Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522729
MD5:	d059de04a3a3332380335593782c6623
SHA1:	0986639f0dda7184b816dfecf738c7064f399d48
SHA256:	77090d1dc1644653d318a6de50c7d614113e58b8e0b320bc94d0edddcc067432
Tags:	exeuser-jstrosch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file overlay found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7780 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D059DE04A3A3332380335593782C6623)

Youbak_MSN_PARTNER2036.exe (PID: 7844 cmdline: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe /VERYSILENT /SP- /NORESTART MD5: D88681C275FD71F42CCAEE06E5901FC9)

Youbak_MSN_PARTNER2036.tmp (PID: 7860 cmdline: "C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp" /SL5="$20468,737659,54272,C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe" /VERYSILENT /SP- /NORESTART MD5: 29BB632F057F068130E8A7877781A05D)

cleanup

Code function: 0_2_00404F66 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404F66

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00423AF4 NtdllDefWindowProc_A,	3_2_00423AF4
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00456060 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	3_2_00456060
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00412548 NtdllDefWindowProc_A,	3_2_00412548
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00476D78 NtdllDefWindowProc_A,	3_2_00476D78
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0042F000 NtdllDefWindowProc_A,	3_2_0042F000

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Code function: 3_2_0042E6A0: 6D1674B0,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

3_2_0042E6A0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403121 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,	0_2_00403121
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_004093A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	2_2_004093A8
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00454680 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	3_2_00454680

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404747	0_2_00404747
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004060FD	0_2_004060FD
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_0040836C	2_2_0040836C
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0047E6EB	3_2_0047E6EB
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0048B890	3_2_0048B890
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0045E038	3_2_0045E038
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0045A0E0	3_2_0045A0E0
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004662DC	3_2_004662DC
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00468354	3_2_00468354
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00484654	3_2_00484654
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00444628	3_2_00444628
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00434788	3_2_00434788
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004309C8	3_2_004309C8
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00444A34	3_2_00444A34
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00450BA4	3_2_00450BA4
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0046F128	3_2_0046F128
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0043D210	3_2_0043D210
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00485588	3_2_00485588
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00443988	3_2_00443988
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00433A84	3_2_00433A84
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0042FE3C	3_2_0042FE3C
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00443F30	3_2_00443F30

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp 4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00405964 appears 106 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00406A2C appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 0043399C appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 004567E0 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00403400 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00445564 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 0045252C appears 90 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 0040785C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00408B74 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00403494 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 004569EC appears 70 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00403684 appears 215 times
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: String function: 00445294 appears 45 times

Source: Youbak_MSN_PARTNER2036.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Youbak_MSN_PARTNER2036.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Youbak_MSN_PARTNER2036.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: Youbak_MSN_PARTNER2036.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Youbak_MSN_PARTNER2036.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Youbak_MSN_PARTNER2036.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: SelfDel.dll.0.dr

Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: _RegDLL.tmp.3.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SelfDel.dll.0.dr

Static PE information: Section: .reloc ZLIB complexity 1.0891089108910892

Source: classification engine

Classification label: mal72.winEXE@5/6@0/0

Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_004093A8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		2_2_004093A8
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00454680 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		3_2_00454680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404232 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,GetDiskFreeSpaceA,MulDiv,

0_2_00404232

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402067 CoCreateInstance,MultiByteToWideChar,

0_2_00402067

Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe

Code function: 2_2_00409B0C FindResourceA,SizeofResource,LoadResource,LockResource,

2_2_00409B0C

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\nsy299C.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe /VERYSILENT /SP- /NORESTART
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Process created: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp "C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp" /SL5="$20468,737659,54272,C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe" /VERYSILENT /SP- /NORESTART
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe /VERYSILENT /SP- /NORESTART	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Process created: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp "C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp" /SL5="$20468,737659,54272,C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe" /VERYSILENT /SP- /NORESTART	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Section loaded: shfolder.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405E06 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405E06

Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_00406518 push 00406555h; ret	2_2_0040654D
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_00408064 push ecx; mov dword ptr [esp], eax	2_2_00408069
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_004040B5 push eax; ret	2_2_004040F1
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_00404185 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_00404206 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_0040C218 push eax; ret	2_2_0040C219
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_004042E8 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_00404283 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: 2_2_00408E98 push 00408ECBh; ret	2_2_00408EC3
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004098B4 push 004098F1h; ret	3_2_004098E9
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004062CC push ecx; mov dword ptr [esp], eax	3_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004582F4 push 00458338h; ret	3_2_00458330
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00410640 push ecx; mov dword ptr [esp], edx	3_2_00410645
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0040A6C8 push esp; retf	3_2_0040A6D1
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00492898 push ecx; mov dword ptr [esp], ecx	3_2_0049289D
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00412898 push 004128FBh; ret	3_2_004128F3
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00442900 push ecx; mov dword ptr [esp], ecx	3_2_00442904
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004509E0 push 00450A13h; ret	3_2_00450A0B
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00456A88 push 00456AC0h; ret	3_2_00456AB8
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00450BA4 push ecx; mov dword ptr [esp], eax	3_2_00450BA9
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0045EC90 push ecx; mov dword ptr [esp], ecx	3_2_0045EC94
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00482EFC push ecx; mov dword ptr [esp], ecx	3_2_00482F01
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0040CF98 push ecx; mov dword ptr [esp], edx	3_2_0040CF9A
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0040546D push eax; ret	3_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0040F4F8 push ecx; mov dword ptr [esp], edx	3_2_0040F4FA
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0040553D push 00405749h; ret	3_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004055BE push 00405749h; ret	3_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0040563B push 00405749h; ret	3_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004056A0 push 00405749h; ret	3_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004818A8 push 00481986h; ret	3_2_0048197E
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00419B98 push ecx; mov dword ptr [esp], ecx	3_2_00419B9D

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	File created: C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	File created: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	3_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	3_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_0042414C IsIconic,SetActiveWindow,SetFocus,	3_2_0042414C
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00424104 IsIconic,SetActiveWindow,	3_2_00424104
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004182F4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	3_2_004182F4
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004227CC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	3_2_004227CC
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00481264 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	3_2_00481264
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00417508 IsIconic,GetCapture,	3_2_00417508
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00417C40 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	3_2_00417C40
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00417C3E IsIconic,SetWindowPos,	3_2_00417C3E

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_2-5936

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

API coverage: 9.1 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004053D0 DeleteFileA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_004053D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405DDF FindFirstFileA,FindClose,	0_2_00405DDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402684 FindFirstFileA,	0_2_00402684
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00451C48 FindFirstFileA,GetLastError,	3_2_00451C48
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00462C34 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	3_2_00462C34
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004630B0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	3_2_004630B0
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004616A8 FindFirstFileA,FindNextFileA,FindClose,	3_2_004616A8
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_004737F4 FindFirstFileA,FindNextFileA,FindClose,	3_2_004737F4
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: 3_2_00495D6C FindFirstFileA,6D1682A0,FindNextFileA,FindClose,	3_2_00495D6C

Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe

Code function: 2_2_00409A50 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

2_2_00409A50

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_0-3290

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405E06 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405E06

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Code function: 3_2_004767BC ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

3_2_004767BC

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Code function: 3_2_0045BB2C GetVersion,GetModuleHandleA,6D166DE0,6D166DE0,6D166DE0,AllocateAndInitializeSid,GetLastError,LocalFree,

3_2_0045BB2C

Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: GetLocaleInfoA,	2_2_0040515C
Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	Code function: GetLocaleInfoA,	2_2_004051A8
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: GetLocaleInfoA,	3_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	Code function: GetLocaleInfoA,	3_2_0040851C

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Code function: 3_2_004575EC GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,6D1674B0,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

3_2_004575EC

Source: C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe

Code function: 2_2_004026C4 GetSystemTime,

2_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Code function: 3_2_00454638 GetUserNameA,

3_2_00454638

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405AEE GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,

0_2_00405AEE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	2 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Obfuscated Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	3 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	68%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Drop.NSIS.ux.1
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe	30%	ReversingLabs	Win32.PUA.Creprote
C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.innosetup.com/	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	Youbak_MSN_PARTNER2036.tmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000000.1411540739.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Youbak_MSN_PARTNER2036.tmp.2.dr	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error	file.exe	false		unknown
http://www.remobjects.com/psU	Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1411073569.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410907677.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000000.1411540739.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Youbak_MSN_PARTNER2036.tmp.2.dr	false		unknown
http://nsis.sf.net/NSIS_ErrorError	file.exe	false	URL Reputation: safe	unknown
http://www.remobjects.com/ps	Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1411073569.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410907677.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000000.1411540739.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Youbak_MSN_PARTNER2036.tmp.2.dr	false	URL Reputation: safe	unknown
http://msn.youbak.com2	Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410581975.0000000001F61000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1414237770.0000000001F61000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://msn.youbak.com#	Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410461810.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1412630705.0000000003100000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://msn.youbak.com	Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410581975.0000000001F61000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410461810.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1414237770.0000000001F61000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413320314.00000000021E8000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413350798.000000000221C000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413025183.0000000002214000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413288845.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1412703141.00000000021E8000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413084543.0000000002218000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1412630705.0000000003100000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522729
Start date and time:	2024-09-30 16:09:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal72.winEXE@5/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 113 Number of non-executed functions: 210
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp	noode.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, PrivateLoader, Socks5Systemz	Browse
	AX3-GUI-45.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	HTMLPhisher	Browse
	AX3-GUI-45.exe	Get hash	malicious	Unknown	Browse
	qgdf1HLJno.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	install.exe	Get hash	malicious	Socks5Systemz	Browse
	install.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1013672
Entropy (8bit):	7.979782969395591
Encrypted:	false
SSDEEP:	24576:620b+HGfS428aNS656djjsIJybodIpp6nOJXo3mJvU2C6/UIhW0j:62xGfS6uS65wj7skdIHBomJvBC6/5j
MD5:	D88681C275FD71F42CCAEE06E5901FC9
SHA1:	3F051192A4EA9722D139CEA2E7D7AEF860880253
SHA-256:	980E63C8F1C312D3DDA44B1FC79CC937357A36C585FCDA7C51A433E36F1600A5
SHA-512:	F096DE74E29554D8960803F272D5C8CD37304D5FCC55D54287D0BD24901C6BF6CF9CA0B33F4D3EE96CDCE5FAB50248ABE9332E5EB47066EB32EE5102737D2D86
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................<......`.............@..........................@.......-...........@..............................P........&..........._..............................................................................................CODE................................ ..`DATA....L...........................@...BSS.....T................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: noode.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: AX3-GUI-45.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: AX3-GUI-45.exe, Detection: malicious, Browse Filename: qgdf1HLJno.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: install.exe, Detection: malicious, Browse Filename: install.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	711168
Entropy (8bit):	6.4824409777908265
Encrypted:	false
SSDEEP:	12288:ruA/arACiIrPe37lzH6A64EGYHuXsr5aER+gjrNAFR9FXsvy8ddXEx9O:rN/arRiIrPe37lzH6A604cs1aEcdFXGH
MD5:	29BB632F057F068130E8A7877781A05D
SHA1:	10060581EB95E61D6AC8176F692A2AE251149B32
SHA-256:	13065EC81BFDF70D1074F8FB90F6EAECAE531B76E71BA1542F3CEFC41A9E29C1
SHA-512:	0B66548EA8690D755566054F42A3886AC983F8402AFD8FF27923F092A71C8404E16ADD8393D314EA056698F51AB0F3260C882C1447B35F73B1830458E70FD405
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................\...z......(h.......p....@..............................................@...............................%......,:..........................................................................................................CODE....`Z.......\.................. ..`DATA.........p.......`..............@...BSS..................r...................idata...%.......&...r..............@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....@.......@..................@..P.....................d..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3685
Entropy (8bit):	3.714680021364841
Encrypted:	false
SSDEEP:	48:qgvd++4+SbkYisPkqipl8KWPvPeMfkR0CXB7AQmJTGIO:T++4+S4YLPFir7WPvPeOkmaZmTE
MD5:	A65AC18F3C745C333818BA4C142639AB
SHA1:	A1737E61EB67FB3BAB5A11CB4CEFFAB8BF2A7EBB
SHA-256:	0C4DF5E0FE04106829C80865D075E992F0A212878C4AFF947FAB9236C991A611
SHA-512:	75275DC1F0324A53634356E2A1F8DBC8800EE8DD3151721B8B95FFA360869831D45037C4FC6DBDF25DF4176453A4DC244FD7C83C7B776651920758081B0C120D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i.j.-...-...-...-...;...O.......r...,......,...Rich-...........................PE..L......C...........!................)........ ...............................P......................................p"..B...\ ..(............................@..X.................................................... ..\............................text.../........................... ..`.rdata....... ......................@..@.data...0....0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.98633319316565
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'043'948 bytes
MD5:	d059de04a3a3332380335593782c6623
SHA1:	0986639f0dda7184b816dfecf738c7064f399d48
SHA256:	77090d1dc1644653d318a6de50c7d614113e58b8e0b320bc94d0edddcc067432
SHA512:	dd73df3b1613d02e518c2698bd13b4d7f4cabfba3a3fc11242a8ff17c28a3574b9b59a4d8fc83215de1e7e4cf7809f780d96c64e7e5fe1b117c15e10245bdf6b
SSDEEP:	24576:jM41a59Lh+PQkqyfIy5JrtqMf8PKM0B/B6QDAAuggo4zqIthbx:oBbYPQZyfIy5JhXfwKMA6Q7uggo4zqo
TLSH:	9C25332A51C0C863EA6951F1A070F639C342FDAE15EC2B4BA7719FCB1C3644E95E60DE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1H..u)..u)..u)...&..w)..u)...)...&..d)...6...).../..t)..Richu)..........PE..L.....:J.................\..........!1.......p....@

File Icon


Icon Hash:	0771ccf8d84d2907

Static PE Info

General

Entrypoint:	0x403121
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4A3AB2A3 [Thu Jun 18 21:33:23 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7fa974366048f9c551ef45714595665e

Entrypoint Preview

Instruction
sub esp, 00000180h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040915Ch
xor esi, esi
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407030h]
push 00008001h
call dword ptr [004070B0h]
push ebx
call dword ptr [0040727Ch]
push 00000008h
mov dword ptr [00423F18h], eax
call 00007F8FA483E0A7h
mov dword ptr [00423E64h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 00000160h
push eax
push ebx
push 0041F424h
call dword ptr [00407158h]
push 00409150h
push 00423660h
call 00007F8FA483DD30h
call dword ptr [004070ACh]
mov edi, 00429000h
push eax
push edi
call 00007F8FA483DD1Eh
push ebx
call dword ptr [0040710Ch]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423E60h], eax
mov eax, edi
jne 00007F8FA483B40Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F8FA483D807h
push eax
call dword ptr [0040721Ch]
mov dword ptr [esp+1Ch], eax
mov cl, byte ptr [eax]
cmp cl, bl
je 00007F8FA483B478h
cmp cl, 00000020h
jne 00007F8FA483B408h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F8FA483B3FCh

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x3b28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x28c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5a38	0x5c00	092e164daa50385128d3c5b319373035	False	0.659561820652174	data	6.403453617755814	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1190	0x1200	4e7f519777030dd2f0ea0d2092babed3	False	0.4453125	data	5.179614628422092	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1af58	0x400	f6d93c048bf148a2daee8a6b0505e38b	False	0.548828125	data	4.617894309842985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x8000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2c000	0x3b28	0x3c00	2f4b4cedcb97ecfcfeb35b10d8fd2983	False	0.6352864583333333	data	5.87475845713189	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2c268	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7213883677298312
RT_ICON	0x2d310	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6751066098081023
RT_ICON	0x2e1b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7851985559566786
RT_ICON	0x2ea60	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.6560693641618497
RT_ICON	0x2efc8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8031914893617021
RT_ICON	0x2f430	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3118279569892473
RT_ICON	0x2f718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.36824324324324326
RT_DIALOG	0x2f840	0x100	data	English	United States	0.5234375
RT_DIALOG	0x2f940	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x2fa60	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x2fac0	0x68	data	English	United States	0.6634615384615384

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, SetFileTime, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetTempPathA
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation
ADVAPI32.dll	RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	10:10:31
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'043'948 bytes
MD5 hash:	D059DE04A3A3332380335593782C6623
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:10:31
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe /VERYSILENT /SP- /NORESTART
Imagebase:	0x400000
File size:	1'013'672 bytes
MD5 hash:	D88681C275FD71F42CCAEE06E5901FC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 30%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:10:32
Start date:	30/09/2024
Path:	C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp" /SL5="$20468,737659,54272,C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe" /VERYSILENT /SP- /NORESTART
Imagebase:	0x400000
File size:	711'168 bytes
MD5 hash:	29BB632F057F068130E8A7877781A05D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.3%
Total number of Nodes:	1298
Total number of Limit Nodes:	23

Executed Functions

Function 00403121 Relevance: 66.8, APIs: 22, Strings: 16, Instructions: 269
comfileshutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403140
SetErrorMode.KERNELBASE(00008001), ref: 0040314B
OleInitialize.OLE32(00000000), ref: 00403152

Part of subcall function 00405E06: GetModuleHandleA.KERNEL32(?,?,00000000,00403164,00000008), ref: 00405E18
Part of subcall function 00405E06: LoadLibraryA.KERNELBASE(?,?,00000000,00403164,00000008), ref: 00405E23
Part of subcall function 00405E06: GetProcAddress.KERNEL32(00000000,?), ref: 00405E34

SHGetFileInfoA.SHELL32(0041F424,00000000,?,00000160,00000000,00000008), ref: 0040317A

Part of subcall function 00405ABA: lstrcpynA.KERNEL32(?,?,00000400,0040318F,00423660,NSIS Error), ref: 00405AC7

GetCommandLineA.KERNEL32(00423660,NSIS Error), ref: 0040318F
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\file.exe",00000000), ref: 004031A2
CharNextA.USER32(00000000,"C:\Users\user\Desktop\file.exe",00000020), ref: 004031CD
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 0040325E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403273
DeleteFileA.KERNELBASE(1033), ref: 00403292

Part of subcall function 0040357E: lstrcmpiA.KERNEL32(?,.exe), ref: 00403677
Part of subcall function 0040357E: GetFileAttributesA.KERNEL32(del), ref: 00403682
Part of subcall function 0040357E: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp), ref: 004036CB

ExitProcess.KERNEL32(00000000), ref: 0040330B

Part of subcall function 004034A0: CloseHandle.KERNEL32(FFFFFFFF,00403310,00000000), ref: 004034AB

CoUninitialize.COMBASE(00000000), ref: 00403310
ExitProcess.KERNEL32 ref: 00403330
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 0040343B
ExitWindowsEx.USER32(00000002,00000000), ref: 00403477
ExitProcess.KERNEL32 ref: 0040349A

Strings

1033, xrefs: 0040328D
C:\Users\user\AppData\Local\Temp\, xrefs: 00403253, 00403258, 00403272, 0040327E, 0040333B, 00403347, 00403353, 0040335A, 004033FA
~nsu.tmp, xrefs: 00403336
\Temp, xrefs: 00403279
C:\Users\user\Desktop, xrefs: 00403341, 00403346, 00403369
", xrefs: 004031F3
C:\Users\user\AppData\Local\Temp, xrefs: 004032ED
NCRC, xrefs: 00403211
NSIS Error, xrefs: 00403180
C:\Users\user\AppData\Local\Temp, xrefs: 00403249, 004032E2, 00403361, 0040336A
"C:\Users\user\Desktop\file.exe", xrefs: 00403195, 0040319B, 004032AF
/D=, xrefs: 00403227
_?=, xrefs: 004032BB
SeShutdownPrivilege, xrefs: 0040344D
C:\Users\user\Desktop\file.exe, xrefs: 004033B4
Error launching installer, xrefs: 004032C8

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitProcess$FileHandle$LoadModuleWindows$AddressAttributesCharCloseCommandCurrentDeleteDirectoryErrorImageInfoInitializeLibraryLineModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\Desktop\file.exe"$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\file.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 1695990901-886356036
Opcode ID: f7a709ca0742978694a3c97eb0af91e4fe8893b2c71dc1a8bd703039c1ec1ec3
Instruction ID: b53188263471dee12f5d149d4766336b7fe55d69321b50a177ee119c3ff264de
Opcode Fuzzy Hash: f7a709ca0742978694a3c97eb0af91e4fe8893b2c71dc1a8bd703039c1ec1ec3
Instruction Fuzzy Hash: D091BF30A08340AFE7216F619D49B2B7EACEB01306F44057EF541B62D2C77C9E058B6E

Function 004053D0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 158
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\user\Desktop\file.exe",00000000), ref: 004053EE
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\*.*,?,?,?,00409010,?,C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\*.*,?,00000000,?,"C:\Users\user\Desktop\file.exe",00000000), ref: 00405470
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 00405527
FindClose.KERNEL32(?), ref: 00405538

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004053D0
"C:\Users\user\Desktop\file.exe", xrefs: 004053DA
\*.*, xrefs: 00405432
C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\*.*, xrefs: 00405422, 00405428, 00405437, 0040546D

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNext
String ID: "C:\Users\user\Desktop\file.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\*.*$\*.*
API String ID: 3592162902-3685466282
Opcode ID: f3c58b3c0ce27e4308d84dedcafb8235b4d8ccf19d0099df7c7845b38bed8bcc
Instruction ID: 74d340b71f8017ed308278dbc42343805d1fc446d82f36b4b8d67d3053e41216
Opcode Fuzzy Hash: f3c58b3c0ce27e4308d84dedcafb8235b4d8ccf19d0099df7c7845b38bed8bcc
Instruction Fuzzy Hash: 97510F30404A447ADB226B218C49BFF3A79DF82719F54807BF905B11D6D77C4A82CE6E

Function 004060FD Relevance: 5.4, APIs: 4, Instructions: 392
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNELBASE(00000000), ref: 00405FE2
GlobalAlloc.KERNELBASE(00000040,?,0040B01C,00004000,00000000), ref: 00405FEB
GlobalFree.KERNELBASE(00000000), ref: 0040606E
GlobalAlloc.KERNELBASE(00000040,00000000,0040B01C,00004000,00000000), ref: 00406079

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: bf58099490c7d3e9217101c12ed11adb7d2dc2cefc16823325d4d14cf14102e6
Instruction ID: 83e4b107c8805b2cf880e51a4f34143165cb8725b81d252219494a40d3d09cfb
Opcode Fuzzy Hash: bf58099490c7d3e9217101c12ed11adb7d2dc2cefc16823325d4d14cf14102e6
Instruction Fuzzy Hash: 2FF16371D00229CBDF28CFA8C8946ADBBB0FF44305F25816ED856BB281D7785A86CF44

Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,004224B0,C:\,004056D2,C:\,C:\,00000000,C:\,C:\,?,?,00000000,004053E4,?,"C:\Users\user\Desktop\file.exe",00000000), ref: 00405DEA
FindClose.KERNEL32(00000000), ref: 00405DF6

Strings

C:\, xrefs: 00405DDF

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: ad41643e803a1296b19ed9780854f03a1804f5503948aa46b41731e22b38ac44
Instruction ID: d997c3b4654e9e49067653d6df9cd6aacba9a2a5bd06b8acd2ab0c350c2db626
Opcode Fuzzy Hash: ad41643e803a1296b19ed9780854f03a1804f5503948aa46b41731e22b38ac44
Instruction Fuzzy Hash: B0D012759095206BC3005778ED0C94B7A59EB053317609A32F565F22E0C378AD918AED

Function 00405E06 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00403164,00000008), ref: 00405E18
LoadLibraryA.KERNELBASE(?,?,00000000,00403164,00000008), ref: 00405E23
GetProcAddress.KERNEL32(00000000,?), ref: 00405E34

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction ID: 4b64482bd895928f148cc5a686a3b2c9a2ee41c2cea76cb4406aa07acf534c14
Opcode Fuzzy Hash: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction Fuzzy Hash: 3CE08C32A04510BBD3115B20AE0896B73A8EAD9B41301487EF655F6251D734AC11DBBA

Function 0040357E Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 216
registrylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405E06: GetModuleHandleA.KERNEL32(?,?,00000000,00403164,00000008), ref: 00405E18
Part of subcall function 00405E06: LoadLibraryA.KERNELBASE(?,?,00000000,00403164,00000008), ref: 00405E23
Part of subcall function 00405E06: GetProcAddress.KERNEL32(00000000,?), ref: 00405E34

lstrcmpiA.KERNEL32(?,.exe), ref: 00403677
GetFileAttributesA.KERNEL32(del), ref: 00403682
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp), ref: 004036CB

Part of subcall function 00405A17: wsprintfA.USER32 ref: 00405A24

RegisterClassA.USER32 ref: 00403712
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 0040372A
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403763
ShowWindow.USER32(00000005,00000000), ref: 00403799
LoadLibraryA.KERNEL32(RichEd20), ref: 004037AA
LoadLibraryA.KERNEL32(RichEd32), ref: 004037B5
GetClassInfoA.USER32(00000000,RichEdit20A,00423600), ref: 004037C5
GetClassInfoA.USER32(00000000,RichEdit,00423600), ref: 004037D2
RegisterClassA.USER32(00423600), ref: 004037DB
DialogBoxParamA.USER32(?,00000000,00403920,00000000), ref: 004037FA

Strings

1033, xrefs: 0040359E, 004035EA
C:\Users\user\AppData\Local\Temp\, xrefs: 00403582
RichEd32, xrefs: 004037B0
.exe, xrefs: 00403671
RichEd20, xrefs: 004037A5
.DEFAULT\Control Panel\International, xrefs: 004035DA
del, xrefs: 00403632, 0040363A, 00403647, 00403663, 00403681, 00403691, 00403697
C:\Users\user\AppData\Local\Temp, xrefs: 004035FE, 00403606, 0040369E, 004036A4, 004036B4
"C:\Users\user\Desktop\file.exe", xrefs: 0040358A
RichEdit, xrefs: 004037CC
RichEdit20A, xrefs: 004037BD, 004037C3
_Nb, xrefs: 00403721, 00403726
Control Panel\Desktop\ResourceLocale, xrefs: 004035B2

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcmpiwsprintf
String ID: "C:\Users\user\Desktop\file.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$del
API String ID: 3298640857-1998729920
Opcode ID: 3622f207a8de84843689798fb021ea29404539eb3abbff87691d54c644945829
Instruction ID: d8b6a56b7098eec18566c7b8ecfdadf94b8a985c1f18c636f14116d312d74c39
Opcode Fuzzy Hash: 3622f207a8de84843689798fb021ea29404539eb3abbff87691d54c644945829
Instruction Fuzzy Hash: 7F61C1B06042007ED620AF659C85F3B3AADEB4474AF80457FF941B22E1D77D9E018A7E

Function 00402C74 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C85
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000400), ref: 00402CA1

Part of subcall function 0040578F: GetFileAttributesA.KERNELBASE(00000003,00402CB4,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 00405793
Part of subcall function 0040578F: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004057B5

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\file.exe,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 00402CED

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402C74
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E4C
"C:\Users\user\Desktop\file.exe", xrefs: 00402C7E
C:\Users\user\Desktop, xrefs: 00402CCF, 00402CD4, 00402CDA
pA, xrefs: 00402D02
Inst, xrefs: 00402D59
C:\Users\user\Desktop\file.exe, xrefs: 00402C8B, 00402C9A, 00402CAE, 00402CCE
Null, xrefs: 00402D6B
soft, xrefs: 00402D62
Error launching installer, xrefs: 00402CC4

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: pA$"C:\Users\user\Desktop\file.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\file.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-77591201
Opcode ID: 618a81ccb80276bd782fabd61a3f0b27549380f8bfdeccb4a79955be0cb22e25
Instruction ID: b606118e793ed5daa4b59b550b8b3073780e541e0a534cf6fb5e0acbaf3dc485
Opcode Fuzzy Hash: 618a81ccb80276bd782fabd61a3f0b27549380f8bfdeccb4a79955be0cb22e25
Instruction Fuzzy Hash: A851E231A41215ABDB209F65DE49B9E7BB8EF14315F24413BE900B72D1C7BC9E418BAC

Function 00402EB2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F10
GetTickCount.KERNEL32 ref: 00402F91
MulDiv.KERNEL32(00000001,00000064,00000020), ref: 00402FBE
wsprintfA.USER32 ref: 00402FCE
WriteFile.KERNELBASE(00000000,0040F01C,0040F01C,00000000,00000000,00000000,?), ref: 00402FFA

Strings

... %d%%, xrefs: 00402FC8

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 40ee30e9fd5152ab7d23f350c32f624ce2127b6ae4ef115e242253f6f80746b3
Instruction ID: 4381862cb37d4cb8e36b80e80363237e84dce081af7ae7260683fe282ac783e9
Opcode Fuzzy Hash: 40ee30e9fd5152ab7d23f350c32f624ce2127b6ae4ef115e242253f6f80746b3
Instruction Fuzzy Hash: 9F51717190220AABDF10DF65DA08A9F7BBCAB44355F14413BF910B72C5C7789E50CBAA

Function 00401765 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 149
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareFileTime.KERNEL32(-00000014,?,del,del,00000000,00000000,del,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 004017D3

Part of subcall function 00405ABA: lstrcpynA.KERNEL32(?,?,00000400,0040318F,00423660,NSIS Error), ref: 00405AC7

Part of subcall function 00404E23: SetWindowTextA.USER32(0041FC3C,0041FC3C), ref: 00404E91
Part of subcall function 00404E23: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EB7
Part of subcall function 00404E23: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404ED1
Part of subcall function 00404E23: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404EDF

Strings

C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll, xrefs: 00401837, 00401853
C:\Users\user\AppData\Local\Temp, xrefs: 00401797
del, xrefs: 00401785, 00401792, 0040179C, 004017AE, 004017BF, 004017F5, 0040180B, 00401829, 00401869, 004018EF, 004018F8, 00401902, 0040190D

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll$del
API String ID: 937995094-2371661106
Opcode ID: 768682712570a18850501d8660df66a62a37743bf310801a9775bb9f9bc60d00
Instruction ID: addc9aa2db3b382a4d0e8f7b3d9efda18be127b7accd4839aa404bfc27cf46c8
Opcode Fuzzy Hash: 768682712570a18850501d8660df66a62a37743bf310801a9775bb9f9bc60d00
Instruction Fuzzy Hash: FA41C531A01514BACF10BB65DD86DAF3679EF41329B20433BF512F21E2D67C4A418EAD

Function 00401F98 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00404E23: SetWindowTextA.USER32(0041FC3C,0041FC3C), ref: 00404E91
Part of subcall function 00404E23: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EB7
Part of subcall function 00404E23: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404ED1
Part of subcall function 00404E23: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404EDF

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FD3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FE3
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040204E

Strings

>B, xrefs: 0040200E

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Library$AddressFreeHandleLoadModuleProcTextWindow
String ID: >B
API String ID: 2049714024-1025945437
Opcode ID: b47d628cdc2b72a844ea518df37b26bb7517ba57572088f8ade541aeec8e758b
Instruction ID: aa6fc6c33b3fdf6314d027099c25d221225d7ff07199dc9467d2da2f8f6cc686
Opcode Fuzzy Hash: b47d628cdc2b72a844ea518df37b26bb7517ba57572088f8ade541aeec8e758b
Instruction Fuzzy Hash: EA21F932D04215B7CF20AFA4DF4DA6E7665AF40358F204237F611B62D0C7BD49819A5E

Function 004015DB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405637: CharNextA.USER32(S@,?,C:\,00000000,0040569D,C:\,C:\,?,?,00000000,004053E4,?,"C:\Users\user\Desktop\file.exe",00000000), ref: 00405645
Part of subcall function 00405637: CharNextA.USER32(00000000), ref: 0040564A
Part of subcall function 00405637: CharNextA.USER32(00000000), ref: 00405659

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 0040164A

Part of subcall function 004055CE: CharNextA.USER32(?,004031CC,"C:\Users\user\Desktop\file.exe",00000020), ref: 004055DF

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 00401603
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 0040160D
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 0040161B

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040163F

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-3707357800
Opcode ID: bffddcac20e3bcd4451fc1ad6022db4a4855f4b064c55159f67b1ca216094a7a
Instruction ID: df909b886637b0bb0bac9a5d09a15d56d747cde8ad7674080f5f79713941c968
Opcode Fuzzy Hash: bffddcac20e3bcd4451fc1ad6022db4a4855f4b064c55159f67b1ca216094a7a
Instruction Fuzzy Hash: 2F010831908140ABDB207B781C4896E37A49A51329728073FF492B22E2D23C4942963E

Function 004057BE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004057D0
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 004057EA

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057BE, 004057C1
"C:\Users\user\Desktop\file.exe", xrefs: 004057C5
nsa, xrefs: 004057C9

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\file.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1681837184
Opcode ID: 039eec692b3cab215364555e49a254316f079165f6bec859b49b181732976f0d
Instruction ID: fcff069b7a085bc23b02539c582d539160aaa44614109564f001e62bd316a6c5
Opcode Fuzzy Hash: 039eec692b3cab215364555e49a254316f079165f6bec859b49b181732976f0d
Instruction Fuzzy Hash: E2F08232748214B6D7104E59AC04B9B7F69DB91750F04C027F904DA180D6B19A5997A5

Function 004052EF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422468,Error launching installer), ref: 00405314
CloseHandle.KERNEL32(?), ref: 00405321

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004052EF
Error launching installer, xrefs: 00405302

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-3625802312
Opcode ID: 136a8c69e03052529237b728483ec7a68084cf12bebd42ffed9ce86d4dbaa0c2
Instruction ID: cc0da3218ca1870966f316b567b6b88986ba0dd0d5b7897c550cf8372f4d746c
Opcode Fuzzy Hash: 136a8c69e03052529237b728483ec7a68084cf12bebd42ffed9ce86d4dbaa0c2
Instruction Fuzzy Hash: 3DE0ECB4A00209BBEB00AF64ED0996B7BBCFB14345B808522A911E2250E7B8D514CE79

Function 004030ED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405D46: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405D9E
Part of subcall function 00405D46: CharNextA.USER32(?,?,?,00000000), ref: 00405DAB
Part of subcall function 00405D46: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405DB0
Part of subcall function 00405D46: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405DC0

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 0040310E

Strings

1033, xrefs: 00403115
C:\Users\user\AppData\Local\Temp\, xrefs: 004030EE, 004030F3, 004030F9, 00403105, 0040310D, 00403114

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3144792594
Opcode ID: 0dd361f5aa555e8b796fae8027a7b2bd2de9e63c724c903c03b9c76945b8c3bd
Instruction ID: 90da95e76a55199b039ea2a058e01b0e2884c6e3a12f4984454634433cc2249d
Opcode Fuzzy Hash: 0dd361f5aa555e8b796fae8027a7b2bd2de9e63c724c903c03b9c76945b8c3bd
Instruction Fuzzy Hash: 25D0522160B83022C9513A263C0AFCF080D8F8332DB52403BF804B91824BAC5A8208EE

Function 00405F14 Relevance: 5.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf66c14af0c056a74c7f0a3626fcf1907275ea5d12f0e8c4362a15e1ea876b2
Instruction ID: cd9ea6a497ca954d9af0e0ea2773304394fd5ac28959d93751cbe7ffc537dccb
Opcode Fuzzy Hash: ecf66c14af0c056a74c7f0a3626fcf1907275ea5d12f0e8c4362a15e1ea876b2
Instruction Fuzzy Hash: 25815671E14228CBEF24CFA8C844BADB7B0FB44305F11816AE456BB280D7B85986DF55

Function 0040678D Relevance: 5.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e01f9bfc12093ebd2a0ace66a6e2983abb1a79ee681fd065951b99aacc9764d
Instruction ID: e06ea804dbf93606c4cf2ec606974c4dc0ffee357b4f6b21e966eca63da280ad
Opcode Fuzzy Hash: 6e01f9bfc12093ebd2a0ace66a6e2983abb1a79ee681fd065951b99aacc9764d
Instruction Fuzzy Hash: 5F912471E00229CFEF24CF98C8547ADBBB1FB44305F16806AD546BB280D7B85996DF45

Function 00406487 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb9fd359c95db430e0465195f4970a86e8f2719c9ef8c5527313d45e4f3266c
Instruction ID: 43c1fa64ae9ad9abbe87c40f05c1c1775fdafde48368947bccf4b02a3e6372c8
Opcode Fuzzy Hash: 5eb9fd359c95db430e0465195f4970a86e8f2719c9ef8c5527313d45e4f3266c
Instruction Fuzzy Hash: 38815671E04229CFEF24CF98C8447ADBBB1FB44305F25806AD446BB280D7789995DF55

Function 004063CE Relevance: 5.2, APIs: 4, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d20c7f478e90be312cd39b007b0cb2ff2d66cd832eda1021e462df0f8e1a227c
Instruction ID: 00e67c9986d3c13f7dc060ca4da6ff0f66469df01e46bc4710d544ff4f2b403c
Opcode Fuzzy Hash: d20c7f478e90be312cd39b007b0cb2ff2d66cd832eda1021e462df0f8e1a227c
Instruction Fuzzy Hash: B5814471E00228CFEF24CF98C844BADBBB0FB44305F21806AE406BB280D7789A95DF55

Function 004064FA Relevance: 5.2, APIs: 4, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83572679ed04b028c43571e03cfafa94b0d1e0d75751db20946e046a77de563
Instruction ID: 33b3cf2dadc0a46e9d82620d4e905de9cd6e7506735f4cffe316a84ff05b4fe5
Opcode Fuzzy Hash: f83572679ed04b028c43571e03cfafa94b0d1e0d75751db20946e046a77de563
Instruction Fuzzy Hash: F7713471E00229CFEF24CF98C854BADBBB1FB44305F26806AE506BB280D7789995DF55

Function 0040643E Relevance: 5.2, APIs: 4, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c79de9321bf552e89de45483f473f641a799cf77810d6ee952ebbb3297c9cb
Instruction ID: 2ad84defe6136893297db3800509cf5dc6111a0e300241fdf9749391c9d2dfd8
Opcode Fuzzy Hash: 68c79de9321bf552e89de45483f473f641a799cf77810d6ee952ebbb3297c9cb
Instruction Fuzzy Hash: AE713871E00229CFEF24CF98C854BADB7B1FB44305F11806AE546BB280D7789A96DF55

Function 00401E5F Relevance: 4.6, APIs: 3, Instructions: 50synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E23: SetWindowTextA.USER32(0041FC3C,0041FC3C), ref: 00404E91
Part of subcall function 00404E23: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EB7
Part of subcall function 00404E23: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404ED1
Part of subcall function 00404E23: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404EDF

Part of subcall function 004052EF: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422468,Error launching installer), ref: 00405314
Part of subcall function 004052EF: CloseHandle.KERNEL32(?), ref: 00405321

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E8E
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EAC

Part of subcall function 00405E3F: PeekMessageA.USER32(?,00000000,00402DF0,00402DF0,00000001), ref: 00405E5A
Part of subcall function 00405E3F: DispatchMessageA.USER32(?), ref: 00405E64

CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401ED1

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$Send$CloseHandleProcess$CodeCreateDispatchExitObjectPeekSingleTextWaitWindow
String ID:
API String ID: 3753073698-0
Opcode ID: 3867a90f1fb0108aa947dff9cec38027b39d2ef8cfb3e029f51d4918e6bd1a69
Instruction ID: a46dd4ec6362f9838c5b44662676efaf077e7f5c45a6b5d2da1a29c0b0f7668f
Opcode Fuzzy Hash: 3867a90f1fb0108aa947dff9cec38027b39d2ef8cfb3e029f51d4918e6bd1a69
Instruction Fuzzy Hash: 6B015E31A04104ABDF209F91CD4499E7BB5EF00315F10407BFA05B51E0C7BD4A829F99

Function 004059A0 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00405BFC,00405BFC,00000002,?,?,00405BFC,80000002,Software\Microsoft\Windows\CurrentVersion,?,del,?,?,00404E5B), ref: 004059C9
RegQueryValueExA.ADVAPI32(00405BFC,?,00000000,80000002,80000002,?,?,00405BFC,80000002,Software\Microsoft\Windows\CurrentVersion), ref: 004059EA
RegCloseKey.ADVAPI32(00405BFC,?,00405BFC,80000002,Software\Microsoft\Windows\CurrentVersion), ref: 00405A0B

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
Instruction ID: 6a26a4cbbe92f56136166bd4860d1e55c9ec7579870860227dca3d620881aae1
Opcode Fuzzy Hash: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
Instruction Fuzzy Hash: 4501567114024AEFDB228F64EC89AEB7FACEF14394F004536F945A6220D235D964DFA5

Function 00405686 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00405ABA: lstrcpynA.KERNEL32(?,?,00000400,0040318F,00423660,NSIS Error), ref: 00405AC7

Part of subcall function 00405637: CharNextA.USER32(S@,?,C:\,00000000,0040569D,C:\,C:\,?,?,00000000,004053E4,?,"C:\Users\user\Desktop\file.exe",00000000), ref: 00405645
Part of subcall function 00405637: CharNextA.USER32(00000000), ref: 0040564A
Part of subcall function 00405637: CharNextA.USER32(00000000), ref: 00405659

GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,00000000,C:\,C:\,?,?,00000000,004053E4,?,"C:\Users\user\Desktop\file.exe",00000000), ref: 004056E9

Strings

C:\, xrefs: 0040568C, 00405691, 00405697, 004056C2, 004056CA, 004056DB, 004056E8

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpyn
String ID: C:\
API String ID: 1620728220-3404278061
Opcode ID: 8b6a650f47c5d77a11693364255d147431381df484ab3129b76ca628e03cb58d
Instruction ID: cf168ce39b7d5aa890c9326bccca8d1b3a6b720b170b0c7d4f5a2b9794c9289a
Opcode Fuzzy Hash: 8b6a650f47c5d77a11693364255d147431381df484ab3129b76ca628e03cb58d
Instruction Fuzzy Hash: ACF02821206E5129C72233365C09AAF2A05CE933647D50D3BF869F13D2DA3E8903CD7E

Function 004013AC Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 0040140B
SendMessageA.USER32(?,00000402,00000000), ref: 0040141B

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: dc31a525b0d78d586b06c459b6c8b59f1dbcd44b7dc1c0b357438cb554342be6
Instruction ID: 8306b540dbad444690881dece7272c135e78fd4af76d6f94f2eda4691c923ec6
Opcode Fuzzy Hash: dc31a525b0d78d586b06c459b6c8b59f1dbcd44b7dc1c0b357438cb554342be6
Instruction Fuzzy Hash: A401D131B14210ABE7245F24AD48B2672A9E714B15F60463BFA11F66F0E67CCD428B59

Function 0040578F Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CB4,C:\Users\user\Desktop\file.exe,80000000,00000003), ref: 00405793
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004057B5

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Function 004034A0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403310,00000000), ref: 004034AB

Strings

C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\, xrefs: 004034BF

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\
API String ID: 2962429428-489695763
Opcode ID: bf564ea65003144b177e2f66b60816cea781d9f28756f3edebc367de77a61f64
Instruction ID: 784c609a44dbd15fcea0832281ee9897f9ae73f7a75bb58e0c1ae8bb1143d783
Opcode Fuzzy Hash: bf564ea65003144b177e2f66b60816cea781d9f28756f3edebc367de77a61f64
Instruction Fuzzy Hash: 4EC0123064460097D2247F74AE0E5053A285741736FA04365F571F40F1D77C5901453F

Function 00405770 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00405573,?,?,?), ref: 00405774
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405786

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 1e5ab56e7945c62be4c341f57016c3f6baca31b7fe5c1c7ce991960d9b2cca7d
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: 31C04CB1808501BFD6015B24DF0D82F7B66EB50321F108B35F569E10F0C7355C66EA1A

Function 004030A4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EFE,000000FF,00000004,00000000,00000000,00000000), ref: 004030BB

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ad01ebe994ea8e5d75c17f9dc7d74897aeb2d9cbe5df98e8e9faa76ff59ceebd
Instruction ID: 895086ffe442742ac6ea60d832c2963359df8ab299286f81918eabf0cb496861
Opcode Fuzzy Hash: ad01ebe994ea8e5d75c17f9dc7d74897aeb2d9cbe5df98e8e9faa76ff59ceebd
Instruction Fuzzy Hash: 7FE08631111119BBDF214F519C00FD63B5CEB04762F008033FA04EA1D0C571AA509BA5

Function 004030D6 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E3B,?), ref: 004030E4

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Non-executed Functions

Function 00404F66 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 281windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00404FC5
GetDlgItem.USER32(?,000003EE), ref: 00404FD4
GetClientRect.USER32(?,?), ref: 00405011
GetSystemMetrics.USER32(00000015), ref: 00405019
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 0040503A
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 0040504B
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 0040505E
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 0040506C
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040507F
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004050A1
ShowWindow.USER32(?,00000008), ref: 004050B5
GetDlgItem.USER32(?,000003EC), ref: 004050D6
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004050E6
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004050FF
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 0040510B
GetDlgItem.USER32(?,000003F8), ref: 00404FE3

Part of subcall function 00403E28: SendMessageA.USER32(00000028,?,00000001,00403C59), ref: 00403E36

GetDlgItem.USER32(?,000003EC), ref: 0040512A
CreateThread.KERNEL32(00000000,00000000,Function_00004EF5,00000000), ref: 00405138
CloseHandle.KERNEL32(00000000), ref: 0040513F
ShowWindow.USER32(00000000), ref: 00405163
ShowWindow.USER32(?,00000008), ref: 00405168
ShowWindow.USER32(00000008), ref: 004051AF
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051E1
CreatePopupMenu.USER32 ref: 004051F2
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405207
GetWindowRect.USER32(?,?), ref: 0040521A
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040523E
SendMessageA.USER32(?,0000102D,?,?), ref: 00405277
OpenClipboard.USER32(00000000), ref: 0040528C
EmptyClipboard.USER32 ref: 00405292
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 0040529B
GlobalLock.KERNEL32(00000000), ref: 004052A5
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052B9
GlobalUnlock.KERNEL32(00000000), ref: 004052D1
SetClipboardData.USER32(00000001,00000000), ref: 004052DC
CloseClipboard.USER32 ref: 004052E2

Strings

{, xrefs: 004051CE

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 9870f1ce2fba9627d33594a99c66d082a961ba676daaf4e718c2990612632be8
Instruction ID: 08e0936ae59f397b4605378a1edb99518d3703162f2206ca35357ddfe10324b1
Opcode Fuzzy Hash: 9870f1ce2fba9627d33594a99c66d082a961ba676daaf4e718c2990612632be8
Instruction Fuzzy Hash: B9A15C71900208BFDB219F60DD85EAE7F79FB04755F00417AFA04BA2A0C7799A42DF59

Function 00404747 Relevance: 56.4, APIs: 30, Strings: 2, Instructions: 420windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040475F
GetDlgItem.USER32(?,00000408), ref: 0040476A
GlobalAlloc.KERNEL32(00000040,?), ref: 004047B4
LoadBitmapA.USER32(0000006E), ref: 004047C7
SetWindowLongA.USER32(?,000000FC,00404D73), ref: 004047E1
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047F6
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 0040480A
SendMessageA.USER32(?,00001109,00000002), ref: 00404820
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 0040482C
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 0040483C
DeleteObject.GDI32(?), ref: 00404841
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404871
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 0040487D
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404918
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404943

Part of subcall function 00403E28: SendMessageA.USER32(00000028,?,00000001,00403C59), ref: 00403E36

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404957
GetWindowLongA.USER32(?,000000F0), ref: 00404986
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404994
ShowWindow.USER32(?,00000005), ref: 004049A5
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A9C
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404B0C
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404B22
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404B44
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B6A
ImageList_Destroy.COMCTL32(?), ref: 00404B7F
GlobalFree.KERNEL32(?), ref: 00404B8F
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404C06
ShowWindow.USER32(?,00000000), ref: 00404C69
GetDlgItem.USER32(?,000003FE), ref: 00404C74
ShowWindow.USER32(00000000), ref: 00404C7B

Strings

M, xrefs: 004048FF
, xrefs: 00404C53

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeLoadMaskedObject
String ID: $M
API String ID: 3675576192-1049183097
Opcode ID: 4618fa708a38249d694b32bd70fbe9416654b157d1f3121e349870d1067c65da
Instruction ID: b153bbacb3e91fb1e2d33faf95d19a4ccd4d645eed3ae2813ebe8e1d5ff954cb
Opcode Fuzzy Hash: 4618fa708a38249d694b32bd70fbe9416654b157d1f3121e349870d1067c65da
Instruction Fuzzy Hash: 2AF19FB0A00209AFEB209F64CD45BAE7BB5FB84315F10413AF714BA2E1D7799A51CF58

Function 00404232 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 271stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040427E
SetWindowTextA.USER32(?,?), ref: 004042AB
SHBrowseForFolderA.SHELL32(?,0041F838,?), ref: 00404360
CoTaskMemFree.OLE32(00000000), ref: 0040436B
lstrcmpiA.KERNEL32(del,00420460), ref: 0040439D

Part of subcall function 00405343: GetDlgItemTextA.USER32(?,?,00000400,004043EC), ref: 00405356

Part of subcall function 00405D46: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405D9E
Part of subcall function 00405D46: CharNextA.USER32(?,?,?,00000000), ref: 00405DAB
Part of subcall function 00405D46: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405DB0
Part of subcall function 00405D46: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405DC0

GetDiskFreeSpaceA.KERNEL32(0041F434,?,?,0000040F,?,0041F434,0041F434,?,00000000,0041F434,?,?,000003FB,?), ref: 00404472
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040448D

Part of subcall function 0040532E: SetDlgItemTextA.USER32(?,?,?), ref: 0040533A

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00404386
A, xrefs: 00404359
del, xrefs: 00404397, 0040439C, 004043A7

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$ItemNextText$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Temp$del
API String ID: 2187339355-149061535
Opcode ID: 0044fd3db1d5ee3921df077c54b0b0b288afed3a920886a143cc4cc486ef188d
Instruction ID: 9833108ab83f13d1216fd3bd0ec19b1ce1809796a8840f851a17381b2ce6f0d3
Opcode Fuzzy Hash: 0044fd3db1d5ee3921df077c54b0b0b288afed3a920886a143cc4cc486ef188d
Instruction Fuzzy Hash: 92A153B1A00118ABDF109FA1DC85AAF7AB9EF84358F10407BFA04B62D1D77C9A41CF59

Function 00405AEE Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 210COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0041FC3C,00000000,?,00404E5B,0041FC3C,00000000,00000000,0040F01C,0040F01C), ref: 00405B9F
GetSystemDirectoryA.KERNEL32(del,00000400), ref: 00405C17
GetWindowsDirectoryA.KERNEL32(del,00000400,?,00404E5B,0041FC3C,00000000), ref: 00405C2A
SHGetSpecialFolderLocation.SHELL32(?,0040F01C,?,00404E5B,0041FC3C,00000000), ref: 00405C6A
SHGetPathFromIDListA.SHELL32(0040F01C,del,?,00404E5B,0041FC3C,00000000), ref: 00405C78
CoTaskMemFree.OLE32(0040F01C,?,00404E5B,0041FC3C,00000000), ref: 00405C84

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405CA8
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405BED
del, xrefs: 00405B1B, 00405BEB, 00405C04, 00405C16, 00405C29, 00405C4D, 00405C74, 00405CAD, 00405CB3, 00405CCC, 00405CDF, 00405CFB, 00405D01, 00405D0C, 00405D39

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindows
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$del
API String ID: 2629221455-2108001582
Opcode ID: 00110967bc701b678de305f9c91e03ececfbbb2a2219761589b9e98642f920be
Instruction ID: fa9f0e703a813b7a27b824d0a196bdede8b756cd7ff50f9c9e599dafcba5bb42
Opcode Fuzzy Hash: 00110967bc701b678de305f9c91e03ececfbbb2a2219761589b9e98642f920be
Instruction Fuzzy Hash: 4E611431A08A55ABEB209F689C887BB7BB4EF11314F14823BE911BA2D0C37C5941DF4D

Function 00402067 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BA
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409348,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402171

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020F2

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-3707357800
Opcode ID: b7064c46d57a15f65ff4574600a3e04ef0947528f292f649836ead34992cb8fa
Instruction ID: c1d0d012afded3b4039fd74b7075fbe76126839184038c5d6160efa632d3cb24
Opcode Fuzzy Hash: b7064c46d57a15f65ff4574600a3e04ef0947528f292f649836ead34992cb8fa
Instruction Fuzzy Hash: F1418E71A00204BFCB10DFA4CD88E9E3BB6AF49324B20456AF905FF2D1DA799D41CB54

Function 00402684 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402693

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 520eb23b417cbef5900151e10629b033abb70deac232ebacd5e489bad6b7fb30
Instruction ID: 7afb1a03dd7f1a0191d37dc0c80b4dee7408fc38be1324a9a7e80c107b976cf9
Opcode Fuzzy Hash: 520eb23b417cbef5900151e10629b033abb70deac232ebacd5e489bad6b7fb30
Instruction Fuzzy Hash: 68F0A732644140ABD710EB649D499EEB768DF51324F60017BF101B20C1C6F849849F2E

Function 00403920 Relevance: 46.8, APIs: 31, Instructions: 345windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 0040395C
ShowWindow.USER32(?), ref: 00403979
DestroyWindow.USER32 ref: 0040398D
SetWindowLongA.USER32(?,00000000,00000000), ref: 004039A9
GetDlgItem.USER32(?,?), ref: 004039CA
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 004039DE
IsWindowEnabled.USER32(00000000), ref: 004039E5
GetDlgItem.USER32(?,00000001), ref: 00403A93
GetDlgItem.USER32(?,00000002), ref: 00403A9D
SetClassLongA.USER32(?,000000F2,?), ref: 00403AB7
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B08
GetDlgItem.USER32(?,00000003), ref: 00403BAE
ShowWindow.USER32(00000000,?), ref: 00403BCF
EnableWindow.USER32(?,?), ref: 00403BE1
EnableWindow.USER32(?,?), ref: 00403BFC
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C12
EnableMenuItem.USER32(00000000), ref: 00403C19
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C31
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C44
SetWindowTextA.USER32(?,00420460), ref: 00403C7C
ShowWindow.USER32(?,0000000A), ref: 00403DB0

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemText
String ID:
API String ID: 4122040696-0
Opcode ID: 4ee09b2caf74cd9129e8788d51bf0cf6fba9c1d38ba174257dc7886376c04bb2
Instruction ID: 822ce4b4a79a00458cb22135b6bf8ac097d43b7102fd8c24891d9a969020acf6
Opcode Fuzzy Hash: 4ee09b2caf74cd9129e8788d51bf0cf6fba9c1d38ba174257dc7886376c04bb2
Instruction Fuzzy Hash: 84C1A071A14204BBDB206F61ED85E2B7E7DEB0470AF50053EF641B12E1C779AA42DB1E

Function 00403F3B Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00403FC6
GetDlgItem.USER32(00000000,000003E8), ref: 00403FDA
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00403FF8
GetSysColor.USER32(?), ref: 00404009
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404018
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404027
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040403F
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040404E
GetDlgItem.USER32(?,0000040A), ref: 004040B2
SendMessageA.USER32(00000000), ref: 004040B5
GetDlgItem.USER32(?,000003E8), ref: 004040E0
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404120
LoadCursorA.USER32(00000000,00007F02), ref: 0040412F
SetCursor.USER32(00000000), ref: 00404138
ShellExecuteA.SHELL32(0000070B,open,00422E00,00000000,00000000,00000001), ref: 0040414B
LoadCursorA.USER32(00000000,00007F00), ref: 00404158
SetCursor.USER32(00000000), ref: 0040415B
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404187
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040419B

Strings

open, xrefs: 00404143
del, xrefs: 0040410B
N, xrefs: 004040CE

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShell
String ID: N$del$open
API String ID: 2553919181-4287126420
Opcode ID: 4f63d35b63b6adf1f30c89e8474c4ba7b959b001eb650b890fe2a7cd87293fdb
Instruction ID: 32cc22161c11fa657b25fe7429f28a10b024f6cccd07486344230bb242fe12d0
Opcode Fuzzy Hash: 4f63d35b63b6adf1f30c89e8474c4ba7b959b001eb650b890fe2a7cd87293fdb
Instruction Fuzzy Hash: B861C271A40309BFEB109F60DC45F6A3B69FB54715F108136FB047A2D1C7B8AA918F99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010E5
FillRect.USER32(00000000,?,00000000), ref: 004010FA
DeleteObject.GDI32(?), ref: 00401103
CreateFontIndirectA.GDI32(?), ref: 0040111B
SetBkMode.GDI32(00000000,00000001), ref: 0040113C
SetTextColor.GDI32(00000000,000000FF), ref: 00401146
SelectObject.GDI32(00000000,?), ref: 00401156
DrawTextA.USER32(00000000,00423660,000000FF,00000010,00000820), ref: 0040116C
SelectObject.GDI32(00000000,00000000), ref: 00401176
DeleteObject.GDI32(?), ref: 0040117B
EndPaint.USER32(?,?), ref: 00401184

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 3e413509c4e3615d2fb3fd13af2a4ccd0d54e8f66ec41a3620c62113ef5b5ce2
Instruction ID: 4032a99e8ae375e5f299f5c9ccfedd970e0385a98bd723899401d4ff11ef6e81
Opcode Fuzzy Hash: 3e413509c4e3615d2fb3fd13af2a4ccd0d54e8f66ec41a3620c62113ef5b5ce2
Instruction Fuzzy Hash: 69517871800209AFCF058FA5CD459BFBBB9FF44315F00812AF952AA2A0C778A955DFA5

Function 00405807 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405E06: GetModuleHandleA.KERNEL32(?,?,00000000,00403164,00000008), ref: 00405E18
Part of subcall function 00405E06: LoadLibraryA.KERNELBASE(?,?,00000000,00403164,00000008), ref: 00405E23
Part of subcall function 00405E06: GetProcAddress.KERNEL32(00000000,?), ref: 00405E34

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405593,?,00000000,000000F1,?), ref: 00405854
GetShortPathNameA.KERNEL32(?,004225F0,00000400), ref: 0040585D
GetShortPathNameA.KERNEL32(00000000,00422068,00000400), ref: 0040587A
wsprintfA.USER32 ref: 00405898
GetFileSize.KERNEL32(00000000,00000000,00422068,C0000000,00000004,00422068,?,?,?,00000000,000000F1,?), ref: 004058D3
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004058E2
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004058F8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421C68,00000000,-0000000A,00409330,00000000,[Rename],?,?,00000000,000000F1,?), ref: 0040593E
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405950
GlobalFree.KERNEL32(00000000), ref: 00405957
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 0040595E

Part of subcall function 004056FE: lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405726
Part of subcall function 004056FE: CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405734

Strings

[Rename], xrefs: 00405908, 0040591A
%s=%s, xrefs: 0040588E
h B, xrefs: 0040586F

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShort$AddressAllocCharFreeLibraryLoadModuleNextPointerProcReadSizeWritelstrcmpiwsprintf
String ID: %s=%s$[Rename]$h B
API String ID: 2212013373-3280566248
Opcode ID: 73f26533948f499e7249a7fda850cf4e84a4f2f79919e681dd76129e890cd5a3
Instruction ID: 1a9792d8d5d9e9aab060a378fd71f88f3442d52d0e04fb3672249972c77e42bc
Opcode Fuzzy Hash: 73f26533948f499e7249a7fda850cf4e84a4f2f79919e681dd76129e890cd5a3
Instruction Fuzzy Hash: 95412171604B12BBD7206B619D49FAB3A5CEB45724F040036FA05F62D2E678A805CEBE

Function 00405D46 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405D9E
CharNextA.USER32(?,?,?,00000000), ref: 00405DAB
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405DB0
CharPrevA.USER32(?,?,"C:\Users\user\Desktop\file.exe",C:\Users\user\AppData\Local\Temp\,00000000,004030F9,C:\Users\user\AppData\Local\Temp\,00000000,00403269), ref: 00405DC0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D47, 00405D82
*?|<>/":, xrefs: 00405D8E
"C:\Users\user\Desktop\file.exe", xrefs: 00405D4C

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\file.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3334322681
Opcode ID: 7fcd70315e273b69258d07be9381e43ed8dfeed35706c3a1724bb024a80f428e
Instruction ID: 752f2ceb6fa339900ba89f291ca2c93cfa1bd721d35065cd8eaccf896ff5a9be
Opcode Fuzzy Hash: 7fcd70315e273b69258d07be9381e43ed8dfeed35706c3a1724bb024a80f428e
Instruction Fuzzy Hash: FB119D55804B952EEB3216384C48BB7BF89CF96760F18847BE8C5722C2D67C5C829E6D

Function 00403E5A Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403E77
GetSysColor.USER32(00000000), ref: 00403E93
SetTextColor.GDI32(?,00000000), ref: 00403E9F
SetBkMode.GDI32(?,?), ref: 00403EAB
GetSysColor.USER32(?), ref: 00403EBE
SetBkColor.GDI32(?,?), ref: 00403ECE
DeleteObject.GDI32(?), ref: 00403EE8
CreateBrushIndirect.GDI32(?), ref: 00403EF2

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 62a9ad4c7a73ffc9cb86ca7c716a8a4c9f862f18c07a6a7207539b231c8623d9
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: 45219671904745ABC7219F78DD08B5BBFF8AF01715F048A29F996E22E0D738EA04CB65

Function 004026C2 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 00402716
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 00402732
GlobalFree.KERNEL32(?), ref: 0040276B
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 0040277D
GlobalFree.KERNEL32(00000000), ref: 00402784
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 0040279C
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004027B0

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: dc259d8af93aae6d3e87d12b280899fdaae246836dd472ee48694a2694c4f43b
Instruction ID: c164b34f633167bc70830bb6fa20a1e613aea451858857728fb4cee29c4a85e9
Opcode Fuzzy Hash: dc259d8af93aae6d3e87d12b280899fdaae246836dd472ee48694a2694c4f43b
Instruction Fuzzy Hash: F3318B71C00128BBDF216FA5CD89DAE7E79EF04324F10422AF910B62E0C77959419BA9

Function 004046C7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004046E2
GetMessagePos.USER32 ref: 004046EA
ScreenToClient.USER32(?,?), ref: 00404704
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404716
SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040473C

Strings

f, xrefs: 00404718

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: be41981aa202d06ba42ecb1d8d9770b4bf4589f765522592d8133ef7c8608880
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 65014071D00219BADB00DBA4DD45BFEBBB8AB55711F10012BBA00B71C0D7B465418B95

Function 00402B8D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402BA8
MulDiv.KERNEL32(0000B200,00000064,?), ref: 00402BD3
wsprintfA.USER32 ref: 00402BE3
SetWindowTextA.USER32(?,?), ref: 00402BF3

Strings

verifying installer: %d%%, xrefs: 00402BDD

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: TextTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 2438957755-82062127
Opcode ID: 4f271783d9116301ef928e9870c70834f4b6e40e89d3dcdab3e6920100e412e8
Instruction ID: c5ff746cdd3f2aec24005ef6ac0e44de3c67302403ed62d2c0be8ecce63342f9
Opcode Fuzzy Hash: 4f271783d9116301ef928e9870c70834f4b6e40e89d3dcdab3e6920100e412e8
Instruction Fuzzy Hash: 2D014470900208ABEB259F60DD0AFEE3769FB04305F008035FA16A92D1D7B49A559B99

Function 00402A7C Relevance: 7.6, APIs: 5, Instructions: 72registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402ABE
RegCloseKey.ADVAPI32(?), ref: 00402AEE
RegCloseKey.ADVAPI32(?), ref: 00402B01
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B31

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: e143a9de713d65b22b45ffa201b3adf8a2d64fbd31a0aab70c993b8dccfa7d2c
Instruction ID: 07d1fbf7a047228144637b536b072ad29fb047bf687eb23e1f1577b756332cb2
Opcode Fuzzy Hash: e143a9de713d65b22b45ffa201b3adf8a2d64fbd31a0aab70c993b8dccfa7d2c
Instruction Fuzzy Hash: 4C211871A00009FADF219F90DE49DAB7B79EB44344F104476FA04B10A0D7B99E51BE69

Function 00401D05 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D09
GetClientRect.USER32(00000000,?), ref: 00401D16
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D37
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D45
DeleteObject.GDI32(00000000), ref: 00401D54

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: e7f555ae755f4011991a2c29fdc406017416609f1097d336ec3c696feb6c7674
Instruction ID: a759b7b63d085fb6f14da2e5a8d19c370c1489c49eb5ebe15418aaa2ecf38cf5
Opcode Fuzzy Hash: e7f555ae755f4011991a2c29fdc406017416609f1097d336ec3c696feb6c7674
Instruction Fuzzy Hash: F1F01DB2A04109BFD700EBA4EE89DAFB7BDEF44315B104476F601F2191C6789D458B29

Function 00405637 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

CharNextA.USER32(S@,?,C:\,00000000,0040569D,C:\,C:\,?,?,00000000,004053E4,?,"C:\Users\user\Desktop\file.exe",00000000), ref: 00405645
CharNextA.USER32(00000000), ref: 0040564A
CharNextA.USER32(00000000), ref: 00405659

Strings

S@, xrefs: 00405640, 00405644
C:\, xrefs: 00405638

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CharNext
String ID: C:\$S@
API String ID: 3213498283-2819263676
Opcode ID: 1ad6e67117f8c956449ae4c5db9bf5aebfa4a1cd2605d5e48cf16f9d5d16c202
Instruction ID: 18696712d74d1b481e2deda0e74adb13b6775f68b3a6dc8b47189095f8000d0b
Opcode Fuzzy Hash: 1ad6e67117f8c956449ae4c5db9bf5aebfa4a1cd2605d5e48cf16f9d5d16c202
Instruction Fuzzy Hash: 38F02751A04B246AEB2122B40C44F7B5BACCB55720F440C77F204B21D0D2BA0C828FA9

Function 00401BEB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C51
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C69

Strings

!, xrefs: 00401C1F

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9e134de257a068e09e10b4953a180385db49f72b228c2e2a68eb950cbb7d2852
Instruction ID: b12435db339aa105ade1be31f14f6de7bd30e81e38517229bc1c50f3127953a2
Opcode Fuzzy Hash: 9e134de257a068e09e10b4953a180385db49f72b228c2e2a68eb950cbb7d2852
Instruction Fuzzy Hash: A5219071A44244BFEF11EFB0DE4AAAE7A76EF44318F14413EF601F61D1D6B88A419B18

Function 00404E23 Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(0041FC3C,0041FC3C), ref: 00404E91
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EB7
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404ED1
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404EDF

Part of subcall function 00405AEE: GetVersion.KERNEL32(?,0041FC3C,00000000,?,00404E5B,0041FC3C,00000000,00000000,0040F01C,0040F01C), ref: 00405B9F

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MessageSend$TextVersionWindow
String ID:
API String ID: 725768855-0
Opcode ID: 1651f495bbe13f20b2cc42b76f3689d4e9eeef9194b9b13d25a13cc865bbdcf4
Instruction ID: e8b907e25bc8824d5dc76fb07b74603c3d15ead815d8bb8d952e82485ab56bcb
Opcode Fuzzy Hash: 1651f495bbe13f20b2cc42b76f3689d4e9eeef9194b9b13d25a13cc865bbdcf4
Instruction Fuzzy Hash: 02218E71A00118BBDF219FA5DD84ADFBFB9FB44354F10807AF904A6290D6794E41CFA8

Function 00401F0C Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401F1B
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F52
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F6B

Part of subcall function 00405A17: wsprintfA.USER32 ref: 00405A24

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: d43b7d5bf52b24a6302c476193d79e7681bc661d7f8915b4152c4bfe2e8e09cd
Instruction ID: 26a014468aa188edf1880291178b8d582cf68a6562efb888f7332690aa7bd06e
Opcode Fuzzy Hash: d43b7d5bf52b24a6302c476193d79e7681bc661d7f8915b4152c4bfe2e8e09cd
Instruction Fuzzy Hash: 0B114F72A00109BFDB01EFA5D985DAEBBB9EF04344B20803AF505F61A1D7789E54DF28

Function 00401D5F Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D66
GetDeviceCaps.GDI32(00000000), ref: 00401D6D
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D7C

Part of subcall function 00405AEE: GetVersion.KERNEL32(?,0041FC3C,00000000,?,00404E5B,0041FC3C,00000000,00000000,0040F01C,0040F01C), ref: 00405B9F

CreateFontIndirectA.GDI32(0040AF50), ref: 00401DCE

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersion
String ID:
API String ID: 3260685224-0
Opcode ID: 699ff77ec8cde7dea788752901c75b556254c38aedfa727075257aad255a4cc5
Instruction ID: 02ec6e9baacee1f01d072f15e9468ddb689b016a2527383320120dc66931aa1e
Opcode Fuzzy Hash: 699ff77ec8cde7dea788752901c75b556254c38aedfa727075257aad255a4cc5
Instruction Fuzzy Hash: 0AF044B1948345AEE701A770AE0AB9A3F64A719305F144535F641BA1E3CA7C1414DB3F

Function 00402C10 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DF0,00000001), ref: 00402C23
GetTickCount.KERNEL32 ref: 00402C41
CreateDialogParamA.USER32(0000006F,00000000,00402B8D,00000000), ref: 00402C5E
ShowWindow.USER32(00000000,00000005), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 7c58fff3741215562ce3e587bd614b66217c6b50781dd9611e7eff0522133455
Instruction ID: cc7f802a35f84cef6f5bdf85897be426ba065069cfc8f20ad423496c920a54dc
Opcode Fuzzy Hash: 7c58fff3741215562ce3e587bd614b66217c6b50781dd9611e7eff0522133455
Instruction Fuzzy Hash: F2F03A3090D220EBD7215F24FE4C98F7A74A708B527118836F404A12E4C7B8D9829FE9

Function 00403847 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00423660), ref: 004038E4

Strings

1033, xrefs: 0040384B, 00403855, 004038CB
C:\Users\user\AppData\Local\Temp\, xrefs: 00403848

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 530164218-3144792594
Opcode ID: 16453532615edf6dcc69895a8fe032745ecc6d2c8d03afc46c8246bdc9ace0af
Instruction ID: fea5df5edc08ba60111476b2fde10976d58b3655a83907dfe6c86257761e8b3f
Opcode Fuzzy Hash: 16453532615edf6dcc69895a8fe032745ecc6d2c8d03afc46c8246bdc9ace0af
Instruction Fuzzy Hash: 59210671B006059BC734AF15DC9093377ADEF8430636882BFE801673A1D73D9E068A98

Function 00404D73 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404DA9
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404E17

Part of subcall function 00403E3F: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 00403E51

Strings

, xrefs: 00404D81

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 76b423985d12a643011934de1796def2cfe54e8fd055aeb45e16926cb9d45637
Instruction ID: e244304c0d1edeb9e0223921f5b1514cf7ade9540d693cc06063b34ee73320ac
Opcode Fuzzy Hash: 76b423985d12a643011934de1796def2cfe54e8fd055aeb45e16926cb9d45637
Instruction Fuzzy Hash: E5116071600219BBDB216F51DC4099B3A69AB80369F00813AF714751E2C3795D918FE9

Function 004034E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\Desktop\file.exe",00000000,00000000,004034BD,00403310,00000000), ref: 004034FF
GlobalFree.KERNEL32(?), ref: 00403506

Strings

"C:\Users\user\Desktop\file.exe", xrefs: 004034F7

Memory Dump Source

Source File: 00000000.00000002.1411014885.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1410999178.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411036392.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411051465.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1411106754.000000000042C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\Desktop\file.exe"
API String ID: 1100898210-2214761044
Opcode ID: 914631cf79bc4f5712b993741e1832c0d075bb2cc09114bf11dfbba85481bbc1
Instruction ID: 9cab24f12007134522121f8ccde68e98ee389680b10af2b039e95af53afe0655
Opcode Fuzzy Hash: 914631cf79bc4f5712b993741e1832c0d075bb2cc09114bf11dfbba85481bbc1
Instruction Fuzzy Hash: F7E08C32810020ABD7225F54BC0579A776C6B98B32F058137F9007B2A087746D824AE8

Analysis Process: Youbak_MSN_PARTNER2036.exePID: 7844, Parent PID: 7780COMMON

Execution Graph

Execution Coverage:	21.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	1468
Total number of Limit Nodes:	28

Executed Functions

Function 00409A50 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409A62
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409A6D
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409AAE
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409AE0
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409AF0

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 7201f50c1bbc867616f34b0d7869ade918e84d4ffec2886a855211ecfaafd62a
Instruction ID: f454ad9899b025228c1f7fcdea0b90f60778d00e9e42dca68456bdeb88109946
Opcode Fuzzy Hash: 7201f50c1bbc867616f34b0d7869ade918e84d4ffec2886a855211ecfaafd62a
Instruction Fuzzy Hash: 7F2181B13003446BDB30DA998C85E6777D89F85364F04493AFA85E23D3D779ED40CA59

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction ID: b78bf48cff894a3999656c5243e329942f020ab22272e2e872fdbeeaebf0035e
Opcode Fuzzy Hash: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction Fuzzy Hash: EDE09271B0021426D711A9699C86AEB735DDB58310F0006BFB904EB3C6EDB49E8046ED

Function 0040A003 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040A00F

Part of subcall function 0040949C: GetLastError.KERNEL32(00000000,0040953F,?,0040B240,?,01F51E48), ref: 004094C0

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A04C
SetWindowLongA.USER32(00020468,000000FC,00409838), ref: 0040A063
RemoveDirectoryA.KERNEL32(00000000,0040A1A2,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A14F
73F85CF0.USER32(00020468,0040A1A2,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A163

Strings

InnoSetupLdrWindow, xrefs: 0040A040
STATIC, xrefs: 0040A045
/SL5="$%x,%d,%d,, xrefs: 0040A0A3

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLastWindow$CreateDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3341979996-3001827809
Opcode ID: 5d513686816418ae243219bf7528eb4b9db1107b46c668a60ca7906752dc9ac7
Instruction ID: 1f7e7fc7b16e3061b9688a463084272918fb4b7ca7fd913d180e89589801694f
Opcode Fuzzy Hash: 5d513686816418ae243219bf7528eb4b9db1107b46c668a60ca7906752dc9ac7
Instruction Fuzzy Hash: 9A411A70600205DFD711EBA9EE86B9A7BA5EB45304F10427BF110BB3E2DB789845CB9D

Function 00409004 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040909D,?,?,?,?,00000000,?,00409B8F), ref: 00409024
6D166DE0.KERNEL32(00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040909D,?,?,?,?,00000000,?,00409B8F), ref: 0040902A
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040909D,?,?,?,?,00000000,?,00409B8F), ref: 0040903E
6D166DE0.KERNEL32(00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040909D,?,?,?,?,00000000,?,00409B8F), ref: 00409044

Strings

shell32.dll, xrefs: 00409070
Wow64RevertWow64FsRedirection, xrefs: 00409034
Wow64DisableWow64FsRedirection, xrefs: 0040901A
kernel32.dll, xrefs: 0040901F, 00409039

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModule
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 439651959-2130885113
Opcode ID: 25df230f82b2c79a3aa95c836895d72a490780489c89180c14923933fe6b72f2
Instruction ID: 72ad054f56adce7298f13d7b65f4c4f8572bdb54ea2996b6cde6789755c9e6b9
Opcode Fuzzy Hash: 25df230f82b2c79a3aa95c836895d72a490780489c89180c14923933fe6b72f2
Instruction Fuzzy Hash: 22018F70208300EEEB10BB76DC47B163AA8E785B14F60447BF604B62D3DA7D4D04CA6E

Function 00409FF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A04C
SetWindowLongA.USER32(00020468,000000FC,00409838), ref: 0040A063

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A0D4,?), ref: 00406AF4

Part of subcall function 004098C4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004099BC,01F51E48,004099B0,00000000,00409997), ref: 00409934
Part of subcall function 004098C4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004099BC,01F51E48,004099B0,00000000), ref: 00409948
Part of subcall function 004098C4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409961
Part of subcall function 004098C4: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409973
Part of subcall function 004098C4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004099BC,01F51E48,004099B0), ref: 0040997C

RemoveDirectoryA.KERNEL32(00000000,0040A1A2,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A14F
73F85CF0.USER32(00020468,0040A1A2,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A163

Strings

InnoSetupLdrWindow, xrefs: 0040A040
STATIC, xrefs: 0040A045
/SL5="$%x,%d,%d,, xrefs: 0040A0A3

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 978128352-3001827809
Opcode ID: d166a4cec2fc33cb56bfbbabcb8daa70af576f639edca3908572750b16a4c946
Instruction ID: a7b6eb54af5060593f1dc40a182d07bad82914a8e6ed89a98b428be1cc587243
Opcode Fuzzy Hash: d166a4cec2fc33cb56bfbbabcb8daa70af576f639edca3908572750b16a4c946
Instruction Fuzzy Hash: F1414B70604204DFD710EBA9EE86B9A77A5EB48304F20827BF110B77E1DB789845CB9D

Function 004098C4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004099BC,01F51E48,004099B0,00000000,00409997), ref: 00409934
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004099BC,01F51E48,004099B0,00000000), ref: 00409948
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409961
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409973
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004099BC,01F51E48,004099B0), ref: 0040997C

Part of subcall function 0040949C: GetLastError.KERNEL32(00000000,0040953F,?,0040B240,?,01F51E48), ref: 004094C0

Strings

D, xrefs: 0040990E

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 6cd749b7da8c447fd26e412475d3e6c1201e0a1137176375851fbb0900f59f1e
Instruction ID: bdd927f14c3698a1a1570e24eb7dd81e4fd7863d50f3020ec4c945394429738e
Opcode Fuzzy Hash: 6cd749b7da8c447fd26e412475d3e6c1201e0a1137176375851fbb0900f59f1e
Instruction Fuzzy Hash: 12114FB16442086EDB10EBE6CC52FAEB7ACEF49714F50007FB604F72C6DA789D048669

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00409D62 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409DC6

Strings

.tmp, xrefs: 00409E0C
$u@, xrefs: 00409E7A
Hy@, xrefs: 00409ECF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp$Hy@
API String ID: 2030045667-3467318143
Opcode ID: 7e3326119f0f45bf3fdc8ffe6fce87748f707ac64b952cdb44e1f50d64bea5b8
Instruction ID: 0fcf381c82764b4c9d7c70074c7f75f418c395a73277f9788cc20b10a1b959eb
Opcode Fuzzy Hash: 7e3326119f0f45bf3fdc8ffe6fce87748f707ac64b952cdb44e1f50d64bea5b8
Instruction Fuzzy Hash: 0141AF30614201DFD315EF25DE92A1A7BA6FB49704B60457AF801B77E2CB79AC01CBAD

Function 00409D7D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409DC6

Strings

.tmp, xrefs: 00409E0C
$u@, xrefs: 00409E7A
Hy@, xrefs: 00409ECF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp$Hy@
API String ID: 2030045667-3467318143
Opcode ID: dd301ae767feb5139ffce102741ee14f65d9c8096cb46c7d46dfbabafacc20fb
Instruction ID: b33f538e520dd1c81796310b03ba0e64836a70915577e91deec38726eba2a1aa
Opcode Fuzzy Hash: dd301ae767feb5139ffce102741ee14f65d9c8096cb46c7d46dfbabafacc20fb
Instruction Fuzzy Hash: 1F41BE30610201DFC315EF25DE92A1A7BA6FB49708B10457AF801B77E2CB79AC01CBAD

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 00409290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040937F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092D6
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040937F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092DF

Strings

.tmp, xrefs: 004092BF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: c29b4afbc625b0adb94a8cd3073cadbee00818e16f6f1e3b2c629215ed2a0195
Instruction ID: 52471fc28369041db9dc80566a9fc74e846417a9792ccad030e5e87360f7ab1a
Opcode Fuzzy Hash: c29b4afbc625b0adb94a8cd3073cadbee00818e16f6f1e3b2c629215ed2a0195
Instruction Fuzzy Hash: 7A211A74A002099BDB01EBA1C9529DFB7B9EF48304F50457BE901B73C2DA7C9E059A65

Function 00409438 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A13B,000000FA,00000032,0040A1A2), ref: 00409457
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A13B,000000FA,00000032,0040A1A2), ref: 00409467
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A13B,000000FA,00000032,0040A1A2), ref: 0040947A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A13B,000000FA,00000032,0040A1A2), ref: 00409484

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 07d8f92f5a140c3baa791f56a037d46507faa73f0e250797275cfabcff61e676
Instruction ID: c88bf81094fe9498b3f4a43de29c1033330ebaee36a687def7254f10b7ff23de
Opcode Fuzzy Hash: 07d8f92f5a140c3baa791f56a037d46507faa73f0e250797275cfabcff61e676
Instruction Fuzzy Hash: 6DF0B476A0811477CB34E5AE9D81A6F628DDBD1369710803FFA54F3283C579CD0242AE

Function 00408F1C Relevance: 3.0, APIs: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6D167770.KERNEL32(00000000,00000000,00408F79,?,0000000D,00000000), ref: 00408F53
GetLastError.KERNEL32(00000000,00000000,00408F79,?,0000000D,00000000), ref: 00408F5B

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167770ErrorLast
String ID:
API String ID: 4081035853-0
Opcode ID: f2cb50cc657bda14d3bb312ac10fd5a86930a6c163d77b3ac60cb23cdc188d21
Instruction ID: a15b2d46f4e197b9001b9aeeb57ba92ae3624390afab9249dc216eb4faede85a
Opcode Fuzzy Hash: f2cb50cc657bda14d3bb312ac10fd5a86930a6c163d77b3ac60cb23cdc188d21
Instruction Fuzzy Hash: D4F0C271B04709AFCB01EFB59D414AEB7E9EB88714B5045BBF804F3281EF789E1085A9

Function 0040A19D Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNEL32(00000000,0040A1A2,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A14F
73F85CF0.USER32(00020468,0040A1A2,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A163

Part of subcall function 00409438: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A13B,000000FA,00000032,0040A1A2), ref: 00409457
Part of subcall function 00409438: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A13B,000000FA,00000032,0040A1A2), ref: 0040947A
Part of subcall function 00409438: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A13B,000000FA,00000032,0040A1A2), ref: 00409484

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast$DirectoryRemoveSleep
String ID:
API String ID: 936953547-0
Opcode ID: a00273ca4a8178c961b9720f82700e3d8e15a9a0b1c761a42b4abaec5ddbfeef
Instruction ID: 0c8896f5df820562778f557013a9bf53dced06f03082227eb4dbd77002fc3682
Opcode Fuzzy Hash: a00273ca4a8178c961b9720f82700e3d8e15a9a0b1c761a42b4abaec5ddbfeef
Instruction Fuzzy Hash: EFF0EC70201200DBD725FB69EFDAB9537A5AB44309F14463BA100BA6F1DBBC9881CB8D

Function 00406F00 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406F0A
LoadLibraryA.KERNEL32(00000000,00000000,00406F54,?,00000000,00406F72,?,00008000), ref: 00406F39

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction ID: 61c75ae37e4b7eabf140846b9e9d3e90831ba1beb5fed57b889ca027c52d2016
Opcode Fuzzy Hash: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction Fuzzy Hash: 49F08270614704BEDB029FB69C6282BBBFCE749B0475348B6F904A26D2E53C5D208568

Function 004075CC Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 004075EB
GetLastError.KERNEL32(?,?,?,00000000), ref: 004075F3

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,01F503AC,?,00409BE9,00000001,00000000,00000002,00000000,0040A1E0,?,00000000,0040A217), ref: 004073EF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction ID: cda5b13584bb414d1d7c0d7cef5a43535e1b929ad68122291bf656bee98e9d77
Opcode Fuzzy Hash: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction Fuzzy Hash: A0E092766081016FD601D55EC881B9B33DCDFC5365F00453ABA54EB2D1D675AC0087B6

Function 0040758C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 004075A3
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004075B2

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction ID: 6d0e635579d8ef6deec62af0acb898b5effba2491802df9b0589d4017bc118ea
Opcode Fuzzy Hash: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction Fuzzy Hash: 4FE012B1A181147AEB24965A9CC5FAB6BDCCBC5314F14847BF904DB282D678DC04877B

Function 00407524 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 0040753B
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407547

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,01F503AC,?,00409BE9,00000001,00000000,00000002,00000000,0040A1E0,?,00000000,0040A217), ref: 004073EF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction ID: cd7afd6369a15af5fc7b0f7528e30ca6696358c0ea2e6c45e94f6e0b4d50a73a
Opcode Fuzzy Hash: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction Fuzzy Hash: 0EE04FB1600210AFEB10EEB98C81B9672DC9F48364F048576EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 004051D0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405306), ref: 004051EF

Part of subcall function 00404C2C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404C49

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction ID: c760dbbb10683706500036a577470844d35ac6ab0c013c9c95042e4326961867
Opcode Fuzzy Hash: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction Fuzzy Hash: 3B313D75E00119ABCB00EF95C8C19EEB779FF84304F158977E815BB285E739AE058B98

Function 004074D6 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D1674
String ID:
API String ID: 2996001779-0
Opcode ID: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 004074D8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D1674
String ID:
API String ID: 2996001779-0
Opcode ID: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 0040693C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406984,?,?,?,?,00000000,?,00406999,00406CC7,00000000,00406D0C,?,?,?), ref: 00406967

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction ID: a5d31a369ac9c1460ce21b6bb4ed2cb839aeaeb50f5f76e03c39097c5263300d
Opcode Fuzzy Hash: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction Fuzzy Hash: A9E065712043047FD701EA629C52959B7ACDB89708B924476B501A6682D5785E108568

Function 00407628 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040763F

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,01F503AC,?,00409BE9,00000001,00000000,00000002,00000000,0040A1E0,?,00000000,0040A217), ref: 004073EF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction ID: 68b513bd5595dc6b38f1d245c0222f257f742b1e6f06676187839ef0e6677733
Opcode Fuzzy Hash: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction Fuzzy Hash: 93E01A727081106BEB10E65EDCC0EABA7DCDFC5764F04547BBA08EB291D674AC049676

Function 004071E4 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409087,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 00407203

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction ID: 095b59eb22c1ada42cfe979e419102ec0d22498c88dfceb067fba30b4837873c
Opcode Fuzzy Hash: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction Fuzzy Hash: 8DE0D8A0B8830125F22514544C87B77110E53C0700F50847EB710ED3D3D6BEA90641AF

Function 0040760C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,01F67FF4,00409FA7,00000000), ref: 00407613

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,01F503AC,?,00409BE9,00000001,00000000,00000002,00000000,0040A1E0,?,00000000,0040A217), ref: 004073EF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction ID: 5d9383f6f08d3e81a9fa52c4aba0b6319cc61be016c813106cdb36ce464f185a
Opcode Fuzzy Hash: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction Fuzzy Hash: 39C04CB1A0450047DB40A6BE99C1A0662DC5A483157045576BA08DB297D679E8009665

Function 00406F5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction ID: 754ecbd0d3eeca534395493226652c0236480d823d7569c9efe771d01927bad3
Opcode Fuzzy Hash: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction Fuzzy Hash: 97B09B7661C2015DE705D6D5745193863F4D7C47103A1457BF104D25C0D57CD4144518

Function 00406F77 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction ID: 7c61e226393e4972c06343dd54fa3db727d2c771c967085a02b7622724de7152
Opcode Fuzzy Hash: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction Fuzzy Hash: BAA022A8C00002B2CE00E2F08080A3C23282A8C3003C00AAA322EB20C0C03CC000822A

Function 004068D0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,004068CC,?,004065A9,?,?,00406CE7,00000000,00406D0C,?,?,?,?,00000000,00000000), ref: 004068D2

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction Fuzzy Hash:

Function 00407E70 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407F00

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bcbcab35e69e4aac02ddc8f9306424be7352c7af00132f0a6ac812590d81b4ba
Instruction ID: fc41cd242ecd06977689102cbc3fe0dda7292da63ddead5a333d1a1ffb22ba19
Opcode Fuzzy Hash: bcbcab35e69e4aac02ddc8f9306424be7352c7af00132f0a6ac812590d81b4ba
Instruction Fuzzy Hash: 0A1184716082059FDB10EF19C881B4B3794EF84359F15847FF958AB2C6DA38EC01CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 004074A8 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004074B8

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction ID: 0172511661962fd54a17c381567595eb1d39a1afdb2a9088c563811225ee2893
Opcode Fuzzy Hash: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction Fuzzy Hash: FDD05E81B00A6017D215E2BE498864696C85F88745B08847AFA84E73D1D67CAC008399

Function 00407E18 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407DFD), ref: 00407E2F

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1093f2965c8d826e2d9255731fcf61e27ff6ff650429467d7a56a0a768ac96fe
Instruction ID: febac6bc74e6b78133d4c9973fd00bf1b5266498df1910f6a89c28e3011ccf1e
Opcode Fuzzy Hash: 1093f2965c8d826e2d9255731fcf61e27ff6ff650429467d7a56a0a768ac96fe
Instruction Fuzzy Hash: E9D0E9B17553055BDB90EEB98CC5B0237D87B48604F5044B66908EB296E774E8009654

Non-executed Functions

Function 004093A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004093B7
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004093BD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004093D6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 004093FD
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00409402
ExitWindowsEx.USER32(00000002,00000000), ref: 00409413

Strings

SeShutdownPrivilege, xrefs: 004093CF

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5f11c42dfc459d8c8d745bef3874dea2540740a64161af9a8cfd559d3eb700c3
Instruction ID: 6d7ed6c9cda2f1ce1f9f93618b8ae596d287dd3264b4ec817c14c29068bbf8ac
Opcode Fuzzy Hash: 5f11c42dfc459d8c8d745bef3874dea2540740a64161af9a8cfd559d3eb700c3
Instruction Fuzzy Hash: D6F036B079831576E620AA718D07F6762C89BC5B08F50493ABF11FA1C3D7BDD809466F

Function 00409B0C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409B16
SizeofResource.KERNEL32(00000000,00000000,?,00409C01,00000000,0040A198,?,00000001,00000000,00000002,00000000,0040A1E0,?,00000000,0040A217), ref: 00409B29
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409C01,00000000,0040A198,?,00000001,00000000,00000002,00000000,0040A1E0,?,00000000), ref: 00409B3B
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409C01,00000000,0040A198,?,00000001,00000000,00000002,00000000,0040A1E0), ref: 00409B4C

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 376c05bc37c95194bc326ac3b717fe79ec3e42ad3bbb289724ae4c4e289e3edd
Instruction ID: 6064aaca9a792ef40435c2eee74f3701aac6da7f3f1b996cd847f096d57c9d2c
Opcode Fuzzy Hash: 376c05bc37c95194bc326ac3b717fe79ec3e42ad3bbb289724ae4c4e289e3edd
Instruction Fuzzy Hash: 2BE05AE035430665EA6036EB1CC2B2A21185BA472DF00003FB740792C3DDACAC04912E

Function 004051A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction ID: dec8dcb9893e8432c944e1b70884c8cc40709e939aac0c2d0d2241257bb7fc31
Opcode Fuzzy Hash: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction Fuzzy Hash: D3D05EB631E6502AE210519B2D85EBB4EACCAC57A4F14443BF648DB242D2248C069776

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 00406F84 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00406FAD
6D166DE0.KERNEL32(00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00406FB3
6D167B60.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00407001

Strings

.DEFAULT\Control Panel\International, xrefs: 00406FD8
Control Panel\Desktop\ResourceLocale, xrefs: 00407010
kernel32.dll, xrefs: 00406FA8
GetUserDefaultUILanguage, xrefs: 00406FA3
Locale, xrefs: 00406FF0

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166D167HandleModule
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 1587692801-2401316094
Opcode ID: e3d1d02752a949e7be31ad703c02a9802a243e51059f8895845ba5cb13b9df21
Instruction ID: 4848c3cc747176469ce0ef08a48ea257d9f62360c4c8e5a9f2e1a14c28c6fa3b
Opcode Fuzzy Hash: e3d1d02752a949e7be31ad703c02a9802a243e51059f8895845ba5cb13b9df21
Instruction Fuzzy Hash: C3217370E04209ABDB10EBB5CD51B9F77A8EB44304F60857BA500F72C1DB7CAA05879E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: File$HandlePointer$CloseD1674ErrorLastReadSizeType
String ID:
API String ID: 1365492021-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 00405314 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040555C,?,?,?,?,00000000,00000000,00000000,?,0040653B,00000000,0040654E), ref: 0040532E

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Part of subcall function 004051A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Strings

m/d/yy, xrefs: 004053FD
AMPM, xrefs: 004054F9
:mm, xrefs: 00405510
:mm:ss, xrefs: 0040552A
mmmm d, yyyy, xrefs: 0040541F

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction ID: f22f4b18e1885e1925b87b286fa486de3d96a381b4aec2b7527aff107c54c5fa
Opcode Fuzzy Hash: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction Fuzzy Hash: 8E514234B00648ABDB00EBA59C91B9F776ADB89304F50957BB514BB3C6CA3DCA058B5C

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409B76), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409B76), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000002.00000002.1414337628.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1414325313.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414350666.000000000040B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1414362855.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Analysis Process: Youbak_MSN_PARTNER2036.tmpPID: 7860, Parent PID: 7844COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 0048B890 Relevance: 136.6, APIs: 22, Strings: 55, Instructions: 1871COMMON

Download Yara Rule

Strings

REGQUERYMULTISTRINGVALUE, xrefs: 0048C5DB
SETINIINT, xrefs: 0048BBF9
GETINIBOOL, xrefs: 0048BA7B
REGQUERYDWORDVALUE, xrefs: 0048C69D
REGWRITEDWORDVALUE, xrefs: 0048CB9B
INIKEYEXISTS, xrefs: 0048BAE6
STRINGCHANGEEX, xrefs: 0048C069
REGWRITEMULTISTRINGVALUE, xrefs: 0048CA91
CHARLENGTH, xrefs: 0048CE28
ADDPERIOD, xrefs: 0048CDF0
SETNTFSCOMPRESSION, xrefs: 0048CE69
ADDQUOTES, xrefs: 0048BEB5
GETWINDIR, xrefs: 0048BF62
REGDELETEVALUE, xrefs: 0048C39A
GETSHORTNAME, xrefs: 0048BF25
DELETEINISECTION, xrefs: 0048BD1D
PARAMSTR, xrefs: 0048BDDB
REGWRITESTRINGVALUE, xrefs: 0048C899
ISADMINLOGGEDON, xrefs: 0048CD4F
DELETEINIENTRY, xrefs: 0048BCCF
REGDELETEKEYINCLUDINGSUBKEYS, xrefs: 0048C2E4
FILEORDIREXISTS, xrefs: 0048B949
REGKEYEXISTS, xrefs: 0048C1C5
GETUILANGUAGE, xrefs: 0048CDCB
GETENV, xrefs: 0048BD57
GETSYSTEMDIR, xrefs: 0048BF8A
FILEEXISTS, xrefs: 0048B8D7
SETINIBOOL, xrefs: 0048BC64
REGDELETEKEYIFEMPTY, xrefs: 0048C33F
REMOVEBACKSLASHUNLESSROOT, xrefs: 0048BE7D
ADDBACKSLASH, xrefs: 0048BE0D
USINGWINNT, xrefs: 0048C0DD
FONTEXISTS, xrefs: 0048CD97
REMOVEBACKSLASH, xrefs: 0048BE45
REGVALUEEXISTS, xrefs: 0048C242
SETINISTRING, xrefs: 0048BB8A
REGWRITEEXPANDSTRINGVALUE, xrefs: 0048C9B0
CONVERTPERCENTSTR, xrefs: 0048C184
FILECOPY, xrefs: 0048C101
REGQUERYBINARYVALUE, xrefs: 0048C77A
GETTEMPDIR, xrefs: 0048BFDA
REGGETVALUENAMES, xrefs: 0048C4AC
REGWRITEBINARYVALUE, xrefs: 0048CC6F
GETINISTRING, xrefs: 0048B982
ISPOWERUSERLOGGEDON, xrefs: 0048CD73
GETINIINT, xrefs: 0048B9F6
DIREXISTS, xrefs: 0048B910
REGQUERYSTRINGVALUE, xrefs: 0048C519
ISINISECTIONEMPTY, xrefs: 0048BB42
GETCMDTAIL, xrefs: 0048BD8F
REMOVEQUOTES, xrefs: 0048BEED
REGGETSUBKEYNAMES, xrefs: 0048C43F
STRINGCHANGE, xrefs: 0048C002
GETSYSWOW64DIR, xrefs: 0048BFB2
PARAMCOUNT, xrefs: 0048BDB7

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID:
String ID: ADDBACKSLASH$ADDPERIOD$ADDQUOTES$CHARLENGTH$CONVERTPERCENTSTR$DELETEINIENTRY$DELETEINISECTION$DIREXISTS$FILECOPY$FILEEXISTS$FILEORDIREXISTS$FONTEXISTS$GETCMDTAIL$GETENV$GETINIBOOL$GETINIINT$GETINISTRING$GETSHORTNAME$GETSYSTEMDIR$GETSYSWOW64DIR$GETTEMPDIR$GETUILANGUAGE$GETWINDIR$INIKEYEXISTS$ISADMINLOGGEDON$ISINISECTIONEMPTY$ISPOWERUSERLOGGEDON$PARAMCOUNT$PARAMSTR$REGDELETEKEYIFEMPTY$REGDELETEKEYINCLUDINGSUBKEYS$REGDELETEVALUE$REGGETSUBKEYNAMES$REGGETVALUENAMES$REGKEYEXISTS$REGQUERYBINARYVALUE$REGQUERYDWORDVALUE$REGQUERYMULTISTRINGVALUE$REGQUERYSTRINGVALUE$REGVALUEEXISTS$REGWRITEBINARYVALUE$REGWRITEDWORDVALUE$REGWRITEEXPANDSTRINGVALUE$REGWRITEMULTISTRINGVALUE$REGWRITESTRINGVALUE$REMOVEBACKSLASH$REMOVEBACKSLASHUNLESSROOT$REMOVEQUOTES$SETINIBOOL$SETINIINT$SETINISTRING$SETNTFSCOMPRESSION$STRINGCHANGE$STRINGCHANGEEX$USINGWINNT
API String ID: 0-948651152
Opcode ID: 1d1db12cd46013362a47805e6ba9d68d80aae8febe31137ad0331960414a684c
Instruction ID: 69d56f8011f8ecca944051e3708884fad6064d0099524071a57294257ef19ca1
Opcode Fuzzy Hash: 1d1db12cd46013362a47805e6ba9d68d80aae8febe31137ad0331960414a684c
Instruction Fuzzy Hash: EBD21F70B001155BDB10FF7ADC825AEA7A6AF59704F50883FB501A7386DE3CED0687A9

Function 00423B7C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2f13614f49997398129d75232017c1e0aeac01b17bc2213285dcafd92c03c3
Instruction ID: eb590f941f7570ce9330ca46e378813a91b16e024a0b8130a17817d45558a203
Opcode Fuzzy Hash: 6b2f13614f49997398129d75232017c1e0aeac01b17bc2213285dcafd92c03c3
Instruction Fuzzy Hash: F0E1AB30B00124EBC710DF69E585A5EB7B0FF48704FA441AAE645AB752CB7DEE81DB08

Function 00451C48 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00451CAB,?,?,-00000001,00000000), ref: 00451C85
GetLastError.KERNEL32(00000000,?,00000000,00451CAB,?,?,-00000001,00000000), ref: 00451C8D

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 030d8343478b2397c3fcae2acb12cfe7b45e8aea45dc1486f49e42fb222fb72e
Instruction ID: a4017119f4984bba3ca52e8ac1f0d93096c019048ff404e61f528f4693a1bbb6
Opcode Fuzzy Hash: 030d8343478b2397c3fcae2acb12cfe7b45e8aea45dc1486f49e42fb222fb72e
Instruction Fuzzy Hash: ECF04971A00204AB8B11DBAA9C4199EB7ECEB457317504ABBFC14D3292DA394D048458

Function 004084D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004994C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction ID: 1ce02aaae6ec4ade8b295bae84213e8e13784b7c216e354617812bc232f4da8b
Opcode Fuzzy Hash: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction Fuzzy Hash: 59E0D87170021467D711E95A9C869F7B35CA758314F00427FB949EB3C2EDB8DE4046ED

Function 00423AF4 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004240C1,?,00000000,004240CC), ref: 00423B1E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 391c0b4f01ace9dc11d42018e655f54e16c96b41035a00a65e5cff4b20b2374c
Instruction ID: 62037174fb3a4e63d39f4d80a9d1e591ad15120c94b51c82d4663250cb3dbf53
Opcode Fuzzy Hash: 391c0b4f01ace9dc11d42018e655f54e16c96b41035a00a65e5cff4b20b2374c
Instruction Fuzzy Hash: A0F0C579205608AFCB40DF9DC588D4AFBE8FB4C260B158295B988CB321C234FE808F94

Function 004813A4 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004813B5
6D166DE0.KERNEL32(00000000,GetNativeSystemInfo,kernel32.dll), ref: 004813C2
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004813D0
6D166DE0.KERNEL32(00000000,IsWow64Process), ref: 004813D8
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004813E4
6D166DE0.KERNEL32(00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00481405
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00481418
6D166DE0.KERNEL32(00000000,advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0048141E
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00481435

Strings

advapi32.dll, xrefs: 00481413
GetNativeSystemInfo, xrefs: 004813BC
GetSystemWow64DirectoryA, xrefs: 004813FF
kernel32.dll, xrefs: 004813B0
IsWow64Process, xrefs: 004813D2
RegDeleteKeyExA, xrefs: 0048140E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 1452695977-2623177817
Opcode ID: 39fa01ddfccae76feb3adcea83eb66da20e12e98a8c1b71c8ab6a98d6124cbf6
Instruction ID: 8e02f12f484013a28ff2341a02192a7bbb37b0de4bdff9f6500997299b828f27
Opcode Fuzzy Hash: 39fa01ddfccae76feb3adcea83eb66da20e12e98a8c1b71c8ab6a98d6124cbf6
Instruction Fuzzy Hash: 88119095148745A4DA21737A4C46F6F168C8B10F5DF588C3B7881AA2F3DABC88478F6F

Function 004237E4 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F334: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

GetClassInfoA.USER32(00400000,004235EC), ref: 0042380F
RegisterClassA.USER32(00497630), ref: 00423827
GetSystemMetrics.USER32(00000000), ref: 00423849
GetSystemMetrics.USER32(00000001), ref: 00423858
SetWindowLongA.USER32(004105C0,000000FC,004235FC), ref: 004238B4
SendMessageA.USER32(004105C0,00000080,00000001,00000000), ref: 004238D5
GetSystemMenu.USER32(004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238E0
DeleteMenu.USER32(00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238EF
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 004238FC
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423912

Strings

5B, xrefs: 00423803, 00423884

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: 5B
API String ID: 183575631-3738334870
Opcode ID: 44db8bd5710692da4d941872787ce0ff9892f94fd12c5b7ab8c6c5f64580aa91
Instruction ID: 16a3b782757fe380e741b78a30b35dddd299cc4c15753c014368db923682a048
Opcode Fuzzy Hash: 44db8bd5710692da4d941872787ce0ff9892f94fd12c5b7ab8c6c5f64580aa91
Instruction Fuzzy Hash: 6E3161B17406106AEB20AF699C82F6B36989718709F10017BBA41AF2D7D67DED00876C

Function 0047AF3C Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6D166DE0.KERNEL32(00000000,SHGetFolderPathA,00000000,0047B077), ref: 0047B03E

Strings

shell32.dll, xrefs: 0047AFE9
_isetup\_shfoldr.dll, xrefs: 0047AF6E
shfolder.dll, xrefs: 0047AFA1, 0047AFDA
nUI, xrefs: 0047AF85, 0047AFCA, 0047AFB2, 0047AFBA
Failed to get address of SHGetFolderPath function, xrefs: 0047B04F
SHFOLDERDLL, xrefs: 0047AF7B
SHGetFolderPathA, xrefs: 0047B033
Failed to load DLL "%s", xrefs: 0047B021
Failed to get version numbers of _shfoldr.dll, xrefs: 0047AF94

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$nUI$shell32.dll$shfolder.dll
API String ID: 1446878013-1488726181
Opcode ID: fcf33c47a224d227a97f9e908a15a7a1d70a81c8d563635d53f9f401c17e5de2
Instruction ID: 661024a6fcd326dbe58571742653adf7f30ba97f8e4a7a3e7e0d87374a7e660b
Opcode Fuzzy Hash: fcf33c47a224d227a97f9e908a15a7a1d70a81c8d563635d53f9f401c17e5de2
Instruction Fuzzy Hash: B3312C70A001499BCB00EBA5C882ADEB7B5EB44308F50C47BE414E7341D7789E54CBAE

Function 0047F47C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 170
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000), ref: 0047F624
FreeLibrary.KERNEL32(00000000), ref: 0047F638
SendNotifyMessageA.USER32(00020468,00000496,00002710,00000000), ref: 0047F6AA

Strings

Deinitializing Setup., xrefs: 0047F49A
Not restarting Windows because Setup is being run from the debugger., xrefs: 0047F659
Restarting Windows., xrefs: 0047F685
DeinitializeSetup, xrefs: 0047F535
GetCustomSetupExitCode, xrefs: 0047F4D9

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: f08e3f154d16099124dcd7ac202c01bfc89482097effeb4aa7c7c7489186b70c
Instruction ID: fc05c62f001f6c3c60b8b7fec0a41231a682c41b7fca8660be104cc12ee3811c
Opcode Fuzzy Hash: f08e3f154d16099124dcd7ac202c01bfc89482097effeb4aa7c7c7489186b70c
Instruction Fuzzy Hash: 33518F34600200AFD725DF79D945B9A7BA4EB59318F61807BE808C73A1DB389C59CB9E

Function 004523D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 004523F8
6D166DE0.KERNEL32(00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 004523FE
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 00452412
6D166DE0.KERNEL32(00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 00452418

Strings

kernel32.dll, xrefs: 004523F3, 0045240D
Wow64DisableWow64FsRedirection, xrefs: 004523EE
shell32.dll, xrefs: 00452444
Wow64RevertWow64FsRedirection, xrefs: 00452408

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModule
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 439651959-2130885113
Opcode ID: a292bf531193ab1ead2b16e2bc7bde0c7d0ba96a21d25e7d8119ef621ddc6c74
Instruction ID: e771d96ce4879ca63704c8b476013a76c59fe1e2fafe43d37d62f38e469d7341
Opcode Fuzzy Hash: a292bf531193ab1ead2b16e2bc7bde0c7d0ba96a21d25e7d8119ef621ddc6c74
Instruction Fuzzy Hash: A9017170201600AEDB01AB669D53B677A58D727B29FA1443FF804A6183D6BC5C49CA2D

Function 0047AC10 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047AD83,?,?,00000000,00499628,00000000,00000000,?,00496201,00000000,004963AA,?,00000000), ref: 0047ACA3
GetLastError.KERNEL32(00000000,00000000,00000000,0047AD83,?,?,00000000,00499628,00000000,00000000,?,00496201,00000000,004963AA,?,00000000), ref: 0047ACAC

Strings

_isetup, xrefs: 0047AC8E
\_setup64.tmp, xrefs: 0047AD3B
\_RegDLL.tmp, xrefs: 0047AD10
Created temporary directory: , xrefs: 0047AC45
REGDLL_EXE, xrefs: 0047AD20

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup
API String ID: 1375471231-1421604804
Opcode ID: 22ff0ccac170d185012c4e90730d0b524bbaef21bfd3bcbbf8a35ae577e700ab
Instruction ID: 454f73def42b3ef3d873a84fb08c748bbf507ca2bd9f15b46ff89584d00f75b5
Opcode Fuzzy Hash: 22ff0ccac170d185012c4e90730d0b524bbaef21bfd3bcbbf8a35ae577e700ab
Instruction Fuzzy Hash: B9414974A001099FCB01EF95D8829DEB7B5EF84305F50847BE81577392D73C9E158BA9

Function 00430420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23
registryclipboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430428
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430437
GetCurrentThreadId.KERNEL32 ref: 00430451
GlobalAddAtomA.KERNEL32(00000000), ref: 00430472

Strings

commdlg_help, xrefs: 00430423
commdlg_FindReplace, xrefs: 00430432
WndProcPtr%.8X%.8X, xrefs: 00430463

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 9fa228cc881c4cb0ee3ad5d29ee6b9fbbaa7526082c5147ac8ab62f476fd5ac8
Instruction ID: 037928bc7e060fe4f6d43156c3d06346d0e5c9b3eeefcd58f5058e009fc46478
Opcode Fuzzy Hash: 9fa228cc881c4cb0ee3ad5d29ee6b9fbbaa7526082c5147ac8ab62f476fd5ac8
Instruction Fuzzy Hash: 1EF082704483408ED700EB65C802B197AE0EB68318F004A7FB598A62E1D73A9A00CB1F

Function 004235FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
OemToCharA.USER32(?,?), ref: 004236CC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Strings

2, xrefs: 0042365A
MAINICON, xrefs: 00423681

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 1b0db4e38410ed08fd43d1227139983cff85abc5e858e568c57dc875fee80bda
Instruction ID: e164940f732d968ba99c163f3fcc12ffe833d184b7498653a3684ef3d7b221e9
Opcode Fuzzy Hash: 1b0db4e38410ed08fd43d1227139983cff85abc5e858e568c57dc875fee80bda
Instruction Fuzzy Hash: CE31A2B0A042559ADF10EF29D8C57C67BE8AF14308F4441BAE844DB393D7BED988CB65

Function 00418EA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418EAD
GlobalAddAtomA.KERNEL32(00000000), ref: 00418ECE
GetCurrentThreadId.KERNEL32 ref: 00418EE9
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F0A

Part of subcall function 00423038: 73F7A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
Part of subcall function 00423038: EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
Part of subcall function 00423038: 73F84620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
Part of subcall function 00423038: 73F7A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Part of subcall function 004235FC: LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
Part of subcall function 004235FC: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
Part of subcall function 004235FC: OemToCharA.USER32(?,?), ref: 004236CC
Part of subcall function 004235FC: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Part of subcall function 0041F088: GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
Part of subcall function 0041F088: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dRegister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0FC
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F125
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F13A
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F14F
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F164
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000), ref: 0041F179
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000), ref: 0041F18E
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60), ref: 0041F1A3
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister), ref: 0041F1B8
Part of subcall function 0041F088: 6D166DE0.KERNEL32(00000001,BtnWndProc3d,00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl), ref: 0041F1CD

Strings

Delphi%.8X, xrefs: 00418EBF
ControlOfs%.8X%.8X, xrefs: 00418EFB

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$AtomCharCurrentErrorGlobalLoadMode$A480A570EnumF84620FileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 2612956653-2767913252
Opcode ID: c9b0b8fe052b9af97da400281df92fa4da10c125a858bc4a98441331311cec09
Instruction ID: 06f349b975f9f6609891f47be69bfb04565190a1809ca848505239c89b9e556c
Opcode Fuzzy Hash: c9b0b8fe052b9af97da400281df92fa4da10c125a858bc4a98441331311cec09
Instruction Fuzzy Hash: 801160B06142409AC700FF2A984278A76E0EB68309F40843FF448DB2A1DB3D9D45CB5E

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(00499420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(00499420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(00499420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 40e8469341dc02a848a614798ee280fe3f503ecf0a0d2c59bf0d54f75b59c03b
Instruction ID: 88ad7e4fdbf6aceacb786a6f84fb2b7d2924a751ca222c4daed3c4176217cff4
Opcode Fuzzy Hash: 40e8469341dc02a848a614798ee280fe3f503ecf0a0d2c59bf0d54f75b59c03b
Instruction Fuzzy Hash: 53116D30A483405AEB16AB7DAC82B2A3BE5A761708F54407FF40067AF1D67C9C52C76E

Function 004516F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

752A1520.VERSION(00000000,?,?,?,nUI), ref: 00451718
752A1500.VERSION(00000000,?,00000000,?,00000000,00451793,?,00000000,?,?,?,nUI), ref: 00451745
752A1540.VERSION(?,004517BC,?,?,00000000,?,00000000,?,00000000,00451793,?,00000000,?,?,?,nUI), ref: 0045175F

Strings

nUI, xrefs: 004516FE

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: A1500A1520A1540
String ID: nUI
API String ID: 2563864905-1975807773
Opcode ID: df9f9219f7fff4aeeb43b9a694070a9ed6eb1772c9747d7333f0a708b5b56bcc
Instruction ID: a0cc86cd750d7bc438b8a734fe0c9faa2ab770da79c61762bd653917837db10d
Opcode Fuzzy Hash: df9f9219f7fff4aeeb43b9a694070a9ed6eb1772c9747d7333f0a708b5b56bcc
Instruction Fuzzy Hash: C7219535A006086FDB01DAA98C41EBFB7FCEB49340F55447AF900E3352D6799E048B69

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Error, xrefs: 00404DB9
Runtime error at 00000000, xrefs: 00404DBE, 00404DD1

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: db7b4c9d9482e5cce4f0e5c0c3c3777e0797bc8f5be78d8ec4822a82c67e7230
Instruction ID: 28ca0cdaec19d645d4e1f18e2455a365a19f54fbea1ec5e445dcbec99b00087c
Opcode Fuzzy Hash: db7b4c9d9482e5cce4f0e5c0c3c3777e0797bc8f5be78d8ec4822a82c67e7230
Instruction Fuzzy Hash: 3B21D670A581418AEB15A77DAC8175A3B8097E9308F04817FE710B73E2C67C8C45C7AE

Function 004239F4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0042398C), ref: 00423A18
GetWindow.USER32(?,00000003), ref: 00423A2D
GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: eafe3f331526a6a31f611ca39f5089d9185a68953368bb2c12f81ff4d04719ff
Instruction ID: 5110e990e8ffff35c2de00358165aba50110dec7380c1ea9fe09c5d3861ee13e
Opcode Fuzzy Hash: eafe3f331526a6a31f611ca39f5089d9185a68953368bb2c12f81ff4d04719ff
Instruction Fuzzy Hash: CA115A70700610ABDB10EF68DC85F5A77E8EB08725F10026AF9A4AB2E2C37CDC40CB58

Function 00423038 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73F7A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
73F84620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
73F7A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: A480A570EnumF84620Fonts
String ID:
API String ID: 3798320768-0
Opcode ID: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction ID: 4d68480f6d607538855b0f171b38ffa839f5ce6e0578d669e72114bdc8101102
Opcode Fuzzy Hash: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction Fuzzy Hash: 0601D2616053002AE700BF6A5C82B9B37649F00709F40027BF804AF2C7D6BE9805476E

Function 0047AE10 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047AE31
GetLastError.KERNEL32 ref: 0047AE3B
GetTickCount.KERNEL32 ref: 0047AE45
Sleep.KERNEL32(00000032), ref: 0047AE55

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: b44c33a29de9a8c844e9a6553cf55176c4cddbdca444f94af6998752a11768b7
Instruction ID: d879743ae8108a8121560a73ec1d8c4f30d4de314ac1b159a8407a382103bc90
Opcode Fuzzy Hash: b44c33a29de9a8c844e9a6553cf55176c4cddbdca444f94af6998752a11768b7
Instruction Fuzzy Hash: 7CE0ED36389A4045CA2131AE2CD66AF4A98CAC5B64B28453FE089E6282C8184C56A53B

Function 00496828 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00496836), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00496836), ref: 00403356

Part of subcall function 00409AE8: 6FAA1CD0.COMCTL32(00496845), ref: 00409AE8

Part of subcall function 004108C4: GetCurrentThreadId.KERNEL32 ref: 00410912

Part of subcall function 00418FB0: GetVersion.KERNEL32(00496859), ref: 00418FB0

Part of subcall function 0044EC04: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049686D), ref: 0044EC3F
Part of subcall function 0044EC04: 6D166DE0.KERNEL32(00000000,user32.dll,NotifyWinEvent,0049686D), ref: 0044EC45

Part of subcall function 0044EFE8: GetVersionExA.KERNEL32(00499788,00496872), ref: 0044EFF7

Part of subcall function 004523D8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 004523F8
Part of subcall function 004523D8: 6D166DE0.KERNEL32(00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 004523FE
Part of subcall function 004523D8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 00452412
Part of subcall function 004523D8: 6D166DE0.KERNEL32(00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00452471,?,?,?,?,00000000,?,0049687C), ref: 00452418

Part of subcall function 00455B80: 6D166DE0.KERNEL32(00000000,SHCreateItemFromParsingName,00496881), ref: 00455BA4

Part of subcall function 0046354C: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00496890), ref: 0046355B
Part of subcall function 0046354C: 6D166DE0.KERNEL32(00000000,shell32.dll,SHPathPrepareForWriteA,00496890), ref: 00463561

Part of subcall function 0046B630: 6D166DE0.KERNEL32(00000000,SHPathPrepareForWriteA,00496895), ref: 0046B645

Part of subcall function 00476ED8: GetModuleHandleA.KERNEL32(kernel32.dll,?,0049689A), ref: 00476EDE
Part of subcall function 00476ED8: 6D166DE0.KERNEL32(00000000,VerSetConditionMask,kernel32.dll,?,0049689A), ref: 00476EEB
Part of subcall function 00476ED8: 6D166DE0.KERNEL32(00000000,VerifyVersionInfoW,00000000,VerSetConditionMask,kernel32.dll,?,0049689A), ref: 00476EFB

Part of subcall function 00493818: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00493831

SetErrorMode.KERNEL32(00000001,00000000,004968E2), ref: 004968B4

Part of subcall function 00496630: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004968BE,00000001,00000000,004968E2), ref: 0049663A
Part of subcall function 00496630: 6D166DE0.KERNEL32(00000000,user32.dll,DisableProcessWindowsGhosting,004968BE,00000001,00000000,004968E2), ref: 00496640

Part of subcall function 00424444: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424463

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,004968E2), ref: 00496925

Part of subcall function 004801DC: SetActiveWindow.USER32(?), ref: 0048028A

Strings

Setup, xrefs: 0049690B

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorFormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 4046210471-3839654196
Opcode ID: 73a81bb03c58a98a0c311fce55a738d31ee3a4c73fe4b2ca1ff9d9df4fd80119
Instruction ID: 08f32f8c0adc8737cdde50bb8cd195f1613ad4d5b7d3ce09845598c59d9094fd
Opcode Fuzzy Hash: 73a81bb03c58a98a0c311fce55a738d31ee3a4c73fe4b2ca1ff9d9df4fd80119
Instruction Fuzzy Hash: CA311D712046509FD601BBBBEC1395D3BA8EB89718793443FF40492553CE3D5C158A7E

Function 00452C0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00452CFB,?,?,00000000,00499628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452C52
GetLastError.KERNEL32(00000000,00000000,?,00000000,00452CFB,?,?,00000000,00499628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452C5B

Strings

.tmp, xrefs: 00452C3B

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: c48ee4a9931f16bc4209ac78fdb486b8a3c15f53af04f62b51f5911c534421c6
Instruction ID: 92c1dba87803f6619e7bc88fa20badbeceb41b656d093e84a639742799fd4c34
Opcode Fuzzy Hash: c48ee4a9931f16bc4209ac78fdb486b8a3c15f53af04f62b51f5911c534421c6
Instruction Fuzzy Hash: E3214775A002089BDB01EFA5C9829DFB7B9EF58305F50457BFC01B7342DA7C9E058AA5

Function 0047A720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

6D167B60.ADVAPI32(?,?,00000001,00000000,?,?,?,0047A9A6,00000000,0047A9BC,?,?,?,?,00000000), ref: 0047A782

Strings

RegisteredOwner, xrefs: 0047A75F
RegisteredOrganization, xrefs: 0047A771

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 557493163-1113070880
Opcode ID: c1a54a052928fa71b87a357a451ff90e2e2aa6c3d29355afdd483e4de5049ccf
Instruction ID: 6a336bb24ca2ab860578fd3cd55d0358beaadaf3102226a605461b288e735e79
Opcode Fuzzy Hash: c1a54a052928fa71b87a357a451ff90e2e2aa6c3d29355afdd483e4de5049ccf
Instruction Fuzzy Hash: 63F0B434704244AFDB08DA659C53B9F37A9E781308F24807BA1049B341D67DEE11CB9E

Function 00455B80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

Part of subcall function 00455B10: CoInitialize.OLE32(00000000), ref: 00455B16

Part of subcall function 0042E1B4: SetErrorMode.KERNEL32(00008000), ref: 0042E1BE
Part of subcall function 0042E1B4: LoadLibraryA.KERNEL32(00000000,00000000,0042E208,?,00000000,0042E226,?,00008000), ref: 0042E1ED

6D166DE0.KERNEL32(00000000,SHCreateItemFromParsingName,00496881), ref: 00455BA4

Strings

shell32.dll, xrefs: 00455B99
SHCreateItemFromParsingName, xrefs: 00455B8F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166ErrorInitializeLibraryLoadMode
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 3497985204-2320870614
Opcode ID: ec250839ddc40d0a736ec8c9589f77cfaeff432978d092a6a1bac2f451eea00c
Instruction ID: a0fbb172c42ed79366dca91357488a0e93138e5875a7ee0513f1a474ff437a71
Opcode Fuzzy Hash: ec250839ddc40d0a736ec8c9589f77cfaeff432978d092a6a1bac2f451eea00c
Instruction Fuzzy Hash: 8AC012B0711900568A0033B6042672E2004874031AB50803F7440AA187DD7DA408076E

Function 0046B630 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON

Download Yara Rule

APIs

Part of subcall function 0042E1B4: SetErrorMode.KERNEL32(00008000), ref: 0042E1BE
Part of subcall function 0042E1B4: LoadLibraryA.KERNEL32(00000000,00000000,0042E208,?,00000000,0042E226,?,00008000), ref: 0042E1ED

6D166DE0.KERNEL32(00000000,SHPathPrepareForWriteA,00496895), ref: 0046B645

Strings

SHPathPrepareForWriteA, xrefs: 0046B630
shell32.dll, xrefs: 0046B63A

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166ErrorLibraryLoadMode
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2964704918-2683653824
Opcode ID: 3b470e072a7483ebb8d94bc7f1f44bae315de2b863f1529f45e1d4f3fa464d11
Instruction ID: 9aff7ad3c568a22a2b4f1a5d030331c7f0412ae4b913a0e6a544d5f2fe6b64ba
Opcode Fuzzy Hash: 3b470e072a7483ebb8d94bc7f1f44bae315de2b863f1529f45e1d4f3fa464d11
Instruction Fuzzy Hash: CFB092F064060482CA00AFB298437171244E760708B24C43BB488EA286FB3D88A84BEF

Function 00408544 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040867A), ref: 00408563

Part of subcall function 00406D54: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406D71

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004994C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Strings

@hI, xrefs: 0040857E, 0040858C, 004085A9, 004085B7, 004085FD, 0040860B, 0040862A, 00408638, 0040866C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID: @hI
API String ID: 1658689577-771705929
Opcode ID: 92a93adff60a03b40d2107b586362a2d213e9cc7dbb7d19789056de0a3a44930
Instruction ID: 2fdd9022aa0b4064c992ef58ec6fabf139125d4ee277b25021975313a4f1d1d2
Opcode Fuzzy Hash: 92a93adff60a03b40d2107b586362a2d213e9cc7dbb7d19789056de0a3a44930
Instruction Fuzzy Hash: A7315275E00109ABCF01EF55C8819EEB7B9EF84314F11857BE815AB285E738AE058B94

Function 0047AE64 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047AEAC

Strings

Failed to remove temporary directory: , xrefs: 0047AEC5

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 318f7e34e458934a0add632f83d789e43d8b0d0d0db99e8a8827eb9571e6c707
Instruction ID: 21e0c25a62b5ef995e74ac43d3b8a18367c873fc1ecf67cae48e6da10c40cfb4
Opcode Fuzzy Hash: 318f7e34e458934a0add632f83d789e43d8b0d0d0db99e8a8827eb9571e6c707
Instruction Fuzzy Hash: 2801F570244204AAEB11EB32DC07F9F7B98D785B09F608437F804A6193D77C9E24865E

Function 00402E70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

RtlUnwind.KERNEL32(?,?,Function_00002E70,00000000,?,?,Function_00002E70,?), ref: 00402EDC

Part of subcall function 00402D90: RaiseException.KERNEL32(0EEDFAD4,00000000,00000002), ref: 00402DA6

Strings

/@, xrefs: 00402EB7

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ExceptionRaiseUnwind
String ID: /@
API String ID: 478881706-2472096700
Opcode ID: f23111f4d6e81841eae0d97d4a064f450bad3e8c03756356cf3c83b9ecda70cb
Instruction ID: 44f7335f82d65d747696bde5430e8942b292ab2e2e3f8fc3da9f32fa67a3d4f2
Opcode Fuzzy Hash: f23111f4d6e81841eae0d97d4a064f450bad3e8c03756356cf3c83b9ecda70cb
Instruction Fuzzy Hash: 3301F7B0200201AFD710DB55CA89F27B7E9EF88754F15C5A9B508672E1C774EC44DA65

Function 0047A63C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167B60.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047A882,00000000,0047A9BC), ref: 0047A681

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047A651

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 557493163-1019749484
Opcode ID: 59cb38cb6bfcf1c18ff106d3ff2ae4b10be3c127c9185a49efd7297f5cdac4d2
Instruction ID: 8e945ff0c1cfc9845514684e1936b43eb0425cd50799034a588753f995eb2c03
Opcode Fuzzy Hash: 59cb38cb6bfcf1c18ff106d3ff2ae4b10be3c127c9185a49efd7297f5cdac4d2
Instruction Fuzzy Hash: 05F0A7317041146BDA00A65A9C42BAFA7DDCBC4758F24403BF608EB342D9BD9E0243AE

Function 0042DC54 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DC6E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: System\CurrentControlSet\Control\Windows
API String ID: 557493163-1109719901
Opcode ID: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction ID: fabb803f5ff523eeab3b7a035bb747b9213277980d9d81731b2bf545c5070290
Opcode Fuzzy Hash: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction Fuzzy Hash: EDD0C772910128BBDB10DA89DC41DF7775DDB59760F54401AFD0497141C1B4EC5197F4

Function 004531C4 Relevance: 3.2, APIs: 2, Instructions: 190fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,004533F7,?,00000000,00453461,?,?,-00000001,00000000,?,0047AEC1,00000000,0047AE10,00000000), ref: 004533D3
FindClose.KERNEL32(000000FF,004533FE,004533F7,?,00000000,00453461,?,?,-00000001,00000000,?,0047AEC1,00000000,0047AE10,00000000,00000001), ref: 004533F1

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: b92dacf6038d044d926ce71e29c1c4d3ef9512044cf767a795ddb841458c8e77
Instruction ID: 59662298388fd7d6b549a2e3b295ee96dcce014c506f44d390d76b8ec2f57b38
Opcode Fuzzy Hash: b92dacf6038d044d926ce71e29c1c4d3ef9512044cf767a795ddb841458c8e77
Instruction Fuzzy Hash: F6817F3090424DABCF12DFA5C8457EFBB74AF49346F5040AAEC4467392D7399B4ACB58

Function 0047C00C Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(00000000,?,00000001,00000000,0047C397,?,?,00000001,00000000,0047E2FD,-00000010,?,00000005,00000019,00000000,0047E64A), ref: 0047C082

Part of subcall function 0042E13C: 73F7A570.USER32(00000000,00000000,00000000,0047E6B1,?,?,00000001,00000000,00000002,00000000,0047EF71), ref: 0042E14B
Part of subcall function 0042E13C: EnumFontsA.GDI32(?,00000000,0042E128,00000000,00000000,0042E194,?,00000000,00000000,00000000,0047E6B1,?,?,00000001,00000000,00000002), ref: 0042E176
Part of subcall function 0042E13C: 73F7A480.USER32(00000000,?,0042E19B,00000000,00000000,0042E194,?,00000000,00000000,00000000,0047E6B1,?,?,00000001,00000000,00000002), ref: 0042E18E

SendNotifyMessageA.USER32(00020468,00000496,00002711,00000000), ref: 0047C252

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: A480A570EnumFontsMessageNotifySend
String ID:
API String ID: 2685184028-0
Opcode ID: ea0f2fd48d3aa1a8db12279c074cd8226564fb4f1d21c8c8305e3363a29b5b38
Instruction ID: 890f667201552ce9ce62703cff0ed3a10e3c6cb05070994abca7e25aa8646fd5
Opcode Fuzzy Hash: ea0f2fd48d3aa1a8db12279c074cd8226564fb4f1d21c8c8305e3363a29b5b38
Instruction Fuzzy Hash: 5D5163346001008BD711FF66D8C168A7BA9EB55309B90C57FA8489B3A7CB3CDD46CB9E

Function 0042DA38 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DA74
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DAE4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction ID: de7305fe23da407263f6a21fe748e6d6d926aae016943a7179aec9e2dd5a457b
Opcode Fuzzy Hash: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction Fuzzy Hash: 4F417171E04129AFDF10DF91D891BAFBBB8EB01704F918466E810B7240D778BE04CB99

Function 00451AF0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

6D167770.KERNEL32(00000000,00000000,00451B4D,?,-00000001,?), ref: 00451B27
GetLastError.KERNEL32(00000000,00000000,00451B4D,?,-00000001,?), ref: 00451B2F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167770ErrorLast
String ID:
API String ID: 4081035853-0
Opcode ID: e83c550b839dcf0bd10dc7b1a97466b50f67bca7ed30c71f0d67f765a3da39ca
Instruction ID: a5da00447ae79fac22184f4da0cf652e5006ca8770c95073f8daf701d0717375
Opcode Fuzzy Hash: e83c550b839dcf0bd10dc7b1a97466b50f67bca7ed30c71f0d67f765a3da39ca
Instruction Fuzzy Hash: 6EF0C875A04608ABCB00EFB59C4199EB7E8DB0931575145B7FC14E3252F6786E188598

Function 00451FF8 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00452055,?,-00000001,00000000), ref: 0045202F
GetLastError.KERNEL32(00000000,00000000,00452055,?,-00000001,00000000), ref: 00452037

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 3258773c82f0d91a1afb79f79dac9d98153e36b8b3101c951e5ad34bae757af7
Instruction ID: f6838928fafbffd6dc9857e8452c835fbb8909989936119e3dca391091342d7a
Opcode Fuzzy Hash: 3258773c82f0d91a1afb79f79dac9d98153e36b8b3101c951e5ad34bae757af7
Instruction Fuzzy Hash: BDF02871A05208ABCF00DFB5AC4159EB7E8EB0A72571049B7FC04E3282EA785E04C598

Function 004231AC Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 004231B9
LoadCursorA.USER32(00000000,00000000), ref: 004231E3

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 41eb8a1f3e1dc0d79877118b4796d5d9dbc495b655fa4abac9d6a83b162566f4
Instruction ID: 676ecd95b1ef36bc0223dd9a2f1ee322795c0d070bb5feb1993450ed68447b4a
Opcode Fuzzy Hash: 41eb8a1f3e1dc0d79877118b4796d5d9dbc495b655fa4abac9d6a83b162566f4
Instruction Fuzzy Hash: 53F0A7117001145BD660593E6CC193A72688F86736B61033BFE3AD72D1C62E2D51426D

Function 0042E1B4 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E1BE
LoadLibraryA.KERNEL32(00000000,00000000,0042E208,?,00000000,0042E226,?,00008000), ref: 0042E1ED

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 26e788730e3cbe96319a03b17e5e53d01e76f45806d8ea66fac71578cd018f2a
Instruction ID: b03bd68b0133cfb85c2b49f6daf1a90f00f582e3dd9511e38abcea9ad9b5a4f7
Opcode Fuzzy Hash: 26e788730e3cbe96319a03b17e5e53d01e76f45806d8ea66fac71578cd018f2a
Instruction Fuzzy Hash: 50F08270B14744BEDB119F77DC6282BBBECE74DB1079249B6F810A3691E63C5810C938

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 09dc17e0e6f2c5ebec2ebd809ac261a530bb5b580bbbfd9be0bab5fb96dc63b8
Instruction ID: 776eaf39b9d1a5f47234cbc0ed7aa96ab08d9c17dfa6ea1fba8a1158cce01b25
Opcode Fuzzy Hash: 09dc17e0e6f2c5ebec2ebd809ac261a530bb5b580bbbfd9be0bab5fb96dc63b8
Instruction Fuzzy Hash: 3EF08272A0063067EB61596A4C81B535A849BC5794F15407AFD09FF3E9D6B58C0142A9

Function 0042CBA8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CBF0,?,00000001,?,?,00000000,?,0042CC42,00000000,00451C0D,00000000,00451C2E,?,00000000), ref: 0042CBD3

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction ID: dfed850972a7f4cfed0b3d6ce6ead54829112a593105f6481b619d55be1254e6
Opcode Fuzzy Hash: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction Fuzzy Hash: 1AE06571304708BFD701EB62AC93E5EBBACD745714B914876B400A7651D5B8AE00845C

Function 0044F9AC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044F9EC

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D1674
String ID:
API String ID: 2996001779-0
Opcode ID: bae66bead66b5e07b83a80faf3efd662bcbb4a6bd163ce373dfa7ef137d5942d
Instruction ID: 242651817cd6b5fd4bb01c3afb7b2e3ec9c275dde43622d2897e753039f2a7bc
Opcode Fuzzy Hash: bae66bead66b5e07b83a80faf3efd662bcbb4a6bd163ce373dfa7ef137d5942d
Instruction Fuzzy Hash: E3E012A53641483EE340EEAC7C52F9777DCD71A754F008033F998D7241D4619D158BA8

Function 0042E634 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045245B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E653

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 1e35d6990590c6e50af99b1e8368dee699bbd3b64eed18c8552a5533455f4f95
Instruction ID: 6dc52a3738478b360af1f37268f932a47e6ce6d9338a48a593b8bc47814fb21e
Opcode Fuzzy Hash: 1e35d6990590c6e50af99b1e8368dee699bbd3b64eed18c8552a5533455f4f95
Instruction Fuzzy Hash: 7AE0D86178431119F62514166C53B7B110E8390B44FD080267A109D3C3C6AE990D429E

Function 00406300 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,004235EC,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 00406329

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 1d12608fc0467a25e6c73015cc4d191371d7057fe5102c86e19c90aa3d4ae925
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: 4CE002B2204309BFDB00DE8ADDC1DABB7ACFB4C654F844105BB1C972428275AD608BB1

Function 00406E78 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406E8C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f93223040538cb60598dc4cf3010d2a684b40fa1b5059103e17c9242f0e749d0
Instruction ID: 5e9ef0cb41ef517b54198f539e7e4457f1ce254f1207c5e451c0fee893fabf4d
Opcode Fuzzy Hash: f93223040538cb60598dc4cf3010d2a684b40fa1b5059103e17c9242f0e749d0
Instruction Fuzzy Hash: 3DD05B763082107AD620A55BAC44DA76BDCCFC5770F11063EB558C71C1D6309C01C675

Function 004235BC Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423568: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042357D

ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423598: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 004235B4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 5307962b8b56938e5b235cb39c89fdcb6647a00241a7e7f9a79480617f51b824
Instruction ID: 6e8deb3ed7ffb4c54c7bf11bddd21d475954711d807402a63cfbe74293682e9f
Opcode Fuzzy Hash: 5307962b8b56938e5b235cb39c89fdcb6647a00241a7e7f9a79480617f51b824
Instruction Fuzzy Hash: 03D05E123812743102107ABB280998B42A84D862AB388043BB54CDB202E91E8A81A1AC

Function 00424234 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042424C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction ID: a3b20f4c882213fa23ff33249cd178fa67041ba6f44abe22b1f00704e939aabb
Opcode Fuzzy Hash: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction Fuzzy Hash: 4CD05EE27011702BCB01BBED54C4AC667CC8B8829AB1940BBF918EF257C638CE448398

Function 0042CC48 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00451E3D,00000000,00451E56,?,-00000001,00000000), ref: 0042CC53

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 82f5dea6b02cc0f726bbe4c909810c4d52a47932f104f8a95c7157b85414663c
Instruction ID: fb3bcb19fe042810799c60ac9426d807c03ae468120a660d59a80632ebfc0af6
Opcode Fuzzy Hash: 82f5dea6b02cc0f726bbe4c909810c4d52a47932f104f8a95c7157b85414663c
Instruction Fuzzy Hash: 04D012D030121015DA1475BF2ACD75F42884FA5735BB41B37B96DE23E2D23D8956101C

Function 00406E28 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A834,0040CDE0,?,00000000,?), ref: 00406E45

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D1674
String ID:
API String ID: 2996001779-0
Opcode ID: fa9085c2757d27c9982339da6d7ec2766c2721ebbc7942d7ae8461916205f344
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: fa9085c2757d27c9982339da6d7ec2766c2721ebbc7942d7ae8461916205f344
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Function 0042E20F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E22D), ref: 0042E220

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 5cb12245fe54509065a79bb868ac9e2c98d4f3c192dc6fa753926c2ceb3ff8f1
Instruction ID: f738dbc2c191c097ff54108f810fd354cf398823fcd47068a980be29c21e85c8
Opcode Fuzzy Hash: 5cb12245fe54509065a79bb868ac9e2c98d4f3c192dc6fa753926c2ceb3ff8f1
Instruction Fuzzy Hash: 91B09B76B0C6005DF705D6D5745152D63D8D7C57203E149B7F111D2581D93C58004928

Function 0047B190 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,0047F642), ref: 0047B1A6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: fdad7df3e44edefcf6d6d9cc32d641229754695adfb19477cfda2e5ffcea6d1c
Instruction ID: 8b4f93e5702c9bb3706ed99b57f206b36c7f792d6e92d0bddf93f222bebf50ef
Opcode Fuzzy Hash: fdad7df3e44edefcf6d6d9cc32d641229754695adfb19477cfda2e5ffcea6d1c
Instruction Fuzzy Hash: 7FC002B15102008EC740EB79AC4C74A36E4F72C319F14487BA804C7260E7B884A4CFEF

Function 0041F334 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bc77a4876f1d895ef1045a47d34a5924c616e63536ec74810147f8327a0b6243
Instruction ID: 08e83a65a2327c8ef9f17986634245e3b79d24060420de3a4e0eeaf4dd20d018
Opcode Fuzzy Hash: bc77a4876f1d895ef1045a47d34a5924c616e63536ec74810147f8327a0b6243
Instruction Fuzzy Hash: FD111C742407059BC710DF59D881B86FBE5EB98350B10C53BE9588B385D378ED45CBA9

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 18c1eba8e1db17ab10124bb7e994193c51c3ea2d8e449add578f9bf5b72e9145
Instruction ID: 931392296a4abfdc71eaf96f3e4e5a487183569b01ba9d664ff519b7feaebb01
Opcode Fuzzy Hash: 18c1eba8e1db17ab10124bb7e994193c51c3ea2d8e449add578f9bf5b72e9145
Instruction Fuzzy Hash: FD01FC766482148FC3109E29DCC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Non-executed Functions

Function 004575EC Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocesstimeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00457653
QueryPerformanceCounter.KERNEL32(00000000,00000000,004578E6,?,?,00000000,00000000,?,00457FE2,?,00000000,00000000), ref: 0045765C
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00457666
GetCurrentProcessId.KERNEL32(?,00000000,00000000,004578E6,?,?,00000000,00000000,?,00457FE2,?,00000000,00000000), ref: 0045766F
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004576E5
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 004576F3
6D1674B0.KERNEL32(00000000,C0000000,00000000,00497AF0,00000003,00000000,00000000,00000000,004578A2), ref: 0045773B
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00457891,?,00000000,C0000000,00000000,00497AF0,00000003,00000000,00000000,00000000,004578A2), ref: 00457774

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045781D
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 00457853
CloseHandle.KERNEL32(000000FF,00457898,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045788B

Part of subcall function 00452684: GetLastError.KERNEL32(00000000,004530F5,00000005,00000000,0045312A,?,?,00000000,00499628,00000004,00000000,00000000,00000000,?,0049606D,00000000), ref: 00452687

Strings

\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 004576BB
Helper process PID: %u, xrefs: 00457870
Starting 64-bit helper process., xrefs: 00457621
CreateProcess, xrefs: 00457826
Cannot utilize 64-bit features on this version of Windows, xrefs: 00457634
SetNamedPipeHandleState, xrefs: 0045777D
helper %d 0x%x, xrefs: 004577FC
CreateNamedPipe, xrefs: 00457703
D, xrefs: 00457796
CreateFile, xrefs: 00457749
i, xrefs: 004577D0
64-bit helper EXE wasn't extracted, xrefs: 00457647

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Handle$CloseCreateErrorLastNamedPipeProcessSystemTime$CountCounterCurrentD1674DirectoryFilePerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 2260430365-3271284199
Opcode ID: 1783b194f199276eba612994a805641d63c54d8f7919fbfe4a5f048a1358e5f9
Instruction ID: 5dda2180c8029377283f5e8c97df4513cffb495ec464450a2f753e82b6758bef
Opcode Fuzzy Hash: 1783b194f199276eba612994a805641d63c54d8f7919fbfe4a5f048a1358e5f9
Instruction Fuzzy Hash: 80714570E043449FDB10EB69DC45B9EBBF8AB19305F1084BAF908EB282D7785944CF69

Function 0045BB2C Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182memoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045BB46
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045BB66
6D166DE0.KERNEL32(00000000,GetNamedSecurityInfoW,advapi32.dll), ref: 0045BB73
6D166DE0.KERNEL32(00000000,SetNamedSecurityInfoW,00000000,GetNamedSecurityInfoW,advapi32.dll), ref: 0045BB80
6D166DE0.KERNEL32(00000000,SetEntriesInAclW,00000000,SetNamedSecurityInfoW,00000000,GetNamedSecurityInfoW,advapi32.dll), ref: 0045BB8E

Part of subcall function 0045BA34: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045BAD3,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045BAAD

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045BD81,?,?,00000000), ref: 0045BC47
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045BD81,?,?,00000000), ref: 0045BC50

Strings

W, xrefs: 0045BC5E
advapi32.dll, xrefs: 0045BB61
GetNamedSecurityInfoW, xrefs: 0045BB6D
SetNamedSecurityInfoW, xrefs: 0045BB7A
SetEntriesInAclW, xrefs: 0045BB88

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 310572366-4263478283
Opcode ID: 958e49eeb0df348717a563a094f26a8e19c2aa33f2d6f1951a388e184588486f
Instruction ID: 8e733099f29d86de2dbb2654b0efe3c2ee40efbec8090b1f800075a1b211c088
Opcode Fuzzy Hash: 958e49eeb0df348717a563a094f26a8e19c2aa33f2d6f1951a388e184588486f
Instruction Fuzzy Hash: D15172B1900608EFDB11DF99C841BEEB7B8EB48315F14846AF905B7281C7789949CFA9

Function 004767BC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00476700: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021D2BFC,?,?,?,021D2BFC,004767EC,00000000,0047690A,?,?,?,?), ref: 00476719
Part of subcall function 00476700: 6D166DE0.KERNEL32(00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BFC,?,?,?,021D2BFC,004767EC,00000000,0047690A,?,?,?,?), ref: 0047671F
Part of subcall function 00476700: 6D1674B0.KERNEL32(00000000,00000080,00000007,00000000,00000003,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BFC,?,?,?,021D2BFC,004767EC), ref: 00476741
Part of subcall function 00476700: CloseHandle.KERNEL32(00000000,?,?,?,021D2BFC,004767EC,00000000,0047690A,?,?,?,?), ref: 0047675F

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

ShellExecuteEx.SHELL32(0000003C), ref: 00476844
GetLastError.KERNEL32(00000000,0047690A,?,?,?,?), ref: 0047684D
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0047689A
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 004768BE
CloseHandle.KERNEL32(00000000,004768EF,00000000,00000000,000000FF,000000FF,00000000,004768E8,?,00000000,0047690A,?,?,?,?), ref: 004768E2

Strings

ShellExecuteEx, xrefs: 0047685E
GetExitCodeProcess, xrefs: 004768C7
MsgWaitForMultipleObjects, xrefs: 004768A7
<, xrefs: 00476803
ShellExecuteEx returned hProcess=0, xrefs: 0047686E
runas, xrefs: 00476811

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Handle$Close$CodeD166D1674DirectoryErrorExecuteExitLastModuleMultipleObjectsProcessShellSystemWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 110906439-221126205
Opcode ID: fa1fdbb6ef41087a1d5ec77f541e807b940cc79beb18a6ca0dd9f45c97c909d0
Instruction ID: 8385799db3b80b867222ea474ac0104d49ac410ce9359fc04928196f762fb440
Opcode Fuzzy Hash: fa1fdbb6ef41087a1d5ec77f541e807b940cc79beb18a6ca0dd9f45c97c909d0
Instruction Fuzzy Hash: 0F3166B0D00608AFDB10EFA6C9416DEB6B9EF05314F52843BF508F6281D77C59048B59

Function 004227CC Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422964
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422B2E), ref: 00422974

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: f400f29292c35972605643c7420a49c437518459aae75a01a386a4deb5ab9326
Instruction ID: ce44026f944b421b325d7338e8876f8bc9f7615d7165fbb9eb6326590add080f
Opcode Fuzzy Hash: f400f29292c35972605643c7420a49c437518459aae75a01a386a4deb5ab9326
Instruction Fuzzy Hash: 89917271B04214FFD710EBA9DA86F9D77F4AB09314F5104BAF504AB3A2C778AE409B58

Function 004182F4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418303
GetWindowPlacement.USER32(?,0000002C), ref: 00418320
GetWindowRect.USER32(?), ref: 0041833C
GetWindowLongA.USER32(?,000000F0), ref: 0041834A
GetWindowLongA.USER32(?,000000F8), ref: 0041835F
ScreenToClient.USER32(00000000), ref: 00418368
ScreenToClient.USER32(00000000,?), ref: 00418373

Strings

,, xrefs: 0041830C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 6e73cc248294e567c08844e3e97027ea107a04c87d830052551685df03000aaa
Instruction ID: 9cf88c6662a8b54f2d940af1896da5675c8924d24fa9a5d7825e36bf04e718ba
Opcode Fuzzy Hash: 6e73cc248294e567c08844e3e97027ea107a04c87d830052551685df03000aaa
Instruction Fuzzy Hash: 40112B71505201AFDB00DF69C885F9B77E8AF49314F18067EBD58DB286C739D900CB69

Function 00454680 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0045468F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00454695
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004546AE
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 004546D5
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004546DA
ExitWindowsEx.USER32(00000002,00000000), ref: 004546EB

Strings

SeShutdownPrivilege, xrefs: 004546A7

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 45243e81071a4d0099171459abff20c101db8c2c1ef78c9e38b53d2452503d26
Instruction ID: b7f6d46838bd3bccc4dc1746167af74d75703c36abf5067b30a583189c7acccc
Opcode Fuzzy Hash: 45243e81071a4d0099171459abff20c101db8c2c1ef78c9e38b53d2452503d26
Instruction Fuzzy Hash: 86F04470294702B5E610A6618C07F2B21D8978174DF50492ABA45EE1C3D6BD95494A6E

Function 00495D6C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00495EAA,?,?,00000000,00499628,?,00496034,00000000,00496088,?,?,00000000,00499628), ref: 00495DC3
6D1682A0.KERNEL32(00000000,00000010), ref: 00495E46
FindNextFileA.KERNEL32(000000FF,?,00000000,00495E82,?,00000000,?,00000000,00495EAA,?,?,00000000,00499628,?,00496034,00000000), ref: 00495E5E
FindClose.KERNEL32(000000FF,00495E89,00495E82,?,00000000,?,00000000,00495EAA,?,?,00000000,00499628,?,00496034,00000000,00496088), ref: 00495E7C

Strings

isRS-, xrefs: 00495DE3
isRS-???.tmp, xrefs: 00495DAD

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$File$CloseD1682FirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 1540395035-3422211394
Opcode ID: 924c48f2dd38d885b52aa8456a45481e29b6cdafa0841f215cd12a525bbb9fe5
Instruction ID: 51b8b4b56f696a9f7b81a5499dc3405eebcd4bf6df5e4c50c2d69a2fb379c021
Opcode Fuzzy Hash: 924c48f2dd38d885b52aa8456a45481e29b6cdafa0841f215cd12a525bbb9fe5
Instruction Fuzzy Hash: C0316571901A08AFDF11EF65CC41ADEBBBCDB49314F6084B7A908A32A1D6389F458F58

Function 00456060 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004560DD
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00456104
SetForegroundWindow.USER32(?), ref: 00456115
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,004563F1,?,00000000,0045642D), ref: 004563DC

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 0045625C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: f96bd67d6e719d7c14ff404dc9ce2902b2b73d96e31f43a70127e85161c07d86
Instruction ID: c437d9d319fdcf54711087da35e0caf05be660954f304f0fcbb6d0e5908c51c0
Opcode Fuzzy Hash: f96bd67d6e719d7c14ff404dc9ce2902b2b73d96e31f43a70127e85161c07d86
Instruction Fuzzy Hash: B591CE34604244EFDB15CF59C951F5ABBF9EB89704F6280BAFC0497792C739AE08CA19

Function 004737F4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0047395E,?,?,00000001,0049A160), ref: 0047384D
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,0047395E,?,?,00000001,0049A160), ref: 0047392A
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,0047395E,?,?,00000001,0049A160), ref: 00473938

Strings

unins, xrefs: 004738A0
unins???.*, xrefs: 00473837

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: e220ed5e2e58537d168cca54789f9dbe2d38019618661ffbb8a4df500e75eafd
Instruction ID: 8a48721e5040b12f1de29ea0e0fb1571e59e2bbe74995f223e62527676c00a63
Opcode Fuzzy Hash: e220ed5e2e58537d168cca54789f9dbe2d38019618661ffbb8a4df500e75eafd
Instruction Fuzzy Hash: 6C3183B0600108AFCB50EF65C985ADEB7A8EF44305F5080B6A54CAB3A2DB78DF419F58

Function 00417C40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Strings

,, xrefs: 00417CC1

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 8175cc34318b0d3d4d46b69db781030ac140a1ffce7c62a0a6e8fdca1920ea86
Instruction ID: c7e48a005123f112bfb3c773aae920d88014dc0855fb7fe4f04d55f6c4297c8c
Opcode Fuzzy Hash: 8175cc34318b0d3d4d46b69db781030ac140a1ffce7c62a0a6e8fdca1920ea86
Instruction Fuzzy Hash: 92213E71604204ABCF00EF69D8C4ADA77B8AF48314F11456AFD18DF346D678E984CBA8

Function 00462C34 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00462DF1), ref: 00462C65
FindFirstFileA.KERNEL32(00000000,?,00000000,00462DC4,?,00000001,00000000,00462DF1), ref: 00462CF4
FindNextFileA.KERNEL32(000000FF,?,00000000,00462DA6,?,00000000,?,00000000,00462DC4,?,00000001,00000000,00462DF1), ref: 00462D86
FindClose.KERNEL32(000000FF,00462DAD,00462DA6,?,00000000,?,00000000,00462DC4,?,00000001,00000000,00462DF1), ref: 00462DA0

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: f547fdcbc44a8c112d4019de1d65e8a81ad1883d3f246a121560aae8052cff23
Instruction ID: 245f7c2356111990964258e8cb2593098eb52ff44e20f951769af61cb2cb26ba
Opcode Fuzzy Hash: f547fdcbc44a8c112d4019de1d65e8a81ad1883d3f246a121560aae8052cff23
Instruction Fuzzy Hash: A941BB74A00A18AFCB10EF65DD45ADEB7B8EB88305F4044BAF404E7391E77C9E488E59

Function 004630B0 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463297), ref: 00463125
FindFirstFileA.KERNEL32(00000000,?,00000000,00463262,?,00000001,00000000,00463297), ref: 0046316B
FindNextFileA.KERNEL32(000000FF,?,00000000,00463244,?,00000000,?,00000000,00463262,?,00000001,00000000,00463297), ref: 00463220
FindClose.KERNEL32(000000FF,0046324B,00463244,?,00000000,?,00000000,00463262,?,00000001,00000000,00463297), ref: 0046323E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 883b117e1face215178b9a72dedaafde048cd9776df124574b792d3a23bac4fb
Instruction ID: 5843323c3d4a6ea9c1c24b6d88c46a3fcdf04d923c7410ee6712d33f4b49ef12
Opcode Fuzzy Hash: 883b117e1face215178b9a72dedaafde048cd9776df124574b792d3a23bac4fb
Instruction Fuzzy Hash: D9418334A006589BCB10EFA5CC959DEB7B8EB88306F5044EAF804A7341E7389E448E49

Function 0042E6A0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452127,00000000,00452148), ref: 0042E6C2
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E6ED
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452127,00000000,00452148), ref: 0042E6FA
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452127,00000000,00452148), ref: 0042E702
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452127,00000000,00452148), ref: 0042E708

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast$CloseControlD1674DeviceHandle
String ID:
API String ID: 1783607827-0
Opcode ID: 0e5e7c90a65406167f7898170dc945b3353e2cbee806782c6914c5c21f74b8b4
Instruction ID: 69ba716829895e5093af9d36c621d6373ea650b16a5cb4695acc15b02c1957a3
Opcode Fuzzy Hash: 0e5e7c90a65406167f7898170dc945b3353e2cbee806782c6914c5c21f74b8b4
Instruction Fuzzy Hash: AFF090713A17203AF620B1BA6C87F7B418CC7C5B68F10823ABB04FF1C1D9A85D06566D

Function 00481264 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004812A2
GetWindowLongA.USER32(00000000,000000F0), ref: 004812C0
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049A03C,00480A6A,00480A9E,00000000,00480ABE,?,?,00000001,0049A03C), ref: 004812E2
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049A03C,00480A6A,00480A9E,00000000,00480ABE,?,?,00000001,0049A03C), ref: 004812F6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 2db370611a20db9f75072be09b46ad1da7a5ebdcfae9fdd5b085a6149f7b7dea
Instruction ID: b09d18af8882c8ebd922b8a88fb257c9fa0d5cabb13e1bf256af569dfdd4690a
Opcode Fuzzy Hash: 2db370611a20db9f75072be09b46ad1da7a5ebdcfae9fdd5b085a6149f7b7dea
Instruction Fuzzy Hash: B40171706002009AE710FBA9DC85B5E23A86F15344F1408BBF841FB3B3CA2D9C96975D

Function 0042414C Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424154
SetActiveWindow.USER32(?,?,?,0046B592), ref: 00424161

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423A84: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021D25AC,0042417A,?,?,?,0046B592), ref: 00423ABF

SetFocus.USER32(00000000,?,?,?,0046B592), ref: 0042418E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: d45248867ec258f00586a254dd3104dbd769442af7a587b2194b96412798c385
Instruction ID: 5fc4ce76e2fd56d68edf849e8d27c6cce982c94ba176b6555b019de7a1c50f04
Opcode Fuzzy Hash: d45248867ec258f00586a254dd3104dbd769442af7a587b2194b96412798c385
Instruction Fuzzy Hash: 76F0307170012087DB00AFA998C4B9633A8AF48304B55017BBD05DF34BC67CDC518768

Function 00417C3E Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: f049b6242392f3fa064e4b255df9e6ab0247290bd5849ac8a9f990d63e31907e
Instruction ID: f0313cfea0d4087130c3a657ee055cc65a4736f61d4b278e94d42609036002a6
Opcode Fuzzy Hash: f049b6242392f3fa064e4b255df9e6ab0247290bd5849ac8a9f990d63e31907e
Instruction Fuzzy Hash: 31015A31204104ABDF10EE6A98C5EEA73A8AF44324F114166FD08CF342E638EC8086A8

Function 00417508 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417533
GetCapture.USER32 ref: 0041753C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: a2e06a33e56df2b28c1ac7c51cd9509904dcce81530e1026fa055b848d635906
Instruction ID: 91c5476f6810031d6ba28f55d540498aeba2d497fd4f51dff2acf4b465765a2b
Opcode Fuzzy Hash: a2e06a33e56df2b28c1ac7c51cd9509904dcce81530e1026fa055b848d635906
Instruction Fuzzy Hash: FFF08171B04602A7DB20E72EC8C4AAB62B69F44394B54403BF415C7B96EA7CDCC08218

Function 00424104 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042410B

Part of subcall function 004239F4: EnumWindows.USER32(0042398C), ref: 00423A18
Part of subcall function 004239F4: GetWindow.USER32(?,00000003), ref: 00423A2D
Part of subcall function 004239F4: GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
Part of subcall function 004239F4: SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

SetActiveWindow.USER32(?,?,?,00423CE3,00000000,004240CC), ref: 0042411F

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 5c58d947887613df8a1a5b004a34a5df3c7671d93cde12ce2b76e9099da7ea36
Instruction ID: b8e4b42960b6b3797255afb6d30997fccd36cf0c86298b6f3b138aeb4614201e
Opcode Fuzzy Hash: 5c58d947887613df8a1a5b004a34a5df3c7671d93cde12ce2b76e9099da7ea36
Instruction Fuzzy Hash: 76E0E5A0300100C7EB00AFAAD8C9B9672A9BB48304F5501BABC08CF24BD6B8C8948724

Function 00412548 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00412745), ref: 00412733

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 27474152015bcb4eb7b2f8a6969131eccbf80fc009b9960156e7ba565eb19cfa
Instruction ID: 84e48a5dd71b03e3ac7236ce71605b31f373ae1f90ae0861ad1c16be3c7d11b6
Opcode Fuzzy Hash: 27474152015bcb4eb7b2f8a6969131eccbf80fc009b9960156e7ba565eb19cfa
Instruction Fuzzy Hash: AD51D3356042059FD710DF5AD681A9BF3E5FF98304B3482ABE814C73A1D6B8AD92874C

Function 00476D78 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00476EC6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 9766044ec5c9c5551cc162b5214fc7164479d034182359d6f3940f7bbfd4ac84
Instruction ID: d332b3b291fea780df115372bad64309aad823c84261d4603bcd034d5ab83380
Opcode Fuzzy Hash: 9766044ec5c9c5551cc162b5214fc7164479d034182359d6f3940f7bbfd4ac84
Instruction Fuzzy Hash: 0F414A79604515EFCB20CF99C6808AAB7F6EB48310B36C596E84CDB715D338EE41DB64

Function 00454638 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 0045464E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f1f66408e8c2c1a17f1262e63008d16cb7fa0479c05ae9f4636daabb8754f5ab
Instruction ID: d556a237bff46435c21392b4e3186fec9b646bf01b8c2644f25cdf3d499efc1f
Opcode Fuzzy Hash: f1f66408e8c2c1a17f1262e63008d16cb7fa0479c05ae9f4636daabb8754f5ab
Instruction Fuzzy Hash: 9BD0127170420067D700AAA9AC82A9A758D8BC4359F00493F7CC5DE2D3EABDDA8C56A6

Function 0042F000 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F01C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: ff2059a00e1596a3655d033c7c7c0ff7ada576643e9dcda53c8e44a3788e9446
Instruction ID: a3f2727a8225cce52aa332fac080a49b8e88e69fc98919c7d6858de85465de56
Opcode Fuzzy Hash: ff2059a00e1596a3655d033c7c7c0ff7ada576643e9dcda53c8e44a3788e9446
Instruction Fuzzy Hash: 5DD09E7121011D6B9B00DE99E840C6B33AD9B88710BA0C929F959C7246D634ED5197B9

Function 0044AB18 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0044AAC4: GetVersionExA.KERNEL32(00000094), ref: 0044AAE1

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB3F
6D166DE0.KERNEL32(00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB57
6D166DE0.KERNEL32(00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB69
6D166DE0.KERNEL32(00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB7B
6D166DE0.KERNEL32(00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB8D
6D166DE0.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB9F
6D166DE0.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044ABB1
6D166DE0.KERNEL32(00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll), ref: 0044ABC3
6D166DE0.KERNEL32(00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData), ref: 0044ABD5
6D166DE0.KERNEL32(00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData), ref: 0044ABE7
6D166DE0.KERNEL32(00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground), ref: 0044ABF9
6D166DE0.KERNEL32(00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText), ref: 0044AC0B
6D166DE0.KERNEL32(00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect), ref: 0044AC1D
6D166DE0.KERNEL32(00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect), ref: 0044AC2F
6D166DE0.KERNEL32(00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize), ref: 0044AC41
6D166DE0.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent), ref: 0044AC53
6D166DE0.KERNEL32(00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics), ref: 0044AC65
6D166DE0.KERNEL32(00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion), ref: 0044AC77
6D166DE0.KERNEL32(00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground), ref: 0044AC89
6D166DE0.KERNEL32(00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge), ref: 0044AC9B
6D166DE0.KERNEL32(00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon), ref: 0044ACAD
6D166DE0.KERNEL32(00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined), ref: 0044ACBF
6D166DE0.KERNEL32(00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044ACD1
6D166DE0.KERNEL32(00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric,00000000,GetThemeColor), ref: 0044ACE3
6D166DE0.KERNEL32(00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString,00000000,GetThemeMetric), ref: 0044ACF5
6D166DE0.KERNEL32(00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool,00000000,GetThemeString), ref: 0044AD07
6D166DE0.KERNEL32(00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt,00000000,GetThemeBool), ref: 0044AD19
6D166DE0.KERNEL32(00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue,00000000,GetThemeInt), ref: 0044AD2B
6D166DE0.KERNEL32(00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition,00000000,GetThemeEnumValue), ref: 0044AD3D
6D166DE0.KERNEL32(00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont,00000000,GetThemePosition), ref: 0044AD4F
6D166DE0.KERNEL32(00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect,00000000,GetThemeFont), ref: 0044AD61
6D166DE0.KERNEL32(00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins,00000000,GetThemeRect), ref: 0044AD73
6D166DE0.KERNEL32(00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList,00000000,GetThemeMargins), ref: 0044AD85
6D166DE0.KERNEL32(00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin,00000000,GetThemeIntList), ref: 0044AD97
6D166DE0.KERNEL32(00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme,00000000,GetThemePropertyOrigin), ref: 0044ADA9
6D166DE0.KERNEL32(00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename,00000000,SetWindowTheme), ref: 0044ADBB
6D166DE0.KERNEL32(00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor,00000000,GetThemeFilename), ref: 0044ADCD
6D166DE0.KERNEL32(00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush,00000000,GetThemeSysColor), ref: 0044ADDF
6D166DE0.KERNEL32(00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool,00000000,GetThemeSysColorBrush), ref: 0044ADF1
6D166DE0.KERNEL32(00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize,00000000,GetThemeSysBool), ref: 0044AE03
6D166DE0.KERNEL32(00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont,00000000,GetThemeSysSize), ref: 0044AE15
6D166DE0.KERNEL32(00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString,00000000,GetThemeSysFont), ref: 0044AE27
6D166DE0.KERNEL32(00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt,00000000,GetThemeSysString), ref: 0044AE39
6D166DE0.KERNEL32(00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive,00000000,GetThemeSysInt), ref: 0044AE4B
6D166DE0.KERNEL32(00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed,00000000,IsThemeActive), ref: 0044AE5D
6D166DE0.KERNEL32(00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme,00000000,IsAppThemed), ref: 0044AE6F
6D166DE0.KERNEL32(00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture,00000000,GetWindowTheme), ref: 0044AE81
6D166DE0.KERNEL32(00000000,EnableTheming,00000000,DrawThemeParentBackground,00000000,GetThemeDocumentationProperty,00000000,GetCurrentThemeName,00000000,SetThemeAppProperties,00000000,GetThemeAppProperties,00000000,IsThemeDialogTextureEnabled,00000000,EnableThemeDialogTexture), ref: 0044AE93

Strings

CloseThemeData, xrefs: 0044AB61
DrawThemeEdge, xrefs: 0044AC15
GetThemeMetric, xrefs: 0044AC6F
DrawThemeBackground, xrefs: 0044AB73
HitTestThemeBackground, xrefs: 0044AC03
GetThemeFont, xrefs: 0044ACDB
SetWindowTheme, xrefs: 0044AD35
OpenThemeData, xrefs: 0044AB4F
GetThemeTextMetrics, xrefs: 0044ABDF
GetThemeMargins, xrefs: 0044ACFF
GetThemePropertyOrigin, xrefs: 0044AD23
GetThemeBool, xrefs: 0044AC93
EnableTheming, xrefs: 0044AE8B
GetWindowTheme, xrefs: 0044ADFB
IsThemeDialogTextureEnabled, xrefs: 0044AE1F
GetThemeColor, xrefs: 0044AC5D
GetThemeSysColorBrush, xrefs: 0044AD6B
DrawThemeParentBackground, xrefs: 0044AE79
uxtheme.dll, xrefs: 0044AB3A
GetThemeTextExtent, xrefs: 0044ABCD
IsThemeBackgroundPartiallyTransparent, xrefs: 0044AC4B
GetThemeIntList, xrefs: 0044AD11
SetThemeAppProperties, xrefs: 0044AE43
EnableThemeDialogTexture, xrefs: 0044AE0D
GetThemePartSize, xrefs: 0044ABBB
IsAppThemed, xrefs: 0044ADE9
GetThemeSysInt, xrefs: 0044ADC5
GetCurrentThemeName, xrefs: 0044AE55
IsThemePartDefined, xrefs: 0044AC39
GetThemeRect, xrefs: 0044ACED
GetThemeSysString, xrefs: 0044ADB3
DrawThemeIcon, xrefs: 0044AC27
GetThemeBackgroundRegion, xrefs: 0044ABF1
GetThemeSysSize, xrefs: 0044AD8F
GetThemeDocumentationProperty, xrefs: 0044AE67
GetThemeSysBool, xrefs: 0044AD7D
GetThemeEnumValue, xrefs: 0044ACB7
GetThemePosition, xrefs: 0044ACC9
GetThemeInt, xrefs: 0044ACA5
GetThemeFilename, xrefs: 0044AD47
DrawThemeText, xrefs: 0044AB85
IsThemeActive, xrefs: 0044ADD7
GetThemeString, xrefs: 0044AC81
GetThemeSysFont, xrefs: 0044ADA1
GetThemeAppProperties, xrefs: 0044AE31
GetThemeSysColor, xrefs: 0044AD59
GetThemeBackgroundContentRect, xrefs: 0044AB97, 0044ABA9

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 48091293-2910565190
Opcode ID: 1d5e7f326ef7fc7d4d80aaa0eb9f01f3f65f1c66a345f784a01a005393b3e03b
Instruction ID: 23a61038ac75b3b0b067e02792df25c67946ab2422e9ce29a72673a1f71d3a80
Opcode Fuzzy Hash: 1d5e7f326ef7fc7d4d80aaa0eb9f01f3f65f1c66a345f784a01a005393b3e03b
Instruction Fuzzy Hash: 669182B0A40B50EBEF00EFF998C6A2636A8EB15B1471445BBB444EF295D778DC04CF59

Function 0046D9D8 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 0046D7C4: 6D168150.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,004748B5,0049A160,?,0046DADB,?,00000000,0046E032,?,_is1), ref: 0046D7E7

6D167B60.ADVAPI32(?,0046E039,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046E084,?,?,00000001,0049A160), ref: 0046E02C

Strings

Inno Setup: User Info: Organization, xrefs: 0046DC3B
5.3.9 (a), xrefs: 0046DACE
UninstallString, xrefs: 0046DD17
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046DA2E
Inno Setup: App Path, xrefs: 0046DAFE
Comments, xrefs: 0046DE56
Inno Setup: Setup Type, xrefs: 0046DB89
Inno Setup: Setup Version, xrefs: 0046DAC9
InstallLocation, xrefs: 0046DB1E
QuietUninstallString, xrefs: 0046DD51
NoRepair, xrefs: 0046DE9E
_is1, xrefs: 0046DA34
Inno Setup: Selected Tasks, xrefs: 0046DBEF
Readme, xrefs: 0046DE1C
Inno Setup: Icon Group, xrefs: 0046DB2D
Inno Setup: User, xrefs: 0046DB6A
Inno Setup: Language, xrefs: 0046DC77
ModifyPath, xrefs: 0046DE76
Inno Setup: Deselected Tasks, xrefs: 0046DC0E
DisplayName, xrefs: 0046DCC0
URLInfoAbout, xrefs: 0046DDA8
Contact, xrefs: 0046DE39
InstallDate, xrefs: 0046DEBD
MinorVersion, xrefs: 0046DEFB
RegisterPreviousData, xrefs: 0046DFE2
EstimatedSize, xrefs: 0046DFA9
DisplayVersion, xrefs: 0046DD6E
DisplayIcon, xrefs: 0046DCDD
URLUpdateInfo, xrefs: 0046DDFF
Inno Setup: User Info: Serial, xrefs: 0046DC50
Inno Setup: Deselected Components, xrefs: 0046DBC7
Publisher, xrefs: 0046DD8B
" /SILENT, xrefs: 0046DD44
NoModify, xrefs: 0046DE8A
HelpLink, xrefs: 0046DDE2
HelpTelephone, xrefs: 0046DDC5
MajorVersion, xrefs: 0046DEE9
Inno Setup: User Info: Name, xrefs: 0046DC26
Inno Setup: No Icons, xrefs: 0046DB4B
Inno Setup: Selected Components, xrefs: 0046DBA8

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167D168150
String ID: " /SILENT$5.3.9 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 2648290316-1831515863
Opcode ID: f5614a6b3879e896b481079cb84c961a5d41588f8e908e33e68097be419b31a2
Instruction ID: 5b29a30331640670f4cf9921d9108c8d1be0cec7446e1f60569eb820528e4c3a
Opcode Fuzzy Hash: f5614a6b3879e896b481079cb84c961a5d41588f8e908e33e68097be419b31a2
Instruction Fuzzy Hash: A1122334E001089FDB04EB96D885ADE73F5EB48304F20857BE8156B396EB79AD41CB5A

Function 00490418 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,0049090D,?,?,?,?,00000000,00000000,00000000), ref: 00490458
FindWindowA.USER32(00000000,00000000), ref: 00490489

Strings

SENDNOTIFYMESSAGE, xrefs: 0049058F
POSTMESSAGE, xrefs: 00490533
CREATEMUTEX, xrefs: 00490839
REGISTERWINDOWMESSAGE, xrefs: 004905EB
SENDBROADCASTMESSAGE, xrefs: 00490625
POSTBROADCASTMESSAGE, xrefs: 00490673
SENDBROADCASTNOTIFYMESSAGE, xrefs: 004906C7
OEMTOCHARBUFF, xrefs: 0049086B
CALLDLLPROC, xrefs: 0049077D
SENDMESSAGE, xrefs: 004904DD
FREEDLL, xrefs: 00490804
CHARTOOEMBUFF, xrefs: 004908AE
SLEEP, xrefs: 00490442
FINDWINDOWBYWINDOWNAME, xrefs: 004904A1
LOADDLL, xrefs: 0049071B
FINDWINDOWBYCLASSNAME, xrefs: 00490465

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 2922215552881872f70abd2422ad2c704b71823ee53133ea12d4e3c776771d80
Instruction ID: 34c7feca907183e38f9e7e62941ef3efdf59270ea588281af32103c30a42d3d0
Opcode Fuzzy Hash: 2922215552881872f70abd2422ad2c704b71823ee53133ea12d4e3c776771d80
Instruction Fuzzy Hash: 15C140A0B002106BDF14BA3E8C5251F5A9A9F99704B11D93FB546EB78BCE3DDC05439E

Function 00456E18 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 237filesynchronizationprocessCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00497AE4,00000001,00000000,00000000,0045714D,?,?,?,00000001,?,00457367,00000000,0045737D,?,00000000,00499628), ref: 00456E65
CreateFileMappingA.KERNEL32(000000FF,00497AE4,00000004,00000000,00002018,00000000), ref: 00456E9D
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,00000000,00457123,?,00497AE4,00000001,00000000,00000000,0045714D,?,?,?), ref: 00456EC4
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456FD1
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,00000000,00457123,?,00497AE4,00000001,00000000,00000000,0045714D), ref: 00456F29

Part of subcall function 00452684: GetLastError.KERNEL32(00000000,004530F5,00000005,00000000,0045312A,?,?,00000000,00499628,00000004,00000000,00000000,00000000,?,0049606D,00000000), ref: 00452687

CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456FE8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457021
GetLastError.KERNEL32(00000000,000000FF,?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457033
UnmapViewOfFile.KERNEL32(00000000,0045712A,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457105
CloseHandle.KERNEL32(00000000,0045712A,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457114
CloseHandle.KERNEL32(00000000,0045712A,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045711D

Strings

MapViewOfFile, xrefs: 00456ED2
_isetup\_RegDLL.tmp, xrefs: 00456F4F
gsE, xrefs: 00456F59, 00456FBF, 00456F5C
REGDLL returned unknown result code %d, xrefs: 004570E4
D, xrefs: 00456F92
CreateFileMapping, xrefs: 00456EAB
Spawning _RegDLL.tmp, xrefs: 00456E44
CreateProcess, xrefs: 00456FDA
REGDLL mutex wait failed (%d, %d), xrefs: 00457047
GetProcAddress, xrefs: 00457091
ReleaseMutex, xrefs: 00456F32
REGDLL failed with exit code 0x%x, xrefs: 00457011
CreateMutex, xrefs: 00456E73
OleInitialize, xrefs: 0045706D
_RegDLL.tmp %u %u, xrefs: 00456F79
LoadLibrary, xrefs: 0045707F
}sE, xrefs: 00457067, 00456EEB, 0045708B, 00456F02, 00457101, 00457051, 00456F13, 00457079, 00456EF4, 0045709D, 004570C2, 00456EDC, 00456F0D

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$MappingObjectProcessReleaseSingleUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OleInitialize$REGDLL failed with exit code 0x%x$REGDLL mutex wait failed (%d, %d)$REGDLL returned unknown result code %d$ReleaseMutex$Spawning _RegDLL.tmp$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp$gsE$}sE
API String ID: 4012871263-2567305340
Opcode ID: 2e09ef0dd6c003555dfb7aaf4f2163ebe4a730367404d00d1d95f0158be56c37
Instruction ID: be3413ed5186559677fde55407b11f62f9f9b75efdae8f043e5f2ee1d3cc33bc
Opcode Fuzzy Hash: 2e09ef0dd6c003555dfb7aaf4f2163ebe4a730367404d00d1d95f0158be56c37
Instruction Fuzzy Hash: E0918F70A042199FDB10EBA9D845B9EB7F4EB08305F50857BF814EB383DB789908CB59

Function 0041F088 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
6D166DE0.KERNEL32(00000001,Ctl3dRegister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0FC
6D166DE0.KERNEL32(00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F125
6D166DE0.KERNEL32(00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F13A
6D166DE0.KERNEL32(00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F14F
6D166DE0.KERNEL32(00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000,?,?,?,00000001), ref: 0041F164
6D166DE0.KERNEL32(00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000), ref: 0041F179
6D166DE0.KERNEL32(00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60,00000000), ref: 0041F18E
6D166DE0.KERNEL32(00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister,?,00418F60), ref: 0041F1A3
6D166DE0.KERNEL32(00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl,00000001,Ctl3dUnregister), ref: 0041F1B8
6D166DE0.KERNEL32(00000001,BtnWndProc3d,00000001,Ctl3DColorChange,00000001,Ctl3dUnAutoSubclass,00000001,Ctl3dAutoSubclass,00000001,Ctl3dCtlColorEx,00000001,Ctl3dDlgFramePaint,00000001,Ctl3dSubclassDlgEx,00000001,Ctl3dSubclassCtl), ref: 0041F1CD
FreeLibrary.KERNEL32(00000001,?,00418F60,00000000,?,?,?,00000001), ref: 0041F1DF

Strings

BtnWndProc3d, xrefs: 0041F1C2
Ctl3dCtlColorEx, xrefs: 0041F16E
Ctl3dAutoSubclass, xrefs: 0041F183
Ctl3dRegister, xrefs: 0041F0F1
CTL3D32.DLL, xrefs: 0041F0B9
Ctl3dUnAutoSubclass, xrefs: 0041F198
Ctl3dUnregister, xrefs: 0041F11A
Ctl3dSubclassDlgEx, xrefs: 0041F144
Ctl3DColorChange, xrefs: 0041F1AD
Ctl3dSubclassCtl, xrefs: 0041F12F
Ctl3dDlgFramePaint, xrefs: 0041F159

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 3037258462-3614243559
Opcode ID: 83202a5e5668af5360d98896c54bafd8752203d7ddc02880caf24378f1438677
Instruction ID: 92a9843203eddb7f9aab2fbfa73ed58fb88c7fc0ed44efda6b06a7d9d2ff7431
Opcode Fuzzy Hash: 83202a5e5668af5360d98896c54bafd8752203d7ddc02880caf24378f1438677
Instruction Fuzzy Hash: 1C311DB1614701EBDF40EBF5AC86A663394B728724B45093FB508DB5A3D77C488ACB1C

Function 0041C97C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73F7A570.USER32(00000000,?,0041A8B4,?), ref: 0041C9B0
73F84C40.GDI32(?,00000000,?,0041A8B4,?), ref: 0041C9BC
73F86180.GDI32(0041A8B4,?,00000001,00000001,00000000,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9E0
73F84C00.GDI32(?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9F0
SelectObject.GDI32(0041CDAC,00000000), ref: 0041CA0B
FillRect.USER32(0041CDAC,?,?), ref: 0041CA46
SetTextColor.GDI32(0041CDAC,00000000), ref: 0041CA5B
SetBkColor.GDI32(0041CDAC,00000000), ref: 0041CA72
PatBlt.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00FF0062), ref: 0041CA88
73F84C40.GDI32(?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4), ref: 0041CA9B
SelectObject.GDI32(00000000,00000000), ref: 0041CACC
73F78830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4), ref: 0041CAE4
73F722A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?), ref: 0041CAED
73F78830.GDI32(0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CAFC
73F722A0.GDI32(0041CDAC,0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CB05
SetTextColor.GDI32(00000000,00000000), ref: 0041CB1E
SetBkColor.GDI32(00000000,00000000), ref: 0041CB35
73F84D40.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CB7A,?,?,00000000), ref: 0041CB51
SelectObject.GDI32(00000000,?), ref: 0041CB5E
DeleteDC.GDI32(00000000), ref: 0041CB74

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Color$ObjectSelect$F722F78830Text$A570DeleteF86180FillRect
String ID:
API String ID: 4069456242-0
Opcode ID: 91f22b5f6011c81c357de1e84dc44a66cc3856cac21d8458ccd4d39da2566191
Instruction ID: 7128b10ae0d2f5501f58bad1f60f679124a592cf14607d549707b49f1954e982
Opcode Fuzzy Hash: 91f22b5f6011c81c357de1e84dc44a66cc3856cac21d8458ccd4d39da2566191
Instruction Fuzzy Hash: 5961FC71A44609ABDF10EBE5DC86FAFB7B8EF48704F10446AF504E7281C67CA9418B69

Function 0042DEBC Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00497788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEF6
GetVersion.KERNEL32(00000000,0042E0A0,?,00497788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF13
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E0A0,?,00497788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF2C
6D166DE0.KERNEL32(00000000,advapi32.dll,CheckTokenMembership,00000000,0042E0A0,?,00497788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF32
FreeSid.ADVAPI32(00000000,0042E0A7,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E09A

Strings

CheckTokenMembership, xrefs: 0042DF22
advapi32.dll, xrefs: 0042DF27

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: AllocateD166FreeHandleInitializeModuleVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 694118772-1888249752
Opcode ID: 27abd94bd871eef970cc38bdf925798c8b2615b9c2521e24353d865300782ff5
Instruction ID: dc513f8645b6afb09f6ffb8efb590dcade29d579fa2071de5649988e62e102ae
Opcode Fuzzy Hash: 27abd94bd871eef970cc38bdf925798c8b2615b9c2521e24353d865300782ff5
Instruction Fuzzy Hash: 7951B471B44629AEDB10EAE69C42FBF77ECEB09304F94447BB500E7282C5BC9805876D

Function 00467CD8 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167B60.ADVAPI32(?,00467EF2,?,?,00000001,00000000,00000000,00467F0D,?,00000000,00000000,?), ref: 00467EDB

Strings

%s\%s_is1, xrefs: 00467D55
Inno Setup: User Info: Organization, xrefs: 00467EAA
Inno Setup: App Path, xrefs: 00467D9A
Inno Setup: Deselected Tasks, xrefs: 00467E69
Inno Setup: Setup Type, xrefs: 00467DEA
Inno Setup: No Icons, xrefs: 00467DC3
Inno Setup: User Info: Serial, xrefs: 00467EBD
Inno Setup: Icon Group, xrefs: 00467DB6
Inno Setup: User Info: Name, xrefs: 00467E97
Inno Setup: Deselected Components, xrefs: 00467E1C
Inno Setup: Selected Tasks, xrefs: 00467E47
Inno Setup: Selected Components, xrefs: 00467DFA
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00467D37

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 557493163-1093091907
Opcode ID: e2a28e799496d224bccfdf42ed31285894da2d8c9d7af7cea6902e25f9281dcf
Instruction ID: e5c6019ad645161c681394fc100f3765f3f925db4c14fea03ad9fce6ba1afad5
Opcode Fuzzy Hash: e2a28e799496d224bccfdf42ed31285894da2d8c9d7af7cea6902e25f9281dcf
Instruction Fuzzy Hash: 64510630A04208DFCB15DB65D891ADEBBF5EF48318F5084BAE844A7391E739AE05CB4D

Function 00496098 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00496430,?,?,00000000,?,00000000,00000000,?,004967BC,00000000,004967C6,?,00000000), ref: 0049611B
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496430,?,?,00000000,?,00000000,00000000,?,004967BC,00000000), ref: 0049612E
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496430,?,?,00000000,?,00000000,00000000), ref: 0049613E
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0049615F
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496430,?,?,00000000,?,00000000), ref: 0049616F

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00495A8C,00000000,00495C55,?,?,00000005), ref: 0042D35D

Strings

/REG, xrefs: 004960CD
.msg, xrefs: 00496192
.lst, xrefs: 004961AC
Setup, xrefs: 00496107
Inno-Setup-RegSvr-Mutex, xrefs: 00496125
/REGU, xrefs: 004960F1

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 22b814efd2d416af5dc398edbcc4541f0bdcbab13d6dfeecec6cec306f084682
Instruction ID: 9f46506c941652713549f1b08c68450b6ccd64515b85c10261120fdd0c0fc2c8
Opcode Fuzzy Hash: 22b814efd2d416af5dc398edbcc4541f0bdcbab13d6dfeecec6cec306f084682
Instruction Fuzzy Hash: 16919734A042445FDF11EBA5D856BAE7FA4EB49704F5244B7F800A7692C67CAC05CB1D

Function 00459644 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459900,?,?,?,?,?,00000006,?,00000000,004954CB,?,00000000,0049556E), ref: 004597B2

Strings

.hlp, xrefs: 0045967B
Failed to delete the file; it may be in use (%d)., xrefs: 004598A1
Deleting file: %s, xrefs: 00459751
.gid, xrefs: 00459694
.lnk, xrefs: 0045971F
.fts, xrefs: 004596B8
Failed to strip read-only attribute., xrefs: 00459797
.chm, xrefs: 004596E0
The file appears to be in use (%d). Will delete on restart., xrefs: 004597FB
.chw, xrefs: 004596F9
Stripped read-only attribute., xrefs: 0045978B

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 0e88e018359bd56ea83e9ca42840c69bb78ef335d06ecb36f793b854efb74337
Instruction ID: ae29bffe216161f3b84ec47cadcfa1b1e1b13bf6851d944a51d431fa1e6eb895
Opcode Fuzzy Hash: 0e88e018359bd56ea83e9ca42840c69bb78ef335d06ecb36f793b854efb74337
Instruction Fuzzy Hash: A1718F70B10244DBDB01EB6988927AE7BA5AB49315F50446FFC01DB383DB7C9D09C799

Function 0041B31C Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73F84C40.GDI32(00000000,?,00000000,?), ref: 0041B333
73F84C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B33D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B34F
73F86180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B366
73F7A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B372
73F84C00.GDI32(00000000,0000000B,?,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B39F
73F7A480.USER32(00000000,00000000,0041B3D2,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3C5
SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Object$Select$Delete$A480A570F86180Stretch
String ID:
API String ID: 4017903488-0
Opcode ID: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction ID: ef99a8f9a6f00624a9096b2aeeb37702e3b70ceb3a8cbf3cb68c8f3869cb2bd7
Opcode Fuzzy Hash: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction Fuzzy Hash: 1541D071E40619AFDF10DAE9D846FEFB7BCEF08704F104466B614FB281C67869408BA4

Function 0047142C Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 319COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004715BF
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 004716B6
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 004716CC
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 004716F1

Strings

target.lnk, xrefs: 0047173B
Filename: %s, xrefs: 00471561
.url, xrefs: 004714FB
{group}\, xrefs: 00471483
Desktop.ini, xrefs: 00471772
.pif, xrefs: 004714D8, 0047163A
.lnk, xrefs: 004714B5

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 659e8c414b5663f48ca7240e38434f8f6fbc604e4898944c2aef02c753adbba7
Instruction ID: 276268ec1249541e405f117e75d64bf8d60ce4695a1b317412b56633e0787fc8
Opcode Fuzzy Hash: 659e8c414b5663f48ca7240e38434f8f6fbc604e4898944c2aef02c753adbba7
Instruction Fuzzy Hash: 50D11174A00249AFDB01EF99D885BDEBBF5AF08314F54402AF804B73A1D778AD45CB69

Function 00453918 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(00459AD6,00000000,00000000,?,00000000,?,00000000,00453BB1,?,00459AD6,00000003,00000000,00000000,00453BE8), ref: 00453A31

Part of subcall function 0042E634: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045245B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E653

RegQueryValueExA.ADVAPI32(00459AD6,00000000,00000000,00000000,?,00000004,00000000,00453AFB,?,00459AD6,00000000,00000000,?,00000000,?,00000000), ref: 00453AB5
RegQueryValueExA.ADVAPI32(00459AD6,00000000,00000000,00000000,?,00000004,00000000,00453AFB,?,00459AD6,00000000,00000000,?,00000000,?,00000000), ref: 00453AE4

Strings

, xrefs: 004539A2
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00453988
RegOpenKeyEx, xrefs: 004539B4
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045394F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: QueryValue$D167FormatMessage
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 357404014-1577016196
Opcode ID: 1cbd5af67d3494d897aa2e7d98341632fbcd9d204c87823e29d2013091fff2ab
Instruction ID: 905b3235484ef923a59641c26f2361d695b05d11952c9fc3648c43a13cfcc774
Opcode Fuzzy Hash: 1cbd5af67d3494d897aa2e7d98341632fbcd9d204c87823e29d2013091fff2ab
Instruction Fuzzy Hash: 46912475D04248ABDB11DF95C942BDEB7F8EB48346F50406BF900F7282D678AF098B69

Function 00457A68 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00457A9F
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00457ABB
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00457AC9
GetExitCodeProcess.KERNEL32(?), ref: 00457ADA
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00457B21
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00457B3D

Strings

Stopping 64-bit helper process. (PID: %u), xrefs: 00457A91
Helper process exited., xrefs: 00457AE9
Helper process exited with failure code: 0x%x, xrefs: 00457B07
Helper process exited, but failed to get exit code., xrefs: 00457B13
Helper isn't responding; killing it., xrefs: 00457AAB

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: da442ae4ae1bba64dd9877b1e5d7a0867af689c3260008a97d5c2163fd06e020
Instruction ID: 0e5647b699e0e4053093b70322e0bac816875cb8c4e57f81f84cf7f0c67341ed
Opcode Fuzzy Hash: da442ae4ae1bba64dd9877b1e5d7a0867af689c3260008a97d5c2163fd06e020
Instruction Fuzzy Hash: 68214F706087009BC720EB79D445B5BB6D59F48349F04CD3FB999CB283D67CE8489B6A

Function 004535CC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: 6D167C60.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004537A3,?,00000000,00453867), ref: 004536F3
6D167B60.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004537A3,?,00000000,00453867), ref: 0045382F

Part of subcall function 0042E634: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0045245B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E653

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045363B
RegCreateKeyEx, xrefs: 00453667
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045360B
, xrefs: 00453655

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167$FormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2345935623-1280779767
Opcode ID: d11e5dc0a39267f542f4ad34df049df210763827f684adaf02f522aecd99ebb9
Instruction ID: f774ad500d365b47b75025b0db09daed89d271555190a36a67f99eb302bca323
Opcode Fuzzy Hash: d11e5dc0a39267f542f4ad34df049df210763827f684adaf02f522aecd99ebb9
Instruction Fuzzy Hash: C481FEB5E00209ABDB01DFD5C941BDEB7F9EB48345F50452AF900F7282D778AA09CB69

Function 004948B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00452AA4: 6D1674B0.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00494A81,_iu,?,00000000,00452BDE), ref: 00452B93
Part of subcall function 00452AA4: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00494A81,_iu,?,00000000,00452BDE), ref: 00452BA3

6D167310.KERNEL32(00000000,00000000,00000000,00000000,00494A81), ref: 0049492D
6D1682A0.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,00494A81), ref: 0049494E
CreateWindowExA.USER32(00000000,STATIC,00494A90,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00494975
SetWindowLongA.USER32(?,000000FC,00494108), ref: 00494988
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00494A54,?,?,000000FC,00494108,00000000,STATIC,00494A90), ref: 004949B8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00494A2C
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00494A54,?,?,000000FC,00494108,00000000), ref: 00494A38

Part of subcall function 00452DF4: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452EDB

73F85CF0.USER32(?,00494A5B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00494A54,?,?,000000FC,00494108,00000000,STATIC), ref: 00494A4E

Strings

STATIC, xrefs: 0049496E
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 004949E7

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$CloseHandle$CreateD167310D1674D1682LongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 3508449449-2312673372
Opcode ID: e6efb713ec31c7210c6b261dfebe5750cdbe23808931c5ab6916535af8cbbc28
Instruction ID: eacec0d7de1d34e9e6adcdbb3d70d05a742875866a1cfdb7182368b58383cd9c
Opcode Fuzzy Hash: e6efb713ec31c7210c6b261dfebe5750cdbe23808931c5ab6916535af8cbbc28
Instruction Fuzzy Hash: 6B416D70A44208AFDF00EBA5DC42F9E7BF8EB49304F20457AF500F7291D6799E018BA8

Function 0042ECEC Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042ECF8
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042ED0C
6D166DE0.KERNEL32(00000000,MonitorFromWindow,user32.dll), ref: 0042ED19
6D166DE0.KERNEL32(00000000,GetMonitorInfoA,00000000,MonitorFromWindow,user32.dll), ref: 0042ED26
GetWindowRect.USER32(?,00000000), ref: 0042ED72
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042EDB0

Strings

(, xrefs: 0042ED51
GetMonitorInfoA, xrefs: 0042ED20
MonitorFromWindow, xrefs: 0042ED13
user32.dll, xrefs: 0042ED07

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$D166$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2448073347-3407710046
Opcode ID: 329879662c10812dca0cb05d82cbdfd4deb68350b93bbe77506a2d196f0687f4
Instruction ID: 1368e4bb0062d89b761d713291631f5b8d35b0a21c23877071abab058fae4c2c
Opcode Fuzzy Hash: 329879662c10812dca0cb05d82cbdfd4deb68350b93bbe77506a2d196f0687f4
Instruction Fuzzy Hash: 3E21C2727016156BD300966ADC81F7F3299DB94714F48462EF984DB3C1EA78EC008A99

Function 00461948 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00461954
GetModuleHandleA.KERNEL32(user32.dll), ref: 00461968
6D166DE0.KERNEL32(00000000,MonitorFromWindow,user32.dll), ref: 00461975
6D166DE0.KERNEL32(00000000,GetMonitorInfoA,00000000,MonitorFromWindow,user32.dll), ref: 00461982
GetWindowRect.USER32(?,00000000), ref: 004619CE
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00461A0C

Strings

GetMonitorInfoA, xrefs: 0046197C
user32.dll, xrefs: 00461963
MonitorFromWindow, xrefs: 0046196F
(, xrefs: 004619AD

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$D166$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2448073347-3407710046
Opcode ID: 31dc27c94f56a489af11cd422b56e5602cfd71b3e33833abd70379b1cbf008a6
Instruction ID: 7cbe90ee826727f72dd852f5e68c3d1e056aacaf57115fc549a8d9e6174259c1
Opcode Fuzzy Hash: 31dc27c94f56a489af11cd422b56e5602cfd71b3e33833abd70379b1cbf008a6
Instruction Fuzzy Hash: A52195757057046BD210DAA8DC82F7F7695DB84720F0D452EF984EB392EA78DC048A5A

Function 0045534C Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 248comCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0045551D
CoCreateInstance.OLE32(00497A68,00000000,00000001,00497774,?,00000000,00455618), ref: 0045538E

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

CoCreateInstance.OLE32(00497764,00000000,00000001,00497774,?,00000000,00455618), ref: 004553B4

Strings

IPersistFile::Save, xrefs: 0045559F
CoCreateInstance, xrefs: 004553BF
IShellLink::QueryInterface, xrefs: 00455541
IPropertyStore::Commit, xrefs: 00455502
IPropertyStore::SetValue, xrefs: 0045549D, 004554E9

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CreateInstanceString$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue$IShellLink::QueryInterface
API String ID: 2125489766-2052886881
Opcode ID: 8edd77f535cb871ade28310fa67fdf8274502d9e5339ccef6ff14ebc3b7e00c4
Instruction ID: 4d8a2d617cb5ab9f8d815c82e8a4c5f27eb68183f32094cfae16cbf70ecffd7b
Opcode Fuzzy Hash: 8edd77f535cb871ade28310fa67fdf8274502d9e5339ccef6ff14ebc3b7e00c4
Instruction Fuzzy Hash: 90916171A00608AFDB00DFA9C895BAE77F9EF09306F544066F904EB252DB78DD48CB59

Function 00457C40 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00457E1F,?,00000000,00457E82,?,?,00000000,00000000), ref: 00457C9D
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457DB4,?,00000000,00000001,00000000,00000000,00000000,00457E1F), ref: 00457CFA
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457DB4,?,00000000,00000001,00000000,00000000,00000000,00457E1F), ref: 00457D07
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00457D53
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00457D8D,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457DB4,?,00000000), ref: 00457D79
GetLastError.KERNEL32(?,?,00000000,00000001,00457D8D,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00457DB4,?,00000000), ref: 00457D80

Part of subcall function 00452684: GetLastError.KERNEL32(00000000,004530F5,00000005,00000000,0045312A,?,?,00000000,00499628,00000004,00000000,00000000,00000000,?,0049606D,00000000), ref: 00452687

Strings

TransactNamedPipe, xrefs: 00457D13
CreateEvent, xrefs: 00457CAB

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 5111e496d22884c3ca12ecfcd95f31abcce1d4242de21634e117ba1afcf575ef
Instruction ID: e325880bd487f688eb68e79077044c89764efaa974bafea4e3a097419b3f9a5b
Opcode Fuzzy Hash: 5111e496d22884c3ca12ecfcd95f31abcce1d4242de21634e117ba1afcf575ef
Instruction Fuzzy Hash: 3F418F75A04608AFDB15DF95D981FAEB7F8EF08710F1040B6F904E7292C6789E44CA68

Function 004557EC Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00455951,?,?,00000031,?), ref: 00455814
6D166DE0.KERNEL32(00000000,OLEAUT32.DLL,UnRegisterTypeLib,00000000,00455951,?,?,00000031,?), ref: 0045581A
LoadTypeLib.OLEAUT32(00000000,?), ref: 00455867

Part of subcall function 00452684: GetLastError.KERNEL32(00000000,004530F5,00000005,00000000,0045312A,?,?,00000000,00499628,00000004,00000000,00000000,00000000,?,0049606D,00000000), ref: 00452687

Strings

UnRegisterTypeLib, xrefs: 0045580A
OLEAUT32.DLL, xrefs: 0045580F
LoadTypeLib, xrefs: 00455872
UnRegisterTypeLib, xrefs: 004558D3
ITypeLib::GetLibAttr, xrefs: 0045589D
GetProcAddress, xrefs: 00455827

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166ErrorHandleLastLoadModuleType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 3383041954-2711329623
Opcode ID: ddc6cdbc325a847e47818ebc71843f6388ff8623a08199f0cc0c2fd611c7de04
Instruction ID: 39bfa6f5bf076d792192d049135fd0b3a21c0cf7b7a83fa7e785e15512932f38
Opcode Fuzzy Hash: ddc6cdbc325a847e47818ebc71843f6388ff8623a08199f0cc0c2fd611c7de04
Instruction Fuzzy Hash: 3F3194B1A00A04EFDB01EFAACC61E6BB7A9EF897117114466BC04D7652DA3CD914C728

Function 0042E238 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E33D,?,?,00000001,00000000,?,?,00000001,00000000,00000002,00000000,0047EF71), ref: 0042E261
6D166DE0.KERNEL32(00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E33D,?,?,00000001,00000000,?,?,00000001,00000000,00000002,00000000,0047EF71), ref: 0042E267
6D167B60.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E33D,?,?,00000001,00000000,?,?,00000001), ref: 0042E2B5

Strings

kernel32.dll, xrefs: 0042E25C
Control Panel\Desktop\ResourceLocale, xrefs: 0042E2C4
GetUserDefaultUILanguage, xrefs: 0042E257
Locale, xrefs: 0042E2A4
.DEFAULT\Control Panel\International, xrefs: 0042E28C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166D167HandleModule
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 1587692801-2401316094
Opcode ID: a6a0cce6eec9ec970ef843174f7b97f38140660a813487cab3674ebc7f2013c7
Instruction ID: a9e15628429a41aa903e8fd8f3b95f4c053fd787f87159220723fd4e37486eb1
Opcode Fuzzy Hash: a6a0cce6eec9ec970ef843174f7b97f38140660a813487cab3674ebc7f2013c7
Instruction Fuzzy Hash: 40211230B00229EBDB00EAA7DC51A9E77A9EB45315F90447BA901E7281D7789A05DB5C

Function 00416CF0 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416D83
SaveDC.GDI32(?), ref: 00416D97
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416DBA
RestoreDC.GDI32(?,?), ref: 00416DD5
CreateSolidBrush.GDI32(00000000), ref: 00416E55
FrameRect.USER32(?,?,?), ref: 00416E88
DeleteObject.GDI32(?), ref: 00416E92
CreateSolidBrush.GDI32(00000000), ref: 00416EA2
FrameRect.USER32(?,?,?), ref: 00416ED5
DeleteObject.GDI32(?), ref: 00416EDF

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 1d5947cc6fd46d04e169061d65422b30ad9728b618146b6347ce06196b6e0963
Instruction ID: 01d81588b69ff1f480347e903aed9c185fc6c29f227380d1fa6610f1b9ad60dd
Opcode Fuzzy Hash: 1d5947cc6fd46d04e169061d65422b30ad9728b618146b6347ce06196b6e0963
Instruction Fuzzy Hash: A8513C712086449BDB50EF69C8C0B9B77E8EF48314F15566AFD48CB286C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: File$HandlePointer$CloseD1674ErrorLastReadSizeType
String ID:
API String ID: 1365492021-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 00422158 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 004221A3
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 004221C1
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221CE
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221DB
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221E8
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 004221F5
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422202
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042220F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 0042222D
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00422249

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 55899cff766bdbcc94ff6a86b202067e9705f8bfb40a3cb380fd1939efd9d364
Instruction ID: e98f5eede000e984507cfb68b46ad6efe0a5c83d9602cc3651cf502f29ecaa29
Opcode Fuzzy Hash: 55899cff766bdbcc94ff6a86b202067e9705f8bfb40a3cb380fd1939efd9d364
Instruction Fuzzy Hash: 23213370380744BAE720D725DD8BF9B7BD89B04708F0444A5BA487F2D7C6F9AE40869C

Function 00458470 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 00458388: 6D167B60.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004584BA,00000000,00458607,?,00000000,00000000,00000000), ref: 004583D5

6D167B60.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00458607,?,00000000,00000000,00000000), ref: 00458516
6D167B60.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00458607,?,00000000,00000000,00000000), ref: 0045857C

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

Strings

.NET Framework not found, xrefs: 004585CA
v2.0.50727, xrefs: 00458508
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00458530
.NET Framework version %s not found, xrefs: 004585B6
v1.1.4322, xrefs: 0045856E
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 004584CA

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$v1.1.4322$v2.0.50727
API String ID: 557493163-1070292914
Opcode ID: 64d43e537c3979adf2ca0d5ecfb7cb978692e99f67eb6c8a1e00aa2a8de5be81
Instruction ID: 4e92089f5f70179fb3c8c2040c17197a0fe85497668ab66a562ec378a0f93eb8
Opcode Fuzzy Hash: 64d43e537c3979adf2ca0d5ecfb7cb978692e99f67eb6c8a1e00aa2a8de5be81
Instruction Fuzzy Hash: AF419830A04149AFCF00DF69D851BAE77A5EB55305F54447FE840EB283EF799A0ACB58

Function 0042F040 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F06F
GetFocus.USER32 ref: 0042F077
RegisterClassA.USER32(004977AC), ref: 0042F098
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F16C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F0D6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F11C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F12D
SetFocus.USER32(00000000,00000000,0042F14F,?,?,?,00000001,00000000,?,0045732A,00000000,00499628), ref: 0042F134

Strings

TWindowDisabler-Window, xrefs: 0042F0CF, 0042F115

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: f8bc7c983fd01c8465ac09bea207b7373ea9913a917cdc8569d92784f7feacd9
Instruction ID: ed48fe58d8234328e3533d793c8fdf20576eb30d3f31e1ac1cfcf9dd6eb6f0ef
Opcode Fuzzy Hash: f8bc7c983fd01c8465ac09bea207b7373ea9913a917cdc8569d92784f7feacd9
Instruction Fuzzy Hash: 8921B570740710BAE221FB66DC02F2A76A4EB14B04FE1413BF604AB2D1D7B86D5487ED

Function 00460600 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0046063B
GetActiveWindow.USER32 ref: 0046069F
CoInitialize.OLE32(00000000), ref: 004606B3
SHBrowseForFolder.SHELL32(?), ref: 004606CA
CoUninitialize.OLE32(0046070B,00000000,?,?,?,?,?,00000000,0046078F), ref: 004606DF
SetActiveWindow.USER32(?,0046070B,00000000,?,?,?,?,?,00000000,0046078F), ref: 004606F5
SetActiveWindow.USER32(?,?,0046070B,00000000,?,?,?,?,?,00000000,0046078F), ref: 004606FE

Strings

A, xrefs: 00460673

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: fef2655736a559b7dd391880132a7ad9026c64351a8a148270402e8fce88bda2
Instruction ID: 37c39436e97ed81eabe62aa77ef6dee9bf7a92f1429f563ab945fa2329ef4438
Opcode Fuzzy Hash: fef2655736a559b7dd391880132a7ad9026c64351a8a148270402e8fce88bda2
Instruction Fuzzy Hash: DC3110B0E00248AFDB00EFA6D886A9EBBF8EB09304F51447AF404E7251E7785A44CF59

Function 0045C220 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41COMMON

Download Yara Rule

APIs

6D166DE0.KERNEL32(00000000,inflateInit_,?,0047D55A,00000000,0047D59D), ref: 0045C229
6D166DE0.KERNEL32(00000000,inflate,00000000,inflateInit_,?,0047D55A,00000000,0047D59D), ref: 0045C239
6D166DE0.KERNEL32(00000000,inflateEnd,00000000,inflate,00000000,inflateInit_,?,0047D55A,00000000,0047D59D), ref: 0045C249
6D166DE0.KERNEL32(00000000,inflateReset,00000000,inflateEnd,00000000,inflate,00000000,inflateInit_,?,0047D55A,00000000,0047D59D), ref: 0045C259

Strings

inflateEnd, xrefs: 0045C243
inflate, xrefs: 0045C233
inflateReset, xrefs: 0045C253
inflateInit_, xrefs: 0045C223

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 1446878013-3516654456
Opcode ID: 826dc7834a6ddf971866aa6ddafbd67dee50fdfbd8ad58b3f36a8c771695b951
Instruction ID: 4e5389c99fc3eaedb52843568a1ec3be984baf4ccae8e4d5869d1c14776ccf34
Opcode Fuzzy Hash: 826dc7834a6ddf971866aa6ddafbd67dee50fdfbd8ad58b3f36a8c771695b951
Instruction Fuzzy Hash: FE01ECB0D00700DEDB14DFB69CC576236A5A76871EF14807BBC05652A2D77C446DCE9E

Function 0041A84C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A929
73F84D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A963
SetBkColor.GDI32(?,?), ref: 0041A978
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041A9C2
SetTextColor.GDI32(00000000,00000000), ref: 0041A9CD
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041A9DD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA1C
SetTextColor.GDI32(00000000,00000000), ref: 0041AA26
SetBkColor.GDI32(00000000,?), ref: 0041AA33

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 013a84676cdaaaf8083e8e05c083cc8ea11cd0d63c2ab0b08c49955aded63c37
Instruction ID: ed8f24b6f3e6af6789b1e3f2c2c828db1826bcf9a3605880229a579b212ac78f
Opcode Fuzzy Hash: 013a84676cdaaaf8083e8e05c083cc8ea11cd0d63c2ab0b08c49955aded63c37
Instruction Fuzzy Hash: 0561C6B5A00505EFCB40EFA9D985E9AB7F8EF08314B14816AF518DB662C734ED41CF98

Function 00456B94 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00456D48,?, /s ",?,regsvr32.exe",?,00456D48), ref: 00456CBA

Strings

Spawning 32-bit RegSvr32: , xrefs: 00456C41
D, xrefs: 00456C70
Spawning 64-bit RegSvr32: , xrefs: 00456C1F
/s ", xrefs: 00456C03
/u, xrefs: 00456BF6
regsvr32.exe", xrefs: 00456BDB
CreateProcess, xrefs: 00456CAC
0x%x, xrefs: 00456CDD

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 69a64d497105b46139ff8da06d8f9de14067347c773c1c938f031247a6108211
Instruction ID: 7df28f0a73235eb6fbae974d173259b32973fea56a0a8878689a8f25607f735f
Opcode Fuzzy Hash: 69a64d497105b46139ff8da06d8f9de14067347c773c1c938f031247a6108211
Instruction Fuzzy Hash: 65410670A003086BDB11EFE5C841BDDB7F9EF48305F91447BA904BB292D7789A0D8B59

Function 0044C638 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044C669
GetSysColor.USER32(00000014), ref: 0044C670
SetTextColor.GDI32(00000000,00000000), ref: 0044C688
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C6B1
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044C6BB
GetSysColor.USER32(00000010), ref: 0044C6C2
SetTextColor.GDI32(00000000,00000000), ref: 0044C6DA
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C703
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C72E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: b2bfa1e68da8afce1922186c001ae5313270e8a3b34217db5e55b2d75b458334
Instruction ID: 2127100c6141c40d7f67eededaad44c9f4776d5faed6a8b6d4067b126811640b
Opcode Fuzzy Hash: b2bfa1e68da8afce1922186c001ae5313270e8a3b34217db5e55b2d75b458334
Instruction Fuzzy Hash: A821CFB42015007FC710FB2ACD8AE8B7BECDF19319B05857AB914EB3A3C678DD408669

Function 004660B8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 0046615B
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00466181

Part of subcall function 00465FF8: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00466090
Part of subcall function 00465FF8: DestroyCursor.USER32(00000000), ref: 004660A6

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004661D8
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00466239
ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046625F

Strings

c:\directory, xrefs: 00466156
shell32.dll, xrefs: 004661BC

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 96e379616a8dbd5e298cab4f41576ef66587869b70909fd2e269815eae32db12
Instruction ID: 3b27be72d541a1f6ff47da91166f71464ff354dbf70f4bb694ce725078c71905
Opcode Fuzzy Hash: 96e379616a8dbd5e298cab4f41576ef66587869b70909fd2e269815eae32db12
Instruction Fuzzy Hash: 34515074600248AFDB10EF65DC8AFDEBBA8EB49304F5141A7F50497391DA38AE81CB59

Function 00494154 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0044FB14: SetEndOfFile.KERNEL32(?,?,0045B2AE,00000000,0045B439,?,00000000,00000002,00000002), ref: 0044FB1B

Part of subcall function 00406EB8: 6D167770.KERNEL32(00000000,00499628,004963B9,00000000,0049640E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

GetWindowThreadProcessId.USER32(00000000,?), ref: 004941E5
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 004941F9
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00494213
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049421F
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00494225
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00494238

Strings

Deleting Uninstall data files., xrefs: 0049415B

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Process$CloseD167770FileHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1695589687-2568741658
Opcode ID: ce04f79baa2961e921ddd5ad2c735cb47f56f986cdd70c47e60a5901f0bdd457
Instruction ID: 5f89ada4f8a7cd80069c1f31b339ddc62a3491fd6529f86a363eb007593340d3
Opcode Fuzzy Hash: ce04f79baa2961e921ddd5ad2c735cb47f56f986cdd70c47e60a5901f0bdd457
Instruction Fuzzy Hash: 532195703042446EEB10AB75EC4AF273798EB99348F10053BB5009A292DABC9C558B6E

Function 0046EC7C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D168150.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046ED79,?,?,?,?,00000000), ref: 0046ECE3
6D167B60.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046ED79), ref: 0046ECFA
AddFontResourceA.GDI32(00000000), ref: 0046ED17
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0046ED2B

Strings

AddFontResource, xrefs: 0046ED35
Failed to open Fonts registry key., xrefs: 0046ED01
Failed to set value in Fonts registry key., xrefs: 0046ECEC

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167$D168150FontMessageNotifyResourceSend
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 2631276223-649663873
Opcode ID: ce87b511589de5ea9e7d074b0292dcbe3b1408d6b3fda1ba581b925addd431d1
Instruction ID: fa558e4d504448ec01a8f8a4d00b26f6ef26fecaf6298a437289807d612c0241
Opcode Fuzzy Hash: ce87b511589de5ea9e7d074b0292dcbe3b1408d6b3fda1ba581b925addd431d1
Instruction Fuzzy Hash: 7621C1787402017BE710EA679C42F6A77ECCB04748F604437B900EB2C2EA7C9E06866E

Function 00461D88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416380: GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
Part of subcall function 00416380: UnregisterClassA.USER32(?,00400000), ref: 0041641B
Part of subcall function 00416380: RegisterClassA.USER32(?), ref: 0041643E

GetVersion.KERNEL32 ref: 00461DB8
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00461DF6
SHGetFileInfo.SHELL32(00461E94,00000000,?,00000160,00004011), ref: 00461E13
LoadCursorA.USER32(00000000,00007F02), ref: 00461E31
SetCursor.USER32(00000000,00000000,00007F02,00461E94,00000000,?,00000160,00004011), ref: 00461E37
SetCursor.USER32(?,00461E77,00007F02,00461E94,00000000,?,00000160,00004011), ref: 00461E6A

Strings

Explorer, xrefs: 00461DD2

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: b24d29b21ba69f7a46faa7161770bba5e0b6b5a54cf948d678523e21185b607e
Instruction ID: 79590ed0db1f7db43664bb900e5f19b1e335256567ca3de94008b30766a17707
Opcode Fuzzy Hash: b24d29b21ba69f7a46faa7161770bba5e0b6b5a54cf948d678523e21185b607e
Instruction Fuzzy Hash: FC21B7717403046AEB10BBB99C47B9B7698DB09708F4444BFFA05EA2D3DA7D9C04866D

Function 004540B4 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,004542D0,004542D0,?,004542D0,00000000), ref: 0045425C
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,004542D0,004542D0,?,004542D0), ref: 00454269

Part of subcall function 00454020: WaitForInputIdle.USER32(?,00000032), ref: 0045404C
Part of subcall function 00454020: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0045406E
Part of subcall function 00454020: GetExitCodeProcess.KERNEL32(?,?), ref: 0045407D
Part of subcall function 00454020: CloseHandle.KERNEL32(?,004540AA,004540A3,?,?,?,00000000,?,?,0045427D,?,?,?,00000044,00000000,00000000), ref: 0045409D

Strings

.cmd, xrefs: 0045415F
cmG, xrefs: 00454272
.bat, xrefs: 00454144
COMMAND.COM" /C , xrefs: 004541C8
cmd.exe" /C ", xrefs: 00454191
D, xrefs: 004541FC

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmG$cmd.exe" /C "
API String ID: 854858120-1733441660
Opcode ID: 5360ad88fbd24ad73d80326545b093d84d43265a5b1b089361e9add530e1caee
Instruction ID: 0c4c0fca1003911141faeb52d746c6e08c311fc688d82d59798b106f567512d0
Opcode Fuzzy Hash: 5360ad88fbd24ad73d80326545b093d84d43265a5b1b089361e9add530e1caee
Instruction Fuzzy Hash: 37517B74600319ABCB00EF95D841B9EBBB9AF8434DF50447BBC04BB292D7789A498759

Function 00458D78 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00458EFA,?,00000000,00000000,00000000,?,00000006,?,00000000,004954CB,?,00000000,0049556E), ref: 00458E3E

Part of subcall function 00453498: FindClose.KERNEL32(000000FF,0045358E), ref: 0045357D

Strings

Failed to strip read-only attribute., xrefs: 00458E0C
Failed to delete directory (%d). Will retry later., xrefs: 00458E57
Stripped read-only attribute., xrefs: 00458E00
Failed to delete directory (%d)., xrefs: 00458ED4
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00458EB3
Deleting directory: %s, xrefs: 00458DC7
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00458E18

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 9e94a00b7c8aafbd64d09b7c5c661f455be3c305af9493ee55afa8b123f838c4
Instruction ID: c18bf7811258659b1d49b837fcab2845bf2e635f70014d4190d0876b95ea6ebd
Opcode Fuzzy Hash: 9e94a00b7c8aafbd64d09b7c5c661f455be3c305af9493ee55afa8b123f838c4
Instruction Fuzzy Hash: D0418331A042149ACB10DB6988427AFB6F5AB8930AF51856FAC51F7383CF7C8D0DC75A

Function 00422DC0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422E14
GetCapture.USER32 ref: 00422E23
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422E29
ReleaseCapture.USER32 ref: 00422E2E
GetActiveWindow.USER32 ref: 00422E3D
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422EBC
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422F20
GetActiveWindow.USER32 ref: 00422F2F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 9258177ad13ddfb732f89b4e517253646e38761d3748712f1dce8d47c2fdbf96
Instruction ID: e195ad3ef6092fcb53c7f5a5f99a3bf722a53bc0b10f849bc0219bc5d9a36e03
Opcode Fuzzy Hash: 9258177ad13ddfb732f89b4e517253646e38761d3748712f1dce8d47c2fdbf96
Instruction Fuzzy Hash: 0E414270B00254AFDB10EB69DA46B9E77F1EF04304F5540BAF404AB3A2D7B99E40DB18

Function 004293F0 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73F7A570.USER32(00000000), ref: 004293FA
GetTextMetricsA.GDI32(00000000), ref: 00429403

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 00429412
GetTextMetricsA.GDI32(00000000,?), ref: 0042941F
SelectObject.GDI32(00000000,00000000), ref: 00429426
73F7A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0042942E
GetSystemMetrics.USER32(00000006), ref: 00429453
GetSystemMetrics.USER32(00000006), ref: 0042946D

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: 0466589c1e1d35fbe5ff96ce52a9832099c11fcb7759f25f5c51244f7efe9c69
Instruction ID: 1c16e140c275e32b72114e8aab6556a20745a09c5650d7ce1a79e9138ea63f74
Opcode Fuzzy Hash: 0466589c1e1d35fbe5ff96ce52a9832099c11fcb7759f25f5c51244f7efe9c69
Instruction Fuzzy Hash: 990104917087103BF710B67A9CC2F6B6188DB9835CF44003FFA469A3D3D56C8C45866A

Function 0041DD94 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

73F7A570.USER32(00000000,?,00418FC9,00496859), ref: 0041DD97
73F84620.GDI32(00000000,0000005A,00000000,?,00418FC9,00496859), ref: 0041DDA1
73F7A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,00418FC9,00496859), ref: 0041DDAE
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DDBD
GetStockObject.GDI32(00000007), ref: 0041DDCB
GetStockObject.GDI32(00000005), ref: 0041DDD7
GetStockObject.GDI32(0000000D), ref: 0041DDE3
LoadIconA.USER32(00000000,00007F00), ref: 0041DDF4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ObjectStock$A480A570F84620IconLoad
String ID:
API String ID: 80563815-0
Opcode ID: 317499979f49fa73b385b8be1ae7cdb80e5b8471e60adc8a579b49d429647add
Instruction ID: 3a47761d36ad02bfc78df21afa9cf5b0727bd80dff73dd58f07baa36398988a3
Opcode Fuzzy Hash: 317499979f49fa73b385b8be1ae7cdb80e5b8471e60adc8a579b49d429647add
Instruction Fuzzy Hash: 7C1100706453415AEB40BF695992BAA3690DB64748F00813FF609AF2D2DB7E1C448B5E

Function 00462198 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 0046229C
SetCursor.USER32(00000000,00000000,00007F02,00000000,00462331), ref: 004622A2
SetCursor.USER32(?,00462319,00007F02,00000000,00462331), ref: 0046230C

Strings

Internal error: Item already expanding, xrefs: 00462239
, xrefs: 00462532
, xrefs: 00462517

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 2ce7a8aeb611f8e8680d3bac35d89eb1a546af4a85e588927e5d965216b18884
Instruction ID: c3b507160399384885c163df025ccdf7e0092f68cfd92cdad35cb5f243267c7a
Opcode Fuzzy Hash: 2ce7a8aeb611f8e8680d3bac35d89eb1a546af4a85e588927e5d965216b18884
Instruction Fuzzy Hash: F3B19330600A44FFD720DF69C655B9ABBF0AF04304F5484AAE8459B792E7BCED45CB1A

Function 00452DF4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452EDB

Strings

NUL, xrefs: 00452F9D
WININIT.INI, xrefs: 00452E89
MoveFileEx, xrefs: 004530EB
.tmp, xrefs: 00452E97
[rename], xrefs: 00452F3E, 00452F7A

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: faacb5120dd61607f15e43a99d6fdf512cd37292a6e7288d3bb959f7b4079db3
Instruction ID: 6742f166414d42bb53fc7f870b2ac63f599eea8e39eec4f9f047603fe75cda16
Opcode Fuzzy Hash: faacb5120dd61607f15e43a99d6fdf512cd37292a6e7288d3bb959f7b4079db3
Instruction Fuzzy Hash: 57911230E002499BDB01EFA5D982BDEB7B5EF49745F508077E800B7296D778AE09CB58

Function 00474FE4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 0047503D
73F859E0.USER32(00000000,000000FC,00474F98,00000000,0047527C,?,00000000,004752A6), ref: 00475064
GetACP.KERNEL32(00000000,0047527C,?,00000000,004752A6), ref: 004750A1
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004750E7

Strings

COMBOBOX, xrefs: 00475036
Inno Setup: Language, xrefs: 0047516F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ClassF859InfoMessageSend
String ID: COMBOBOX$Inno Setup: Language
API String ID: 1758235654-4234151509
Opcode ID: 6b130839cf11617b621cea3722220a3d04441580ed45be4d4d37919108964c35
Instruction ID: fabf997e48ae97986d7f230cd689813c7c73d3db0777660193f5721c0c0d9349
Opcode Fuzzy Hash: 6b130839cf11617b621cea3722220a3d04441580ed45be4d4d37919108964c35
Instruction Fuzzy Hash: 03813030A046059FCB10DF69C985AAAB7F1FB08304F5581BAE808EB362D778AD41CB59

Function 00408688 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004088D0,?,?,?,?,00000000,00000000,00000000,?,004098D7,00000000,004098EA), ref: 004086A2

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004994C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Part of subcall function 0040851C: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040871E,?,?,?,00000000,004088D0), ref: 0040852F

Strings

:mm, xrefs: 00408884
AMPM, xrefs: 0040886D
:mm:ss, xrefs: 0040889E
mmmm d, yyyy, xrefs: 00408793
m/d/yy, xrefs: 00408771

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: a30fc41475cb844fc1d0cd96782bde6282fdc384be22a0289465391dc2abf4b9
Instruction ID: 2534e8f89ba6a18a24524fff76901190ecdb34efc2f457388f889d4d1fe01f59
Opcode Fuzzy Hash: a30fc41475cb844fc1d0cd96782bde6282fdc384be22a0289465391dc2abf4b9
Instruction Fuzzy Hash: 1F515B34B002486BDB01FBAA8941A9F7769DB98308F50D47FA141BB3C6CA3DCE06871D

Function 00411664 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411869), ref: 004116FC
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 004117BA

Part of subcall function 00411A1C: CreatePopupMenu.USER32 ref: 00411A36

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 00411846

Part of subcall function 00411A1C: CreateMenu.USER32 ref: 00411A40

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 0041182D

Strings

?, xrefs: 00411716
,, xrefs: 0041170F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 427dcd3bd3284b7198b9ac8e2351f7ed5d652d75c1074368b86d3c51f4e1672e
Instruction ID: 9f3cd353704c6e6df4760fc9e7825bd2b36e241702b237f10a7cfd97aeeb4675
Opcode Fuzzy Hash: 427dcd3bd3284b7198b9ac8e2351f7ed5d652d75c1074368b86d3c51f4e1672e
Instruction Fuzzy Hash: 2E511474A14140ABDB10EF6ADC816DA7BF9AF09304B1585BBFA04E73A6D738C941CB5C

Function 0041BDD3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BE98
GetObjectA.GDI32(?,00000018,?), ref: 0041BEA7
GetBitmapBits.GDI32(?,?,?), ref: 0041BEF8
GetBitmapBits.GDI32(?,?,?), ref: 0041BF06
DeleteObject.GDI32(?), ref: 0041BF0F
DeleteObject.GDI32(?), ref: 0041BF18
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BF35

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 3d797d1906e0c606487274bef3f8b6967846da0d995fd7b3f29d94f188c04d3b
Instruction ID: 6ccfe3e05be1f9361b89c498b95593dd8bbd66f2dd05af997845d9e2841d21eb
Opcode Fuzzy Hash: 3d797d1906e0c606487274bef3f8b6967846da0d995fd7b3f29d94f188c04d3b
Instruction Fuzzy Hash: 91510571E00219AFCB14DFA9D8819EEB7F9EF48314B10446AF914E7391D738AD81CB64

Function 0041CE48 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CE6E
73F84620.GDI32(00000000,00000026), ref: 0041CE8D
73F78830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CEF3
73F722A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF02
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CF6C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041CFAA
73F78830.GDI32(?,?,00000001,0041CFDC,00000000,00000026), ref: 0041CFCF

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Stretch$F78830$BitsF722F84620Mode
String ID:
API String ID: 891820546-0
Opcode ID: 74297f3bd10097d01eff673f8498ce71c96219b6a5d33082056140f7efed8789
Instruction ID: 0295d75a013be80ecc2d975aeb153abe1d20fbb24d7cab5e263b7fb8805ed029
Opcode Fuzzy Hash: 74297f3bd10097d01eff673f8498ce71c96219b6a5d33082056140f7efed8789
Instruction Fuzzy Hash: 6A512970644600AFDB14DFA8C985FABBBF9AF08304F10459AF544DB292C778ED80CB58

Function 00455DA8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 00455DFA

Part of subcall function 004241EC: GetWindowTextA.USER32(?,?,00000100), ref: 0042420C

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73F85940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042EA14,?,00000001), ref: 0041EE69

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00455E61
TranslateMessage.USER32(?), ref: 00455E7F
DispatchMessageA.USER32(?), ref: 00455E88

Strings

[Paused] , xrefs: 00455E30

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Message$TextWindow$CurrentDispatchF85940SendThreadTranslate
String ID: [Paused]
API String ID: 4181422233-4230553315
Opcode ID: 974f50c28e7a0d06d1499ac9cc24255be8932453f55a04bd5513a218078ddf53
Instruction ID: 5631f5fef0d136326ce9ec6fe6a6c5ad4cf360b27ce0d5c9196fa0682c0395d6
Opcode Fuzzy Hash: 974f50c28e7a0d06d1499ac9cc24255be8932453f55a04bd5513a218078ddf53
Instruction Fuzzy Hash: 1C31B7319046449EDB11DBB9DC52BDEBBB8EB49314F55407BE800E7292D73C9E09CB29

Function 00469E38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,00469F77), ref: 00469EF4
LoadCursorA.USER32(00000000,00007F02), ref: 00469F02
SetCursor.USER32(00000000,00000000,00007F02,00000000,00469F77), ref: 00469F08
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,00469F77), ref: 00469F12
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,00469F77), ref: 00469F18

Strings

CheckPassword, xrefs: 00469E9C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 5190d1b9022a4a1901e6d2d6fd4117dbf96bdd56d7e6ea468fc9ea279eb906d8
Instruction ID: 15d1937f4172d90e864f08df21a73f22350dd5d95189fb01be908ffc385681df
Opcode Fuzzy Hash: 5190d1b9022a4a1901e6d2d6fd4117dbf96bdd56d7e6ea468fc9ea279eb906d8
Instruction Fuzzy Hash: 3931A534740204AFD711DB69C88AF9A7BE4EF48304F5580BAB8049F3E2D7B89D40CB49

Function 00475FFC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00475F24: GetWindowThreadProcessId.USER32(00000000), ref: 00475F2C
Part of subcall function 00475F24: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00476023,0049A03C,00000000), ref: 00475F3F
Part of subcall function 00475F24: 6D166DE0.KERNEL32(00000000,user32.dll,AllowSetForegroundWindow,00000000,?,?,00476023,0049A03C,00000000), ref: 00475F45

SendMessageA.USER32(00000000,0000004A,00000000,004763B6), ref: 00476031
GetTickCount.KERNEL32 ref: 00476076
GetTickCount.KERNEL32 ref: 00476080
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 004760D5

Strings

CallSpawnServer: Unexpected status: %d, xrefs: 004760BE
CallSpawnServer: Unexpected response: $%x, xrefs: 00476066

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CountTick$D166HandleMessageModuleMultipleObjectsProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 1874973071-3771334282
Opcode ID: d9391f7ff84f521ee5e8d0d5a8338081c105a43ec95f3db65b7eab306574c1a7
Instruction ID: 7fc3440640e0aba4a39dc3708d8047dd0d8c3a2e160d9e8c8e3136e6a7122d16
Opcode Fuzzy Hash: d9391f7ff84f521ee5e8d0d5a8338081c105a43ec95f3db65b7eab306574c1a7
Instruction Fuzzy Hash: 5931B174F006159ACB10EBB988467EEB6E5EF04304F90813AF148EB382D6BD9D05879D

Function 004586F0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

6D166DE0.KERNEL32(626D6573,CreateAssemblyCache,00000000,004587F3,?,?,?,00000000), ref: 004587AB

Strings

.NET Framework CreateAssemblyCache function failed, xrefs: 004587CE
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 004587B6
Fusion.dll, xrefs: 0045874B
CreateAssemblyCache, xrefs: 004587A2
Failed to load .NET Framework DLL "%s", xrefs: 00458790

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 1446878013-3990135632
Opcode ID: 8bbf340b64d83b10f3ec2cabc1b3994f22f1d6da3731548a8a0c58cdda6b247c
Instruction ID: 81554f96b97ec1de94d6379c777798724e8092ba429b6bbf7826aab024c65cc6
Opcode Fuzzy Hash: 8bbf340b64d83b10f3ec2cabc1b3994f22f1d6da3731548a8a0c58cdda6b247c
Instruction Fuzzy Hash: 30316671E006096BCB11EBA5C88159FB7A5EB09315F50857FE814B7382DF389A098B99

Function 0041C0B8 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB8: GetObjectA.GDI32(?,00000018), ref: 0041BFC5

GetFocus.USER32 ref: 0041C0D8
73F7A570.USER32(?), ref: 0041C0E4
73F78830.GDI32(?,?,00000000,00000000,0041C163,?,?), ref: 0041C105
73F722A0.GDI32(?,?,?,00000000,00000000,0041C163,?,?), ref: 0041C111
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C128
73F78830.GDI32(?,00000000,00000000,0041C16A,?,?), ref: 0041C150
73F7A480.USER32(?,?,0041C16A,?,?), ref: 0041C15D

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: F78830$A480A570BitsF722FocusObject
String ID:
API String ID: 3455042967-0
Opcode ID: 79a038cea31138c71b2ef77edfdeafaab103df7d1acda3a818e2678accba0093
Instruction ID: be6d8328aec04e85a436dd0cf8ae2147a44d9b66c6d411dca3268b31211d8f12
Opcode Fuzzy Hash: 79a038cea31138c71b2ef77edfdeafaab103df7d1acda3a818e2678accba0093
Instruction Fuzzy Hash: B2116A71A40618BFDB10DBA9CC86FAFB7FCEF48700F54446AB514E7281D6789D008B68

Function 00418BC4 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418BE0
GetSystemMetrics.USER32(0000000D), ref: 00418BE8
6FA82980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418BEE

Part of subcall function 00409920: 6FA7C400.COMCTL32(00499628,000000FF,00000000,00418C1C,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00409924

6FAECB00.COMCTL32(00499628,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C3E
6FAEC740.COMCTL32(00000000,?,00499628,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418C49
6FAECB00.COMCTL32(00499628,00000001,?,?,00000000,?,00499628,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000), ref: 00418C5C
6FA80860.COMCTL32(00499628,00418C7F,?,00000000,?,00499628,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E), ref: 00418C72

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: MetricsSystem$A80860A82980C400C740
String ID:
API String ID: 265698141-0
Opcode ID: e60f9813f3a55f33c9c30997bb55312e8b08414ce97b83284cdc55a22c36d154
Instruction ID: 26b891211d8d430f193af2678edb9fbe52fb5794735e9b484422d58a1dee4d18
Opcode Fuzzy Hash: e60f9813f3a55f33c9c30997bb55312e8b08414ce97b83284cdc55a22c36d154
Instruction Fuzzy Hash: D3113675744204BADB10EBF5DC82F5E73B8DB48704F5040AEB604E72D2E6799D408768

Function 00481594 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167B60.ADVAPI32(?,?,00000001,00000000,00000000,0048164C), ref: 00481631

Strings

System\CurrentControlSet\Control\ProductOptions, xrefs: 004815B8
ProductType, xrefs: 004815D0
WinNT, xrefs: 004815E1
ServerNT, xrefs: 00481615
LanmanNT, xrefs: 004815FB

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 557493163-2530820420
Opcode ID: 33c21e0d2e6add59f1b24b6a849ee8a96c3074c7579e45bf81f1fcf8c17d26aa
Instruction ID: 592cd06a245c4f5f2cb2cd7b4b64ace286a6c4331103c7d230e3d6d92b95bea5
Opcode Fuzzy Hash: 33c21e0d2e6add59f1b24b6a849ee8a96c3074c7579e45bf81f1fcf8c17d26aa
Instruction Fuzzy Hash: 2511D070B04204ABDB10FB6A8802B9F7BACDB11304F154877A841F72A2F7788E03975D

Function 0049316C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73F7A570.USER32(00000000,?,?,00000000), ref: 0049317D

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 0049319F
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,0049371D), ref: 004931B3
GetTextMetricsA.GDI32(00000000,?), ref: 004931D5
73F7A480.USER32(00000000,00000000,004931FF,004931F8,?,00000000,?,?,00000000), ref: 004931F2

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004931AA

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: 00ab011a0482a4ca9d99f930a833df1ccd569561059c6994f7e4ec24a9fe92c6
Instruction ID: 4ec58355845d2b02f69284f4495f440b55ff71641bc2e0f0a28a2b12dc5a472b
Opcode Fuzzy Hash: 00ab011a0482a4ca9d99f930a833df1ccd569561059c6994f7e4ec24a9fe92c6
Instruction Fuzzy Hash: CE016176A44608BFEB00DFA9CC42E5EB7ECDB49704F51447AB604E7291D678AE008B28

Function 0041B3D2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction ID: 073f11bba2386bee955988a390c3df6f0cbda7ed7a331810ab0cae2060ca734e
Opcode Fuzzy Hash: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction Fuzzy Hash: F9114C72E40659ABDF10D6D9D985FAFB3BCEF08704F048456B614FB242C678A8418B54

Function 00423304 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 0042331F
WindowFromPoint.USER32(?,?), ref: 0042332C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042333A
GetCurrentThreadId.KERNEL32 ref: 00423341
SendMessageA.USER32(00000000,00000084,?,?), ref: 0042335A
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423371
SetCursor.USER32(00000000), ref: 00423383

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: b7c3d0ed9cab098bf85e911ca9467ad0a8c32c8ca0e3c41edecca8c26dcac659
Instruction ID: 4e500bdd1cb7c406dcecfc45487f359b17b305850d12e3c552a5b3a09f906ed3
Opcode Fuzzy Hash: b7c3d0ed9cab098bf85e911ca9467ad0a8c32c8ca0e3c41edecca8c26dcac659
Instruction Fuzzy Hash: EC01D4223043103AD620BB795C86E3F26A8CFC5B55F50417FB909BE283DA3D8D0163AD

Function 00476700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,021D2BFC,?,?,?,021D2BFC,004767EC,00000000,0047690A,?,?,?,?), ref: 00476719
6D166DE0.KERNEL32(00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BFC,?,?,?,021D2BFC,004767EC,00000000,0047690A,?,?,?,?), ref: 0047671F
6D1674B0.KERNEL32(00000000,00000080,00000007,00000000,00000003,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,021D2BFC,?,?,?,021D2BFC,004767EC), ref: 00476741
CloseHandle.KERNEL32(00000000,?,?,?,021D2BFC,004767EC,00000000,0047690A,?,?,?,?), ref: 0047675F

Strings

GetFinalPathNameByHandleA, xrefs: 0047670F
kernel32.dll, xrefs: 00476714

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Handle$CloseD166D1674Module
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 730909071-2318956294
Opcode ID: 342ad769757e769c0df952a9a5769ddf6768b88966d0b427d74164e61265f34c
Instruction ID: b1273806145a63f9a8243b19b57c825c7ee45b57583113674eff970469e2f101
Opcode Fuzzy Hash: 342ad769757e769c0df952a9a5769ddf6768b88966d0b427d74164e61265f34c
Instruction Fuzzy Hash: 7B01A251741F0036E524756A0CC3FBB658D8B44BA9F25813BBA48AA2C2D9AC9D05019D

Function 00492F90 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00492FA0
6D166DE0.KERNEL32(00000000,MonitorFromRect,user32.dll), ref: 00492FAD
6D166DE0.KERNEL32(00000000,GetMonitorInfoA,00000000,MonitorFromRect,user32.dll), ref: 00492FBA

Strings

GetMonitorInfoA, xrefs: 00492FB4
MonitorFromRect, xrefs: 00492FA7
user32.dll, xrefs: 00492F9B

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 4215997472-2254406584
Opcode ID: 78aad8e0b9714be116a3aea95144d42542147ec8597618743bc89a8df43bfd09
Instruction ID: cea5fac38c2e36fda3f38752097ffcd25a4d7e14f24dd8c8f836c606a3de58aa
Opcode Fuzzy Hash: 78aad8e0b9714be116a3aea95144d42542147ec8597618743bc89a8df43bfd09
Instruction Fuzzy Hash: 2AF0F69274171477DE6065B61C81E7B6D9CCB85771F040037BD04F7386E99C8D0592BD

Function 0045C0F4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

6D166DE0.KERNEL32(00000000,ISCryptGetVersion,?,0047D6E3,00000000,0047D70C), ref: 0045C0FD
6D166DE0.KERNEL32(00000000,ArcFourInit,00000000,ISCryptGetVersion,?,0047D6E3,00000000,0047D70C), ref: 0045C10D
6D166DE0.KERNEL32(00000000,ArcFourCrypt,00000000,ArcFourInit,00000000,ISCryptGetVersion,?,0047D6E3,00000000,0047D70C), ref: 0045C11D

Strings

ArcFourCrypt, xrefs: 0045C117
ArcFourInit, xrefs: 0045C107
ISCryptGetVersion, xrefs: 0045C0F7

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1446878013-508647305
Opcode ID: 1e4b4554fa8dc7ed0896e28cfb45fbec44cae0d49747c5ad8009963892b4c210
Instruction ID: aed6ea8d9d3c8b9440fa0c8f086378259b955efe14af5088ffa7e98f00b34660
Opcode Fuzzy Hash: 1e4b4554fa8dc7ed0896e28cfb45fbec44cae0d49747c5ad8009963892b4c210
Instruction Fuzzy Hash: 6FF0F9B0505B009EDB24DF76ACCDFA27695AB90702F14843BA444951B3D77C0668EADE

Function 0045C5F4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

6D166DE0.KERNEL32(00000000,BZ2_bzDecompressInit,?,0047D574,00000000,0047D59D), ref: 0045C5FD
6D166DE0.KERNEL32(00000000,BZ2_bzDecompress,00000000,BZ2_bzDecompressInit,?,0047D574,00000000,0047D59D), ref: 0045C60D
6D166DE0.KERNEL32(00000000,BZ2_bzDecompressEnd,00000000,BZ2_bzDecompress,00000000,BZ2_bzDecompressInit,?,0047D574,00000000,0047D59D), ref: 0045C61D

Strings

BZ2_bzDecompressInit, xrefs: 0045C5F7
BZ2_bzDecompressEnd, xrefs: 0045C617
BZ2_bzDecompress, xrefs: 0045C607

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 1446878013-212574377
Opcode ID: 33f842e00593cb357119dfa6f9a480721ccadad753552c0f5e582bb033676269
Instruction ID: db07a3548f1b4e2cfd50f82a9a0b282cd256409efcee8e5d658b723deb76043f
Opcode Fuzzy Hash: 33f842e00593cb357119dfa6f9a480721ccadad753552c0f5e582bb033676269
Instruction Fuzzy Hash: 0DF030B0902300DEDB04DF36ACC072632A5E76874AF14E43B9C05592A2DB7C0568CF5E

Function 0044BC9C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044E549), ref: 0044BCAB
6D166DE0.KERNEL32(00000000,LresultFromObject,oleacc.dll,?,0044E549), ref: 0044BCBC
6D166DE0.KERNEL32(00000000,CreateStdAccessibleObject,00000000,LresultFromObject,oleacc.dll,?,0044E549), ref: 0044BCCC

Strings

LresultFromObject, xrefs: 0044BCB6
oleacc.dll, xrefs: 0044BCA6
CreateStdAccessibleObject, xrefs: 0044BCC6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 3670945825-1050967733
Opcode ID: e9e002c519eea4ea79b14f61333e405369ee6d80d36180ba86343255585cae84
Instruction ID: 198f4a53d7b827362494993b39ef16200e6ed3be4a6c00edf1fbc836726e95c8
Opcode Fuzzy Hash: e9e002c519eea4ea79b14f61333e405369ee6d80d36180ba86343255585cae84
Instruction Fuzzy Hash: 22F0FEB0660351CAFF10AFB9EDC57623694E364709F1451BFA4025A2D2CFBD8C44CA5C

Function 00476ED8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0049689A), ref: 00476EDE
6D166DE0.KERNEL32(00000000,VerSetConditionMask,kernel32.dll,?,0049689A), ref: 00476EEB
6D166DE0.KERNEL32(00000000,VerifyVersionInfoW,00000000,VerSetConditionMask,kernel32.dll,?,0049689A), ref: 00476EFB

Strings

kernel32.dll, xrefs: 00476ED9
VerSetConditionMask, xrefs: 00476EE5
VerifyVersionInfoW, xrefs: 00476EF5

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 4215997472-222143506
Opcode ID: 8579039af7882282ecf87d49981187eb6e55a2056c897e057ee5ca9e035bf5af
Instruction ID: 334153fe173fcca34c6ba34e65941f511c8fcbd2c254e8132cf735f1af7427f0
Opcode Fuzzy Hash: 8579039af7882282ecf87d49981187eb6e55a2056c897e057ee5ca9e035bf5af
Instruction Fuzzy Hash: B6C012E0285B00EEEE00BFB13DC3D7B294AC590B28321843BB148791C3D6BD0C188E6E

Function 0041B5DC Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B6B5
73F7A570.USER32(?), ref: 0041B6C1
73F78830.GDI32(00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B6F6
73F722A0.GDI32(00000000,00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B702
73F86310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B730
73F78830.GDI32(00000000,00000000,00000000,0041B771,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B764

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: F78830$A570F722F86310Focus
String ID:
API String ID: 2456752540-0
Opcode ID: d29f05eb6b29070db352309e07eb4e8bfeb24327755f0d073565eec47d644615
Instruction ID: 06dd750ffd38faa4806619bbf82afcbb6c92213719a6bc319da55d16d67b79f4
Opcode Fuzzy Hash: d29f05eb6b29070db352309e07eb4e8bfeb24327755f0d073565eec47d644615
Instruction Fuzzy Hash: 8E512C70A00609AFDF11DFA9C895AEEBBB8FF49704F104466F510A7390D7789981CBA9

Function 0041B8AC Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B987
73F7A570.USER32(?), ref: 0041B993
73F78830.GDI32(00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9CD
73F722A0.GDI32(00000000,00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9D9
73F86310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041B9FD
73F78830.GDI32(00000000,00000000,00000000,0041BA3E,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041BA31

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: F78830$A570F722F86310Focus
String ID:
API String ID: 2456752540-0
Opcode ID: 7c51fc24fae23f99d30c86bebf47e6e5bb2fa1576662f29aaf30661c9bdccefa
Instruction ID: 49b1e422d63778e1935042bf56866254f806bc58ba08b8974fd4ee1451f7b7cb
Opcode Fuzzy Hash: 7c51fc24fae23f99d30c86bebf47e6e5bb2fa1576662f29aaf30661c9bdccefa
Instruction Fuzzy Hash: 4F512B74A006089FCB11DFA9C895AAEBBF9FF48700F118066F904EB750D7389D40CBA8

Function 0041B478 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B4EE
73F7A570.USER32(?,00000000,0041B5C8,?,?,?,?), ref: 0041B4FA
73F84620.GDI32(?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B516
73FAE680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B533
73FAE680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8), ref: 0041B54A
73F7A480.USER32(?,?,0041B5A3,?,?), ref: 0041B596

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: E680$A480A570F84620Focus
String ID:
API String ID: 1182602078-0
Opcode ID: 1f4298d78a2f1742154d7222e83094663d7d9fd1bb92d6f88fa0bedfa030a04b
Instruction ID: a6e4b16520c9e4bc630ca31e265eea6a5194191570467489af8bdb357d288b52
Opcode Fuzzy Hash: 1f4298d78a2f1742154d7222e83094663d7d9fd1bb92d6f88fa0bedfa030a04b
Instruction Fuzzy Hash: 2D41C571A04254AFDF10DFA9C885AAFBBB5EF49704F1484AAE900E7351D2389D10CBA5

Function 0045BFB8 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045C084,?,?,?,?,00000000), ref: 0045C023
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045C0F0,?,00000000,0045C084,?,?,?,?,00000000), ref: 0045C062

Strings

CLASSES_ROOT, xrefs: 0045BFE8
USERS, xrefs: 0045C015
MACHINE, xrefs: 0045C006
CURRENT_USER, xrefs: 0045BFF7

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 1635db9367c3538f01df35720d1f6460fc1de285fb0027a2b8e666c186e7b59a
Instruction ID: b6cd0bec3ff09a3bb6dc86b9927888ec64e4347f774d72f3c1437a5c2b732091
Opcode Fuzzy Hash: 1635db9367c3538f01df35720d1f6460fc1de285fb0027a2b8e666c186e7b59a
Instruction Fuzzy Hash: 8F11A535204308EFD711DAE1C9C1BAF76ADDB44B1AF608077AD00A62C3D67C5F0A956A

Function 0041BCFC Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BD45
GetSystemMetrics.USER32(0000000C), ref: 0041BD4F
73F7A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD59
73F84620.GDI32(00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD80
73F84620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD8D
73F7A480.USER32(00000000,00000000,0041BDD3,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDC6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: F84620MetricsSystem$A480A570
String ID:
API String ID: 3949167401-0
Opcode ID: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction ID: 8181195c8b7ace5e518c23098daf85fccaa127339f370ed271397b7e8efdaee2
Opcode Fuzzy Hash: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction Fuzzy Hash: 1F212C74E046499FEB04EFA9C941BEEB7B4EB48714F10402AF514B7680D7785940CFA9

Function 004135AC Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 004135D4
GetWindowLongA.USER32(?,000000F0), ref: 004135DF
GetWindowLongA.USER32(?,000000F4), ref: 004135F1
SetWindowLongA.USER32(?,000000F4,?), ref: 00413604
SetPropA.USER32(?,00000000,00000000), ref: 0041361B
SetPropA.USER32(?,00000000,00000000), ref: 00413632

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 4ddfdf6a7757ea552a82c0c4c22da95f795192ce00a0438a73c6c00e638455e2
Instruction ID: fc28b156e1f5584ed0309b3167e09f9ed1df3e03a3a700cae6e5885bbd9195fc
Opcode Fuzzy Hash: 4ddfdf6a7757ea552a82c0c4c22da95f795192ce00a0438a73c6c00e638455e2
Instruction Fuzzy Hash: 1511F976114204BFDB00DF99DC84E9A3BE8AB08364F108266B918DB2A1D738D9908B68

Function 0047C3AC Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047C3BA
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046B588), ref: 0047C3E0
GetWindowLongA.USER32(?,000000EC), ref: 0047C3F0
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047C411
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047C425
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047C441

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 7c432d6b7207baace45a7fec6191b6016af158ff3578d68d92032f8752a16d6c
Instruction ID: aa46c9770f5a049cfa1fc35fa8fa508e72473281f0db034a4ddf36960027aefc
Opcode Fuzzy Hash: 7c432d6b7207baace45a7fec6191b6016af158ff3578d68d92032f8752a16d6c
Instruction Fuzzy Hash: 5F010CB5651210ABE610DB68CD91FAA3798AB0D334F05466EB559DF2E3C629DC408B48

Function 0041B1E0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A650: CreateBrushIndirect.GDI32 ref: 0041A6BB

UnrealizeObject.GDI32(00000000), ref: 0041B1EC
SelectObject.GDI32(?,00000000), ref: 0041B1FE
SetBkColor.GDI32(?,00000000), ref: 0041B221
SetBkMode.GDI32(?,00000002), ref: 0041B22C
SetBkColor.GDI32(?,00000000), ref: 0041B247
SetBkMode.GDI32(?,00000001), ref: 0041B252

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction ID: 2be34f36c4bf399c8fa5e8a938e63ded300dcfd20fe04f8c9e05bbd916d2a40e
Opcode Fuzzy Hash: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction Fuzzy Hash: 84F0BFB1511101ABCE00FFBAD9CAE4B27A89F443097048057B944DF19BC63CDC504B3E

Function 00454774 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167B60.ADVAPI32(?,?,00000001,00000000,00000000,0045490B,?,00000000,0045494B), ref: 00454851

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004547D4
PendingFileRenameOperations2, xrefs: 00454820
PendingFileRenameOperations, xrefs: 004547F0
WININIT.INI, xrefs: 00454880

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 557493163-2199428270
Opcode ID: e7607ece70d0f5f5ee74137fab1a4bb6db07373ca8769939dfb7f522c0d98637
Instruction ID: e585b470d606cef0f7ff89ad470cd776915c75dff17687b4f5620fe554696a3d
Opcode Fuzzy Hash: e7607ece70d0f5f5ee74137fab1a4bb6db07373ca8769939dfb7f522c0d98637
Instruction Fuzzy Hash: E751BC74E042489FDB10EF71DC529DEB7B9EF84309F10857BE804AB292DB399E45CA18

Function 00454EA8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00454FDC), ref: 00454ED8
6D166DE0.KERNEL32(00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00454FDC), ref: 00454EDE

Strings

GetDiskFreeSpaceExA, xrefs: 00454ECE
kernel32.dll, xrefs: 00454ED3

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModule
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 439651959-3712701948
Opcode ID: 1189ca3242940dc4504bc600adf4358f0779097aa4101c01e5a4aca5621140fb
Instruction ID: 6556e6f8e85692071989244b9e76e97104b9a8ec68df38102fc512f580600cd7
Opcode Fuzzy Hash: 1189ca3242940dc4504bc600adf4358f0779097aa4101c01e5a4aca5621140fb
Instruction Fuzzy Hash: D7314471A04249AFCB01DFA9C892DEFB7B8EF89705F504566F800F7292D6785D098B68

Function 00495A24 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,00495C89,?,?,00000000), ref: 00495A5A

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

Part of subcall function 00407210: SetCurrentDirectoryA.KERNEL32(00000000,?,00495A82,00000000,00495C55,?,?,00000005,00000000,00495C89,?,?,00000000), ref: 0040721B

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00495A8C,00000000,00495C55,?,?,00000005), ref: 0042D35D

Strings

IMsg, xrefs: 00495B2E
.msg, xrefs: 00495AC0
.dat, xrefs: 00495AA1
Uninstall, xrefs: 00495A40

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: a65f7f6f85c1ba76a6ecb4eec30e47d063e55d9ac03b40616d0cda4559523cf8
Instruction ID: eed15c66d0b60b6a3c4c16a6531e268fd98716f92798e373cf10e096f35d41a1
Opcode Fuzzy Hash: a65f7f6f85c1ba76a6ecb4eec30e47d063e55d9ac03b40616d0cda4559523cf8
Instruction Fuzzy Hash: 9631B634A006149FDB01FF65DC56D5E7BB5FB88308B60887AF400AB391CB79AD05CB99

Function 0042E814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042E846
6D166DE0.KERNEL32(00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042E84C
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042E875

Strings

ShutdownBlockReasonCreate, xrefs: 0042E83C
user32.dll, xrefs: 0042E841

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ByteCharD166HandleModuleMultiWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 3811887981-2866557904
Opcode ID: 45bf696c58fb1a06ed23ea2970b0f1bccc84676fbc05fa91be3c282395eba54e
Instruction ID: ac0542c787143ba22f0eab23c99be7939f1a28ededf3295516800ce376932e43
Opcode Fuzzy Hash: 45bf696c58fb1a06ed23ea2970b0f1bccc84676fbc05fa91be3c282395eba54e
Instruction Fuzzy Hash: 90F0F6E174072237E620B2BFACC2F6B15CC8F94766F540136B588EB2C2E96C8905426F

Function 00456AC8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00456AF8
GetExitCodeProcess.KERNEL32(?,0049640E), ref: 00456B19
CloseHandle.KERNEL32(?,00456B4C,?,?,gsE,00000000,00000000), ref: 00456B3F

Strings

GetExitCodeProcess, xrefs: 00456B22
MsgWaitForMultipleObjects, xrefs: 00456B05

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: e68a510a9562e6ffe4bd6e2b7f4476c54b810d57e85b6d58634b9f4cba1bde83
Instruction ID: 0967fcd1d3bdefac7bc2385a56a55f6452ec80dcafea2609c0c459e4db786005
Opcode Fuzzy Hash: e68a510a9562e6ffe4bd6e2b7f4476c54b810d57e85b6d58634b9f4cba1bde83
Instruction Fuzzy Hash: 5301AD30600214AFDB14EBA98D12A5E73E9EB49721FA24077FD10E73D3DA79AE04961C

Function 0042DC7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,?), ref: 0042DC88
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE0B,00000000,0042DE23,?,?,?,?,00000006,?,00000000,004954CB), ref: 0042DCA3
6D166DE0.KERNEL32(00000000,advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE0B,00000000,0042DE23,?,?,?,?,00000006,?,00000000,004954CB), ref: 0042DCA9

Strings

advapi32.dll, xrefs: 0042DC9E
RegDeleteKeyExA, xrefs: 0042DC99

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166DeleteHandleModule
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 529285437-1846899949
Opcode ID: 0d323e8ce3ed0a1df9cde1e38352a16ea2708c0262c31cd6209868a8e33aeb8c
Instruction ID: a8e6c3e19bf274c0ac554b71675f4f4da1622df9f0b95ac594cbb4a71638a8fc
Opcode Fuzzy Hash: 0d323e8ce3ed0a1df9cde1e38352a16ea2708c0262c31cd6209868a8e33aeb8c
Instruction Fuzzy Hash: D9E06DF0B45230AADA20676B7D4AFA327289B64725F54403BB105A619182FD4C40DE5D

Function 0042E788 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00497934,00455CBD,00456060,00455C14,00000000,00000B06,00000000,00000000,?,00000001,00000000,00000002,00000000), ref: 0042E7A1
6D166DE0.KERNEL32(00000000,user32.dll,ChangeWindowMessageFilterEx,00000004,00497934,00455CBD,00456060,00455C14,00000000,00000B06,00000000,00000000,?,00000001,00000000,00000002), ref: 0042E7A7
InterlockedExchange.KERNEL32(00499668,00000001), ref: 0042E7B8

Part of subcall function 0042E718: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E7DC,00000004,00497934,00455CBD,00456060,00455C14,00000000,00000B06,00000000,00000000,?,00000001,00000000), ref: 0042E72E
Part of subcall function 0042E718: 6D166DE0.KERNEL32(00000000,user32.dll,ChangeWindowMessageFilter,?,0042E7DC,00000004,00497934,00455CBD,00456060,00455C14,00000000,00000B06,00000000,00000000,?,00000001), ref: 0042E734
Part of subcall function 0042E718: InterlockedExchange.KERNEL32(00499660,00000001), ref: 0042E745

Strings

user32.dll, xrefs: 0042E79C
ChangeWindowMessageFilterEx, xrefs: 0042E797

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166ExchangeHandleInterlockedModule
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 529160291-2676053874
Opcode ID: a5adeedac3879557c0600b8cab95d2a3851616d22d0594a68f65248dd121f376
Instruction ID: d327addb07fa1d34877d3082f65a6d6aa94696c7b20ac2dcfa67383fa2b4ac77
Opcode Fuzzy Hash: a5adeedac3879557c0600b8cab95d2a3851616d22d0594a68f65248dd121f376
Instruction Fuzzy Hash: 38E06DB1341720AAEA1077BA6CC6F9A225C8780769F54403FF600A61D1C2BE0C80CA5C

Function 0042E718 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E7DC,00000004,00497934,00455CBD,00456060,00455C14,00000000,00000B06,00000000,00000000,?,00000001,00000000), ref: 0042E72E
6D166DE0.KERNEL32(00000000,user32.dll,ChangeWindowMessageFilter,?,0042E7DC,00000004,00497934,00455CBD,00456060,00455C14,00000000,00000B06,00000000,00000000,?,00000001), ref: 0042E734
InterlockedExchange.KERNEL32(00499660,00000001), ref: 0042E745

Strings

ChangeWindowMessageFilter, xrefs: 0042E724
user32.dll, xrefs: 0042E729

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166ExchangeHandleInterlockedModule
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 529160291-2498399450
Opcode ID: 425561683d1a582b287fd4423fac3983046a6d6a64d4090f95d0908a83494576
Instruction ID: 83b15b5d67bfb2ce210de02991b715893c24bd2fd1fcf991286e79864b3c950e
Opcode Fuzzy Hash: 425561683d1a582b287fd4423fac3983046a6d6a64d4090f95d0908a83494576
Instruction Fuzzy Hash: FBE0ECB1741314EADB107B7A6D8AF5A265CA768715F54043FF501651E2C7BD0C40C91C

Function 00475F24 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00475F2C
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00476023,0049A03C,00000000), ref: 00475F3F
6D166DE0.KERNEL32(00000000,user32.dll,AllowSetForegroundWindow,00000000,?,?,00476023,0049A03C,00000000), ref: 00475F45

Strings

AllowSetForegroundWindow, xrefs: 00475F35
user32.dll, xrefs: 00475F3A

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModuleProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 3209758144-3855017861
Opcode ID: 034d89e5d93904354b17ae14d84902b50b2a6fce19bbd9290eadab28e9067b8e
Instruction ID: 93acaa5a75c3b516ac4be21c8560ff1ba3ec921bf34a9ca8d1ccf185f5b704da
Opcode Fuzzy Hash: 034d89e5d93904354b17ae14d84902b50b2a6fce19bbd9290eadab28e9067b8e
Instruction Fuzzy Hash: 9ED0A790644F0169ED10B7F14C4ED6B234C9D84714724853BB40CFE1C2CABCD809493D

Function 00416B9C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416BC2
SaveDC.GDI32(?), ref: 00416BF3
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416CB5), ref: 00416C54
RestoreDC.GDI32(?,?), ref: 00416C7B
EndPaint.USER32(00000000,?,00416CBC,00000000,00416CB5), ref: 00416CAF

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction ID: 41fb8ea60d97978a9acdf236596d3a8a0d8a1996066437b2b943a95edf1585a8
Opcode Fuzzy Hash: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction Fuzzy Hash: BF414E70A042049FDB14DB99C989FAA77F9EB48304F1580AEE4459B362D778DD40CB58

Function 00414770 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 004147A6
MulDiv.KERNEL32(?,?,?), ref: 004147C0
MulDiv.KERNEL32(?,?,?), ref: 004147E9
MulDiv.KERNEL32(?,?,?), ref: 00414814
MulDiv.KERNEL32(00000000,?,00000000), ref: 0041485C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction ID: 41a7722d09b35ce9ade17cd18fdec9692d257bae8bd1aa266952c484067d5cda
Opcode Fuzzy Hash: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction Fuzzy Hash: D3311F746047409FC320EB69C584BABB7E8AF89714F04991EF9E5C7791D738EC818B19

Function 0042973C Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429778
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 004297A7
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 004297C3
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 004297EE
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042980C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d93a833f87ba0e73dcc457bbfd04d607f88d4d221c0389d21231ca6786db581f
Instruction ID: 5c059f72bad19c8464015bcf3ba3f3fa2ba546ca9f5ab3c2e37583cf1b766786
Opcode Fuzzy Hash: d93a833f87ba0e73dcc457bbfd04d607f88d4d221c0389d21231ca6786db581f
Instruction Fuzzy Hash: 2E217F70710714BAE710ABA6DC82F5B77ACEB46708F90443EB501BB3D2DB78AD41865C

Function 0041BB28 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BB3A
GetSystemMetrics.USER32(0000000C), ref: 0041BB44
73F7A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BB82
73F86310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BCED,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBC9
DeleteObject.GDI32(00000000), ref: 0041BC0A

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: MetricsSystem$A570DeleteF86310Object
String ID:
API String ID: 2606799143-0
Opcode ID: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction ID: e64c8cfb77975bfe1c5019289902123c5e37d94f13133d85ba8c481b6df62587
Opcode Fuzzy Hash: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction Fuzzy Hash: 91316F74E00609EFDB00DFA5C941AAEB7F4EB48700F10846AF510AB781D7389E80DB98

Function 00471E74 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045BFB8: SetLastError.KERNEL32(00000057,00000000,0045C084,?,?,?,?,00000000), ref: 0045C023

GetLastError.KERNEL32(00000000,00000000,00000000,00471F48,?,?,00000001,0049A160), ref: 00471F01
GetLastError.KERNEL32(00000000,00000000,00000000,00471F48,?,?,00000001,0049A160), ref: 00471F17

Strings

Failed to set permissions on registry key (%d)., xrefs: 00471F28
Setting permissions on registry key: %s\%s, xrefs: 00471EC6
Could not set permissions on the registry key because it currently does not exist., xrefs: 00471F0B

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 06b4b6b62b22b9a4bd7e9f6c553833e2a2a92df5dd6c89c033ecf3b2de3a5925
Instruction ID: ba9c69de7a70f3ceaeb13725b546c2869ccc266c25af2b357a52a6f2c4dcf2c9
Opcode Fuzzy Hash: 06b4b6b62b22b9a4bd7e9f6c553833e2a2a92df5dd6c89c033ecf3b2de3a5925
Instruction Fuzzy Hash: 0521A770A042445FCB00DBADC8426EEBBE9EB49314F50817BE408E73A2D7785D058BAD

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 00414350 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73F78830.GDI32(00000000,00000000,00000000), ref: 00414389
73F722A0.GDI32(00000000,00000000,00000000,00000000), ref: 00414391
73F78830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143A5
73F722A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143AB
73F7A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143B6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: F722F78830$A480
String ID:
API String ID: 2177965545-0
Opcode ID: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction ID: 94861c3129a932f854b236b0087f7367a4de39103189020794ca85cb03cdcc47
Opcode Fuzzy Hash: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction Fuzzy Hash: 6F01DF7121C3806AD200B63E8C85A9F6BED8FCA314F15556EF498DB382CA7ACC018765

Function 00480ACC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00480DE1,?,?,00000001,?), ref: 00480BDD
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00480C52

Strings

Need to restart Windows? %s, xrefs: 00480C8F
, xrefs: 00480D0F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 393233134be75f05b4779166502c265e7d55b511039cf989b62b59604718cb6a
Instruction ID: 4aa1253117f9d220f86d454c8ebac855e08be0f9177d91d94ed259031e7b075c
Opcode Fuzzy Hash: 393233134be75f05b4779166502c265e7d55b511039cf989b62b59604718cb6a
Instruction Fuzzy Hash: 469180346002449FCB54EF69D886B9E77F1AF45308F1445BBE8009B362DB78AD09CB9E

Function 00424C50 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041EFE4: GetActiveWindow.USER32 ref: 0041EFE7
Part of subcall function 0041EFE4: GetCurrentThreadId.KERNEL32 ref: 0041EFFC
Part of subcall function 0041EFE4: 73F85940.USER32(00000000,Function_0001EFC0), ref: 0041F002

Part of subcall function 00423118: GetSystemMetrics.USER32(00000000), ref: 0042311A

OffsetRect.USER32(?,?,?), ref: 00424D39
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424DFC
OffsetRect.USER32(?,?,?), ref: 00424E0D

Part of subcall function 004234D4: GetCurrentThreadId.KERNEL32 ref: 004234E9
Part of subcall function 004234D4: SetWindowsHookExA.USER32(00000003,00423490,00000000,00000000), ref: 004234F9
Part of subcall function 004234D4: CreateThread.KERNEL32(00000000,000003E8,00423440,00000000,00000000), ref: 0042351D

Part of subcall function 00424A9C: SetTimer.USER32(00000000,00000001,?,00423424), ref: 00424AB7

Strings

KB, xrefs: 00424C63, 00424D41

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$ActiveCreateDrawF85940HookMetricsSystemTextTimerWindowWindows
String ID: KB
API String ID: 1676449949-1869488878
Opcode ID: 140feffe6cce27af2a6224d3065bdd52d93ca5af5fa2531d527dd57fc9eed11e
Instruction ID: f52d481962c584d609b581bf8db91b810bad9089dae7ddb0c95d7c9dd944e9bb
Opcode Fuzzy Hash: 140feffe6cce27af2a6224d3065bdd52d93ca5af5fa2531d527dd57fc9eed11e
Instruction Fuzzy Hash: 73811771A002189FDF14DFA8D884ADEBBB5FF48314F5045AAE904AB296DB38AD45CF44

Function 0046E418 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

GetLastError.KERNEL32(00000000,0046E615,?,?,00000001,0049A160), ref: 0046E4F2
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046E56C
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046E591

Strings

Creating directory: %s, xrefs: 0046E4DA

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: c2d4aff7de63fd893b6f91d39f276edaed519ab4f4a2fb556f08066925c7a893
Instruction ID: ee391acc8c46a12a701fe7de38f12e5d0d012ca565d69bb7ed801d16d917e0e6
Opcode Fuzzy Hash: c2d4aff7de63fd893b6f91d39f276edaed519ab4f4a2fb556f08066925c7a893
Instruction Fuzzy Hash: 70512674E00258ABDB01DFA5C582BDEB7F5AF48308F50856AE841B7342D7785E04DB99

Function 00406F0C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406F6B
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00406FE5
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 0040703D

Strings

Z, xrefs: 00406FA4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: e8dbae99a7dcba8e3fe9697e607370068dc5994f2dd1835f7b1653fcac931384
Instruction ID: c5afe0da71e31bc3c88331cc7d2fcbc5ad41680026aac5e5d837dfd1e94c86ee
Opcode Fuzzy Hash: e8dbae99a7dcba8e3fe9697e607370068dc5994f2dd1835f7b1653fcac931384
Instruction Fuzzy Hash: D7514170E042099FDB11EF55C941A9EBBB9FB09304F5041BAE540BB3D1C778AE418F5A

Function 0044C480 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044C50E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044C539
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044C5C1

Strings

, xrefs: 0044C4F3

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: a89014da5242fac794eed501f7e96c44124a9002652a303dae5d4ebba296219e
Instruction ID: 4508d5f579824a8c6f6f234c08085581b80e9f6740b97ff1de3d45831c78f32f
Opcode Fuzzy Hash: a89014da5242fac794eed501f7e96c44124a9002652a303dae5d4ebba296219e
Instruction Fuzzy Hash: 36517371900258AFDB50DFA5C8C5BDEBBF9EF49304F08847AE845EB251D738A944CB64

Function 0042EAD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

73F7A570.USER32(00000000,00000000,0042EC2C,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042EB02

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(?,00000000), ref: 0042EB25
73F7A480.USER32(00000000,?,0042EC11,00000000,0042EC0A,?,00000000,00000000,0042EC2C,?,?,?,?,00000000,00000000,00000000), ref: 0042EC04

Strings

...\, xrefs: 0042EBB6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: 9547bbdf0534f10ac831ebfa93f718171ab8ca5bfe4f9870a769e3513675e216
Instruction ID: 3ea2f4fda2af0d4dbead9854f9e4c512e5c56e1bc2fe1fbb634109393928ece3
Opcode Fuzzy Hash: 9547bbdf0534f10ac831ebfa93f718171ab8ca5bfe4f9870a769e3513675e216
Instruction Fuzzy Hash: 81313370B00128AFDF11EB97D841BAEBBB9EF48304F91447BF410A7291D7786D45CA69

Function 00453E78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

6D166DE0.KERNEL32(00000000,SfcIsFileProtected,00000000,00453FEC), ref: 00453F26
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00453FEC), ref: 00453F90

Strings

SfcIsFileProtected, xrefs: 00453F20
sfc.dll, xrefs: 00453EE8

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ByteCharD166MultiWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 3111646875-591603554
Opcode ID: 48cd59871438a208470380f511db199473adc8dc8e8fa4cea36bd2c778173ea8
Instruction ID: 048db31cea9a49fe57b20dbb51b81541660e5ea55c147f47882b69a52e81beff
Opcode Fuzzy Hash: 48cd59871438a208470380f511db199473adc8dc8e8fa4cea36bd2c778173ea8
Instruction Fuzzy Hash: 4B419971A042189FEB10DF55DC85B9EB7B8AB04709F5041BBB908E7293D7789F48CA5C

Function 00452AA4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00494A81,_iu,?,00000000,00452BDE), ref: 00452B93
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00494A81,_iu,?,00000000,00452BDE), ref: 00452BA3

Strings

_iu, xrefs: 00452B35
.tmp, xrefs: 00452B47

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseD1674Handle
String ID: .tmp$_iu
API String ID: 3372331149-10593223
Opcode ID: 1fcc9553a8f684c5c7c9a0ea766f5fca7cf566c39ceade857f735b1514f9f4be
Instruction ID: 6fde55615647d4ed48ab14c0a307ffcb251606c4012a1fb284826946d44ffa3a
Opcode Fuzzy Hash: 1fcc9553a8f684c5c7c9a0ea766f5fca7cf566c39ceade857f735b1514f9f4be
Instruction Fuzzy Hash: E431B370A40209ABCB11EFA5C942B9EB7B4AF45309F20446BF800B73C2D7786E0587A8

Function 00416380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
UnregisterClassA.USER32(?,00400000), ref: 0041641B
RegisterClassA.USER32(?), ref: 0041643E

Strings

@, xrefs: 00416399

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 7bde4a9d017b37b399d712bcb3f1799561031588eacc8c0706b456525513edcb
Instruction ID: 409200c13affa244f493d0d71e2c786b6f8b5131a0ea67a27e918f437d5bfa87
Opcode Fuzzy Hash: 7bde4a9d017b37b399d712bcb3f1799561031588eacc8c0706b456525513edcb
Instruction Fuzzy Hash: E7316E706042058BD760EF68C981B9B77E5AB88308F04447FF985DB392DB39DD448B6E

Function 00495ED8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,004967F0,00000000,00495FCE,?,?,00000000,00499628), ref: 00495F48
6D1682A0.KERNEL32(00000000,00000000,00000000,004967F0,00000000,00495FCE,?,?,00000000,00499628), ref: 00495F71
6D1678C0.KERNEL32(00000000,00000000,00000001,00000000,004967F0,00000000,00495FCE,?,?,00000000,00499628), ref: 00495F8A

Strings

isRS-%.3u.tmp, xrefs: 00495F27

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: AttributesD1678D1682File
String ID: isRS-%.3u.tmp
API String ID: 3811636008-3657609586
Opcode ID: 4dda7df42beea12b38ebe66a3453a91feda8450add797991091dec449b692549
Instruction ID: 39fc4aa3b1325c5674b16a15386e220f06d470d82164ec59b5a324909a67f6b3
Opcode Fuzzy Hash: 4dda7df42beea12b38ebe66a3453a91feda8450add797991091dec449b692549
Instruction Fuzzy Hash: 4F216171E00609AFCF01EFA9C8819AFBBB8AB54324F60453BB814F72D5D6385E018B59

Function 00454334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 004543C8
GetLastError.KERNEL32(0000003C,00000000,00454411,?,?,?), ref: 004543D9

Part of subcall function 00454020: WaitForInputIdle.USER32(?,00000032), ref: 0045404C
Part of subcall function 00454020: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0045406E
Part of subcall function 00454020: GetExitCodeProcess.KERNEL32(?,?), ref: 0045407D
Part of subcall function 00454020: CloseHandle.KERNEL32(?,004540AA,004540A3,?,?,?,00000000,?,?,0045427D,?,?,?,00000044,00000000,00000000), ref: 0045409D

Strings

cmG, xrefs: 004543F3
<, xrefs: 0045437C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Wait$CloseCodeErrorExecuteExitHandleIdleInputLastMultipleObjectsProcessShell
String ID: <$cmG
API String ID: 35504260-4292423251
Opcode ID: 55ee40c41e9ddff98899753e07bfda4df124d29e4a376b990b1a8eba7a94bb2b
Instruction ID: 6d00b500fe1a4f5c57a5d9171d2bf5619df6299d1693ef38611f843adfa964d5
Opcode Fuzzy Hash: 55ee40c41e9ddff98899753e07bfda4df124d29e4a376b990b1a8eba7a94bb2b
Instruction Fuzzy Hash: DB2186B0600219ABDB10DF65D88269E7BE8EF49349F50443AFC40EB391D7789D49CB98

Function 004556C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0045571C
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00455749

Strings

LoadTypeLib, xrefs: 00455727
RegisterTypeLib, xrefs: 00455754

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 5424298b63e03f5a7a6df135285e8d4bf37638db31f4934c177431c1aec250f2
Instruction ID: 9c5d3dee6c8685e3ca62ce7cd3bde038cf3e16764db62fae168a797d2c5b37cd
Opcode Fuzzy Hash: 5424298b63e03f5a7a6df135285e8d4bf37638db31f4934c177431c1aec250f2
Instruction Fuzzy Hash: 6E11B430A00A04EFDB10DFAADD61A5EBBBDDB4D701F104476BC04D3651DA389A04CA18

Function 004519D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,HmE,00000000,0mE,?,?,?,00000000,00451A4A,?,?,?,00000001), ref: 00451A24
GetLastError.KERNEL32(00000000,00000000,?,?,HmE,00000000,0mE,?,?,?,00000000,00451A4A,?,?,?,00000001), ref: 00451A2C

Strings

0mE, xrefs: 00451A0E, 00451A11
HmE, xrefs: 00451A16, 00451A19

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: 0mE$HmE
API String ID: 2919029540-2521494901
Opcode ID: 619675bf623f8dbda08f347ef1ff45bf3db687bd4adbc65eff433dafc0cc1e86
Instruction ID: fba8dffb969e303b4de63fc0ba570861335efdf6f59496035e6af68b7fbb63d3
Opcode Fuzzy Hash: 619675bf623f8dbda08f347ef1ff45bf3db687bd4adbc65eff433dafc0cc1e86
Instruction Fuzzy Hash: 481139B2A04208AF8B41DEADDC41EEBB7ECEB4D321B114566FD08D3251D678ED14CBA4

Function 00455C20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00455C3A
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00455CD7

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00455C66
Failed to create DebugClientWnd, xrefs: 00455CA0

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 0914801d72e3a8c31c53756c2e8b01d028722194d10330e31a4a693caee6127a
Instruction ID: 93f24d929eafa933d6a1dec800f788ec7668c19fe5f9afbdabdb8c6272a63917
Opcode Fuzzy Hash: 0914801d72e3a8c31c53756c2e8b01d028722194d10330e31a4a693caee6127a
Instruction Fuzzy Hash: 50119DB16043505EE301AB2C8891BABBA989B95309F15407AF985DB383D3798C08C7AA

Function 004769A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetFocus.USER32 ref: 00476A0F
GetKeyState.USER32(0000007A), ref: 00476A21
WaitMessage.USER32(?,00000000,00476A48,?,00000000,00476A6F,?,?,00000001,00000000,?,?,?,?,0047E0FF,00000000), ref: 00476A2B

Strings

Wnd=$%x, xrefs: 004769F3

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: 2a2725b69fb386ccad8cf45c0e8c202c421051f06f46427955794b178fcc7fb4
Instruction ID: c47d8b81a3f89e4d9f305e8958344f99b85f65a22a562f943514e929f638a567
Opcode Fuzzy Hash: 2a2725b69fb386ccad8cf45c0e8c202c421051f06f46427955794b178fcc7fb4
Instruction Fuzzy Hash: 85117730604605AFC701FF69DC51ADE7BFAEB4A714B52C4BAF408E3641D7386D008A6D

Function 0046CF90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046CF98
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046CFA7

Strings

(invalid), xrefs: 0046D02A
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046D01C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 7c8e18e794b06d15e90a5dadea8765798a5493bfebc67ba29a9805845c59dadc
Instruction ID: f0a6dd1d8ce8d87e863054ef8fae022cb88d972da5a78582b75138adf414e1ed
Opcode Fuzzy Hash: 7c8e18e794b06d15e90a5dadea8765798a5493bfebc67ba29a9805845c59dadc
Instruction Fuzzy Hash: 21112EA090C3919ED340DF26C44032BBAE4AB89708F04492EF9C4C6381E379C849DB77

Function 0045303A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

6D1682A0.KERNEL32(00000000,00000020), ref: 00453047

Part of subcall function 00406EB8: 6D167770.KERNEL32(00000000,00499628,004963B9,00000000,0049640E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

6D167830.KERNEL32(00000000,00000000,00000000,00000020), ref: 0045306C

Part of subcall function 00452684: GetLastError.KERNEL32(00000000,004530F5,00000005,00000000,0045312A,?,?,00000000,00499628,00000004,00000000,00000000,00000000,?,0049606D,00000000), ref: 00452687

Strings

DeleteFile, xrefs: 00453058
MoveFile, xrefs: 00453075

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167770D167830D1682ErrorLast
String ID: DeleteFile$MoveFile
API String ID: 12618126-139070271
Opcode ID: c39cb627dc2ac0eeb819a9784302370d9ddbd57153aecb2ad7e4817e6583de82
Instruction ID: aa365475a2a04e12f65dacb09188f13895f7dda552768fa7ebf74221350b1b82
Opcode Fuzzy Hash: c39cb627dc2ac0eeb819a9784302370d9ddbd57153aecb2ad7e4817e6583de82
Instruction Fuzzy Hash: 80F06D752042055BEB04FEB6D94266FA3ECEB4434BFA1403BB800B76C7DA3C8E094929

Function 00454AAC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167B60.ADVAPI32(?,00454B17,?,00000001,00000000), ref: 00454B0A

Strings

PendingFileRenameOperations2, xrefs: 00454AEB
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454AB8
PendingFileRenameOperations, xrefs: 00454ADC

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 557493163-2115312317
Opcode ID: e1ba571f496d43fd120299fc58e1da5f08dc4d1c6c4e27a2b7d368f985733f8d
Instruction ID: e818f9f29e18ec6221192f3c1b5ee660968d1a720cb36d9e55705c43ae0854d0
Opcode Fuzzy Hash: e1ba571f496d43fd120299fc58e1da5f08dc4d1c6c4e27a2b7d368f985733f8d
Instruction Fuzzy Hash: 50F09071704204AFE704D6A6EC13F5BB3ACD7C4759FA0446BF8009B682EA79FD54962C

Function 00458388 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167B60.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004584BA,00000000,00458607,?,00000000,00000000,00000000), ref: 004583D5

Strings

.NET Framework not found, xrefs: 004583E4
SOFTWARE\Microsoft\.NETFramework, xrefs: 004583A8
InstallRoot, xrefs: 004583C4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 557493163-2631785700
Opcode ID: 8fd23e478814a874b9220d2ded310c003ac97ba78d12d4552293bb4c637d5cbf
Instruction ID: ea3a45bed5edc2ba876fa1f084c84d8c5f80d8fbd4465fa42c84833bd08a17ce
Opcode Fuzzy Hash: 8fd23e478814a874b9220d2ded310c003ac97ba78d12d4552293bb4c637d5cbf
Instruction Fuzzy Hash: 83F0A4323041115BC710DB5A9845B4E6689DB91356F54503FFD80E7257DE79CC09C619

Function 004814EC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0048152D
6D167B60.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00481550

Strings

System\CurrentControlSet\Control\Windows, xrefs: 004814FA
CSDVersion, xrefs: 00481524

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167$QueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 1765961986-1910633163
Opcode ID: 190be3375aeb142d0155381d0867c6ef1911cb9197c08fb1e2fab0832a9d60d6
Instruction ID: e24f9e339270721fa73cfd358d02fba8345311e4b2ef2f3849d45b3fd657234f
Opcode Fuzzy Hash: 190be3375aeb142d0155381d0867c6ef1911cb9197c08fb1e2fab0832a9d60d6
Instruction Fuzzy Hash: B5F044B9E40208BADF10EAD58C45BDF73BCAB44704F104967E916E7290E778DA05CB5D

Function 0042D7CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00452D42,00000000,00452DE5,?,?,00000000,00000000,00000000,00000000,00000000,?,004530B1,00000000), ref: 0042D7E6
6D166DE0.KERNEL32(00000000,kernel32.dll,GetSystemWow64DirectoryA,?,00452D42,00000000,00452DE5,?,?,00000000,00000000,00000000,00000000,00000000,?,004530B1), ref: 0042D7EC

Strings

kernel32.dll, xrefs: 0042D7E1
GetSystemWow64DirectoryA, xrefs: 0042D7DC

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModule
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 439651959-4063490227
Opcode ID: 62870b4d965a73d26b664e348fa178bf2b253222eec6b6ddec63d9f2b08f2550
Instruction ID: 4db8f333c9a0d948aa4d288d669557f69a64c6eaa67e0ad6c3f7b03414b73d9c
Opcode Fuzzy Hash: 62870b4d965a73d26b664e348fa178bf2b253222eec6b6ddec63d9f2b08f2550
Instruction Fuzzy Hash: 23E04F61B44B1112D7107ABA9C83A5B10898B88724FA0843B79A5E72C7EDBCD94A1A7D

Function 0042E8C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042E83C), ref: 0042E8CE
6D166DE0.KERNEL32(00000000,user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042E83C), ref: 0042E8D4

Strings

ShutdownBlockReasonDestroy, xrefs: 0042E8C4
user32.dll, xrefs: 0042E8C9

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModule
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 439651959-260599015
Opcode ID: 2abcef729450efc82d79671326ca9d62cff0d5dd7e0677da4eb6e6ce1e2a4421
Instruction ID: 7c69bd6c2ee87db4326f6693fa526596aa450ba62902fbcca0c83f78b45ae659
Opcode Fuzzy Hash: 2abcef729450efc82d79671326ca9d62cff0d5dd7e0677da4eb6e6ce1e2a4421
Instruction Fuzzy Hash: 61D0C9A2752B32AA6A2075FB3CD1AEB02CC8D106B93980477F540F7242EA9DCC4565AC

Function 0044EC04 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049686D), ref: 0044EC3F
6D166DE0.KERNEL32(00000000,user32.dll,NotifyWinEvent,0049686D), ref: 0044EC45

Strings

NotifyWinEvent, xrefs: 0044EC35
user32.dll, xrefs: 0044EC3A

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModule
String ID: NotifyWinEvent$user32.dll
API String ID: 439651959-597752486
Opcode ID: 971d7d52e343c129525c0f9a23f8a1ecd53e328ddf718e9c00615770f922066f
Instruction ID: 1d6847f5b71cfb889fb72cb275d2bd98f16d086b2cf5a985e24d695b54fb2eec
Opcode Fuzzy Hash: 971d7d52e343c129525c0f9a23f8a1ecd53e328ddf718e9c00615770f922066f
Instruction Fuzzy Hash: E0E0ECF0E51740D9FB10BBBB6986B0D2AA4F728319F04547FB111A6292CB7C58008F1E

Function 00496630 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004968BE,00000001,00000000,004968E2), ref: 0049663A
6D166DE0.KERNEL32(00000000,user32.dll,DisableProcessWindowsGhosting,004968BE,00000001,00000000,004968E2), ref: 00496640

Strings

DisableProcessWindowsGhosting, xrefs: 00496630
user32.dll, xrefs: 00496635

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166HandleModule
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 439651959-834958232
Opcode ID: 69e20e3a751bef653dfab8a6a11158a94526fab5adfb5b133f0b84dae802b24a
Instruction ID: 1d36f3c6e50f4853aec038a6431439aa93ab912a32aac72bd1e084e061b821e8
Opcode Fuzzy Hash: 69e20e3a751bef653dfab8a6a11158a94526fab5adfb5b133f0b84dae802b24a
Instruction Fuzzy Hash: F3B002D1641B41549D1032F25D47E1B0C58488076575604777814B51C7DD6E9D045C6D

Function 0046354C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0044AB18: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB3F
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB57
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB69
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB7B
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB8D
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044AB9F
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll,?,0044EC35,0049686D), ref: 0044ABB1
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData,uxtheme.dll), ref: 0044ABC3
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData,00000000,OpenThemeData), ref: 0044ABD5
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground,00000000,CloseThemeData), ref: 0044ABE7
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText,00000000,DrawThemeBackground), ref: 0044ABF9
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect,00000000,DrawThemeText), ref: 0044AC0B
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect,00000000,GetThemeBackgroundContentRect), ref: 0044AC1D
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize,00000000,GetThemeBackgroundContentRect), ref: 0044AC2F
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent,00000000,GetThemePartSize), ref: 0044AC41
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics,00000000,GetThemeTextExtent), ref: 0044AC53
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion,00000000,GetThemeTextMetrics), ref: 0044AC65
Part of subcall function 0044AB18: 6D166DE0.KERNEL32(00000000,GetThemeMetric,00000000,GetThemeColor,00000000,IsThemeBackgroundPartiallyTransparent,00000000,IsThemePartDefined,00000000,DrawThemeIcon,00000000,DrawThemeEdge,00000000,HitTestThemeBackground,00000000,GetThemeBackgroundRegion), ref: 0044AC77

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00496890), ref: 0046355B
6D166DE0.KERNEL32(00000000,shell32.dll,SHPathPrepareForWriteA,00496890), ref: 00463561

Strings

shell32.dll, xrefs: 00463556
SHPathPrepareForWriteA, xrefs: 00463551

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D166$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 3670945825-2683653824
Opcode ID: b7dcb10c1046edb4d4e126dba9a904e55d042e599e7a4bdfc6bc511a5488d8ae
Instruction ID: c0fcb66c02a8dab539d9d5e808ad8ee58df08d6502fb75decf3995d68355cc99
Opcode Fuzzy Hash: b7dcb10c1046edb4d4e126dba9a904e55d042e599e7a4bdfc6bc511a5488d8ae
Instruction Fuzzy Hash: A3B092E0B80780B48E00BFF6188790A54189550B9B720047F3046BA097EE7C42188DAF

Function 00470BB8 Relevance: 6.3, APIs: 4, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00470D89,?,00000000,?,00000001,00000000,00470F57,?,00000000,?,00000000,?,00471112), ref: 00470D65
FindClose.KERNEL32(000000FF,00470D90,00470D89,?,00000000,?,00000001,00000000,00470F57,?,00000000,?,00000000,?,00471112,?), ref: 00470D83
FindNextFileA.KERNEL32(000000FF,?,00000000,00470EAB,?,00000000,?,00000001,00000000,00470F57,?,00000000,?,00000000,?,00471112), ref: 00470E87
FindClose.KERNEL32(000000FF,00470EB2,00470EAB,?,00000000,?,00000001,00000000,00470F57,?,00000000,?,00000000,?,00471112,?), ref: 00470EA5

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: fabff4c738ed4808cfb25c096fc04527225f06d2f7b39a7e350cec414d0a5612
Instruction ID: 8155a0475b96a0e8b3dfb93bc231237a894523f3b66553093324e5ed05be0f29
Opcode Fuzzy Hash: fabff4c738ed4808cfb25c096fc04527225f06d2f7b39a7e350cec414d0a5612
Instruction Fuzzy Hash: A0B12B3490425DDFCF11DFA5C881ADEBBB9FF48304F5085AAE808A3251D739AA46CF58

Function 0047B8D4 Relevance: 6.2, APIs: 4, Instructions: 194fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047BA44,?,?,?,?,00000000,0047BB99,?,00000000,?,00000000,?,0047BCED), ref: 0047BA20
FindClose.KERNEL32(000000FF,0047BA4B,0047BA44,?,?,?,?,00000000,0047BB99,?,00000000,?,00000000,?,0047BCED,00000000), ref: 0047BA3E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 688660f1e4094ed34319b7c64fac86a671ffd6bff7fcc50adfd23abf8383e2d8
Instruction ID: 90f54a55b09df938123969646071422b0b6b51c39b9d231898d1c05be4ec9d6e
Opcode Fuzzy Hash: 688660f1e4094ed34319b7c64fac86a671ffd6bff7fcc50adfd23abf8383e2d8
Instruction Fuzzy Hash: 59813F7090424D9FCF11EF95CC41BDFBBB8EB49304F5080AAE918A7691D7399A46CF98

Function 0047DA6C Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047DC65,?,00000000,00000000,?,?,0047EDF8,?,?,00000000), ref: 0047DB12
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047DC65,?,00000000,00000000,?,?,0047EDF8,?,?), ref: 0047DB1F
FindNextFileA.KERNEL32(000000FF,?,00000000,0047DC38,?,?,?,?,00000000,0047DC65,?,00000000,00000000,?,?,0047EDF8), ref: 0047DC14
FindClose.KERNEL32(000000FF,0047DC3F,0047DC38,?,?,?,?,00000000,0047DC65,?,00000000,00000000,?,?,0047EDF8,?), ref: 0047DC32

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: fc2bcd60a884b3481da35a047366ea4f80f60d3d463ebca9738422de1f83445a
Instruction ID: 535fa8ff41714791b16e1cb9ca038bd6a4321c611076a7b16b6e80abc644c091
Opcode Fuzzy Hash: fc2bcd60a884b3481da35a047366ea4f80f60d3d463ebca9738422de1f83445a
Instruction Fuzzy Hash: F8514D71E006489FCB21EFA5CC45ADEB7B8EF88315F5084AAA408E7351D6789F85CF54

Function 004211E4 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004212D1
SetMenu.USER32(00000000,00000000), ref: 004212EE
SetMenu.USER32(00000000,00000000), ref: 00421323
SetMenu.USER32(00000000,00000000), ref: 0042133F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 56c2488dfc212d101127e5c7c13890798fb7bc3de671997bf903a0a3b8ff45b6
Instruction ID: 9167a1b96ed3692bf6fa46568bd71e8e44bf9b724138963d14a6a49c295ca86a
Opcode Fuzzy Hash: 56c2488dfc212d101127e5c7c13890798fb7bc3de671997bf903a0a3b8ff45b6
Instruction Fuzzy Hash: 7E41BE307002645BEB20AA7AA88579B37914F65308F4845BFFC44EF3A7CA7DCC4582AD

Function 00413C68 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413CB6
GetDesktopWindow.USER32 ref: 00413D6E

Part of subcall function 00418E30: 6FAEC6F0.COMCTL32(?,00000000,00413F33,00000000,00414043,?,?,00499628), ref: 00418E4C
Part of subcall function 00418E30: ShowCursor.USER32(00000001,?,00000000,00413F33,00000000,00414043,?,?,00499628), ref: 00418E69

SetCursor.USER32(00000000,?,?,?,?,00413A63,00000000,00413A76), ref: 00413DAC

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: f93635452a3540b18525377051338fa553d5bfeb17669cb5afee2586f1b9e959
Instruction ID: 9041e376e68cac3d3f12fafa287a9a1d672feaf4b908caafcd791b624cb6b8f2
Opcode Fuzzy Hash: f93635452a3540b18525377051338fa553d5bfeb17669cb5afee2586f1b9e959
Instruction Fuzzy Hash: 97415876600151AFCB01EF2DE9C8B8777E0AB65325B1A847FE004DB365DA39AC81CF58

Function 004089BC Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 004089DD
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408A4C
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408AE7
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408B26

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 7d5ee083bef0366bcb4814e6dcf43939bfc2141079d81ee54d2647310300da8e
Instruction ID: 1d628db87d3f10c37e3f79da841816f31d20c8eb4fd8ddf490f23963b5bf11f3
Opcode Fuzzy Hash: 7d5ee083bef0366bcb4814e6dcf43939bfc2141079d81ee54d2647310300da8e
Instruction Fuzzy Hash: 663132706083809BD330EA698945B9B77E89B8A304F40483FB6C8E72D1DB7999058767

Function 0044DD84 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044DDCD

Part of subcall function 0044C410: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044C442

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044DE51

Part of subcall function 0042BB24: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BB38

IsRectEmpty.USER32(?), ref: 0044DE13
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044DE36

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 507253a555fab8430786164ed62efea146418745806fc46137cfa61568251170
Instruction ID: 337b33acb9e7367f704548962b9ee544586480788f75c241c542739c8af6450f
Opcode Fuzzy Hash: 507253a555fab8430786164ed62efea146418745806fc46137cfa61568251170
Instruction Fuzzy Hash: 61114A71B0031027E210BA7E8C86B5B66899B89748F14083FB646EB382DE79EC194299

Function 00493588 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 004935EC
OffsetRect.USER32(?,00000000,?), ref: 00493607
OffsetRect.USER32(?,?,00000000), ref: 00493621
OffsetRect.USER32(?,00000000,?), ref: 0049363C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: c34a829c107c6ae086cdf1cafd4eb7a7dca89cb743bed0ec5f0ea2ad2411eb09
Instruction ID: 15cef71e731e3fee1735122eb73e290e76ed006c2447abbb7b90f461cffe9875
Opcode Fuzzy Hash: c34a829c107c6ae086cdf1cafd4eb7a7dca89cb743bed0ec5f0ea2ad2411eb09
Instruction Fuzzy Hash: 39217CB6704201ABD700DE69CC85E6BBBEEEBC8314F15CA2AF554C7349D634EE048796

Function 00417188 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004171D0
SetCursor.USER32(00000000), ref: 00417213
GetLastActivePopup.USER32(?), ref: 0041723D
GetForegroundWindow.USER32(?), ref: 00417244

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 70457936ae722886cc68ab85c7e1e9677c9b745f3ec84423ac9ddd6608127d37
Instruction ID: de9644f57ac26c8b09368bc5631ddcdfe556ff5052eaa30755f4c332c8ab0a02
Opcode Fuzzy Hash: 70457936ae722886cc68ab85c7e1e9677c9b745f3ec84423ac9ddd6608127d37
Instruction Fuzzy Hash: 7C2183313086018ADB20AB69D889ADB33F1AF45714F0545AFF8589B392D73DDC82CB59

Function 00416AB2 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416AF4
SetTextColor.GDI32(?,00000000), ref: 00416B0E
SetBkColor.GDI32(?,00000000), ref: 00416B28
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416B50

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 067d3ba40eb3a1cc822801215cfcbdeff8a461c2d0af939e65cc5a52f50c3ab8
Instruction ID: c000e8b01db0500dd6874d208778bcf8efa3d9016d5589f965051e8255cd057a
Opcode Fuzzy Hash: 067d3ba40eb3a1cc822801215cfcbdeff8a461c2d0af939e65cc5a52f50c3ab8
Instruction Fuzzy Hash: 74115EB2604604AFC710EE6ECC84E8777ECEF49710B15886BB55ADB652C638FC418B79

Function 00493240 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000008,?), ref: 00493255
MulDiv.KERNEL32(?,00000008,?), ref: 00493269
MulDiv.KERNEL32(?,00000008,?), ref: 0049327D
MulDiv.KERNEL32(?,00000008,?), ref: 0049329B

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction ID: e512a9e758a0ad12aeaf5b5a151844cfaa890fd3a601ce0f6a8c9cc519870162
Opcode Fuzzy Hash: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction Fuzzy Hash: C0112E72604204ABCF40DFA9D8C4D9B7BECEF4D364B1441AAF918DB246D634ED408BA8

Function 0041F3F0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F3E0,?), ref: 0041F411
UnregisterClassA.USER32(0041F3E0,00400000), ref: 0041F43A
RegisterClassA.USER32(00497598), ref: 0041F444
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F47F

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: ead5ffb11019ba6777c9dbb947f435eb0b6670811c7fa7acfad3f7d865a438b4
Instruction ID: e46a42e6552743bf644647bcc5b156b551fdc520883961385e1d4b912d915443
Opcode Fuzzy Hash: ead5ffb11019ba6777c9dbb947f435eb0b6670811c7fa7acfad3f7d865a438b4
Instruction Fuzzy Hash: 3D0192712141047BCB60EB6CEC81EAB339CA72D314B10413BBA15E76E1C6359C154BAC

Function 00454020 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 0045404C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0045406E
GetExitCodeProcess.KERNEL32(?,?), ref: 0045407D
CloseHandle.KERNEL32(?,004540AA,004540A3,?,?,?,00000000,?,?,0045427D,?,?,?,00000044,00000000,00000000), ref: 0045409D

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: a54fefd10c2e0f687b4aa2e3a33a8cd1bb9efb467a2b3b7473968d6a7ccf8035
Instruction ID: d785216c1c548539e19217780dfe4ba2d40096d11eba98a688fe1d4667f4d093
Opcode Fuzzy Hash: a54fefd10c2e0f687b4aa2e3a33a8cd1bb9efb467a2b3b7473968d6a7ccf8035
Instruction Fuzzy Hash: F401F970640208BEEB20979A8C06F6B7AACDF85B74F710167BA04DB2C2C5785D449668

Function 0040D170 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D187
LoadResource.KERNEL32(00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,0047ABD4,0000000A,REGDLL_EXE), ref: 0040D1A1
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,0047ABD4), ref: 0040D1BB
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?), ref: 0040D1C5

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 1fe06807482f72613b6667064fe88f51cf947b58ca2a32820fbe45912fd18073
Instruction ID: a2e4909c1946fcd89949086e6ecb513f2c22862e5b7fa6f76d970aa484769738
Opcode Fuzzy Hash: 1fe06807482f72613b6667064fe88f51cf947b58ca2a32820fbe45912fd18073
Instruction Fuzzy Hash: BEF0FF726056046F9754EE9DA881D5B76ECDE48264320416AF908EB246DE38DD118B78

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(00499420,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(00499420,00499420,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,00499420,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(00499420,00401A89,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: f4fe37a3204f9cf8c06f5fa04845c9c999d181734b3cfdf376519ce1c3326a47
Instruction ID: 1b289a0fd0139ecfea4ba23488efb997744b2f3c2cdf6dce9f943993a5499d4d
Opcode Fuzzy Hash: f4fe37a3204f9cf8c06f5fa04845c9c999d181734b3cfdf376519ce1c3326a47
Instruction Fuzzy Hash: 5A018B7064C2405EFB1AAB6E98027293FD4E795748F11803FF445A6AF1C67C4C42CA2E

Function 0046E730 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046E781

Strings

Failed to set NTFS compression state (%d)., xrefs: 0046E792
Setting NTFS compression on directory: %s, xrefs: 0046E74F
Unsetting NTFS compression on directory: %s, xrefs: 0046E767

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: 11ae83ec9d9c617c1427c98b83e746d0ffa9825848c7ae3d1a3c62776c62defd
Instruction ID: 1ad9d76730abffe208a4c5c4264c48cdeee6a445b50b34408956a707461cb1f1
Opcode Fuzzy Hash: 11ae83ec9d9c617c1427c98b83e746d0ffa9825848c7ae3d1a3c62776c62defd
Instruction Fuzzy Hash: 77018B34D0424896CF04D7AE50412DEFBE89F0D315F54C1EFA465DB382EB794909879B

Function 00454E38 Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167ED0.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045A71A,?,?,?,?,?,00000000,0045A741), ref: 00454E74
6D167B60.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045A71A,?,?,?,?,?,00000000), ref: 00454E7D
RemoveFontResourceA.GDI32(00000000), ref: 00454E8A
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00454E9E

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167$FontMessageNotifyRemoveResourceSend
String ID:
API String ID: 3193810409-0
Opcode ID: 242de68abadbe4cf4150fdd48716a18268a80d8283c8eef6f2b31c8c9acbf7a4
Instruction ID: 4e4cb5fa7b3d268b0fe4689e36407a1938bb3ff91da4f7d52b0471ff91aa649d
Opcode Fuzzy Hash: 242de68abadbe4cf4150fdd48716a18268a80d8283c8eef6f2b31c8c9acbf7a4
Instruction Fuzzy Hash: 53F05EB575530036EA10B6B69C8BF1B228C9F94759F10483BBA00EF2C3D97CDD04966D

Function 0046F020 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0046F071

Strings

Setting NTFS compression on file: %s, xrefs: 0046F03F
Failed to set NTFS compression state (%d)., xrefs: 0046F082
Unsetting NTFS compression on file: %s, xrefs: 0046F057

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: 47588f84d4241e5ef74cc6b07774c25b7c2e1c7e9913edef3eb6cca03a74b933
Instruction ID: 3bcfe379fe8649a68af53553754e9ba1347c0f07075e283614f92db878f91d71
Opcode Fuzzy Hash: 47588f84d4241e5ef74cc6b07774c25b7c2e1c7e9913edef3eb6cca03a74b933
Instruction Fuzzy Hash: 08011C70D0424496CF04D7AD64412DEB7E49F0D314F54C1BFA495D7283E679490D879B

Function 00476594 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,0047E6B1,?,?,00000001,00000000,00000002,00000000,0047EF71,?,?,?,?,?,00496961), ref: 0047659D
OpenProcessToken.ADVAPI32(00000000,00000008,?,0047E6B1,?,?,00000001,00000000,00000002,00000000,0047EF71), ref: 004765A3
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,0047E6B1,?,?,00000001,00000000,00000002,00000000,0047EF71), ref: 004765C5
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,0047E6B1,?,?,00000001,00000000,00000002,00000000), ref: 004765D6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 523267de2bed6c45bf373fcc6eef02a457dcad744cb55a4ee6033627b6947a5c
Instruction ID: 4707548daa461976a567d9c5ed96e780b6f068cb4c493cd3f6b693a0b69ea1e9
Opcode Fuzzy Hash: 523267de2bed6c45bf373fcc6eef02a457dcad744cb55a4ee6033627b6947a5c
Instruction Fuzzy Hash: D5F030A16447017BD600EAB5CC82EAB77DCEB44354F04893A7E98C72C1DA78DC18AB26

Function 004241B0 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 004241BC
IsWindowVisible.USER32(?), ref: 004241CD
IsWindowEnabled.USER32(?), ref: 004241D7
SetForegroundWindow.USER32(?), ref: 004241E1

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 9b2c73b2f118cbfdb3fd477b95624e7834d98b8dfb73253704230ee2573409e1
Instruction ID: 7a261241521d5f36110480f60a41559dbc21bd8b6604a945fb8666e4bf107b55
Opcode Fuzzy Hash: 9b2c73b2f118cbfdb3fd477b95624e7834d98b8dfb73253704230ee2573409e1
Instruction Fuzzy Hash: 0DE08699B06531139E31FA251885ABB25ACCD54B883C60127BC04F7243DF1CCFA0C1AC

Function 00406284 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406287
GlobalUnlock.KERNEL32(00000000), ref: 0040628E
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 00406293
GlobalLock.KERNEL32(00000000), ref: 00406299

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction ID: ad050c8fb554795a0ca7e59246f03ac17dd57b6c6051e6027a9978793207e39e
Opcode Fuzzy Hash: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction Fuzzy Hash: A0B009C5814A05B9EC0833B24C0BD3F141CD88072C3808A6FB458BA1839C7C9C402A3D

Function 004697F8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 259windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 00469A03
EnableMenuItem.USER32(00000000,00000000,00000000), ref: 00469A09

Strings

CurPageChanged, xrefs: 00469BA4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: 19836a5f4fde9c47581cbd8901a54eb9bf3c7de6f89836ce848586466e8af689
Instruction ID: e26546ca6fb89f82da4547dc60bb11ab24f56930d245b11690f8a3cef2263ad0
Opcode Fuzzy Hash: 19836a5f4fde9c47581cbd8901a54eb9bf3c7de6f89836ce848586466e8af689
Instruction Fuzzy Hash: D1B14974604104DFCB11DB69D985EAA73F9FF49304F2540FAE8049B322EB78AE45DB4A

Function 00478624 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210COMMON

Download Yara Rule

APIs

6D167B60.ADVAPI32(?,?,?,?,00000001,00000000,00000000,00479E1D,?,00000000,00000000,00000001,00000000,004788C1,?,00000000), ref: 00478885

Strings

Failed to parse "reg" constant, xrefs: 0047888C
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 004786F9

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 557493163-1938159461
Opcode ID: 7e30cd5ee2c5b36123dad34a1db95c680faf5a75f97db96401e384924d5dbd70
Instruction ID: 0a8968fb34543a57d7f88d193baa73527c032baa78e0536dbdff1824591fc682
Opcode Fuzzy Hash: 7e30cd5ee2c5b36123dad34a1db95c680faf5a75f97db96401e384924d5dbd70
Instruction Fuzzy Hash: 75815274E00108AFCB10EFA5D885ADEBBF9AF48354F50816AE414B7395DB389E05CB99

Function 0045B1D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0044FB14: SetEndOfFile.KERNEL32(?,?,0045B2AE,00000000,0045B439,?,00000000,00000002,00000002), ref: 0044FB1B

FlushFileBuffers.KERNEL32(?), ref: 0045B405

Strings

EndOffset range exceeded, xrefs: 0045B339
NumRecs range exceeded, xrefs: 0045B302

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: a301c6dabb9704468c1e24fbdb81701ef7f79906638069347b556430a8d3a1f9
Instruction ID: a903170d8bc781d07a600957566dfe45593df76c4c3c994ec0904f2b6ceaf1c8
Opcode Fuzzy Hash: a301c6dabb9704468c1e24fbdb81701ef7f79906638069347b556430a8d3a1f9
Instruction Fuzzy Hash: 1A615434A002588BDB25DF25C891BDAB7B5EF49305F0084EAED889B352D7B49EC98F54

Function 004248B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004248D5
WaitMessage.USER32(00000000,004249C9,?,?,?,?), ref: 004249A9

Strings

hI, xrefs: 00424962, 0042496C, 004249BB

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CursorMessageWait
String ID: hI
API String ID: 4021538199-1175817223
Opcode ID: 3187036f9c3f7976241ac30da1ed3e361baa2a7407fb3d64dbd480958c6647a7
Instruction ID: a4eeb57de98a079bb1a60e4e34ee33fef4df48c0e9511a927bf7c7f4a07835e5
Opcode Fuzzy Hash: 3187036f9c3f7976241ac30da1ed3e361baa2a7407fb3d64dbd480958c6647a7
Instruction Fuzzy Hash: 0831D4B07002249BDB21EF39D48179FB7B5EFC8304F95456AEC049B385DB789D80CA99

Function 00477150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: 6D167FA0.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048150B,?,00000001,?,?,0048150B,?,00000001,00000000), ref: 0042DC70

6D167B60.ADVAPI32(?,00477236,?,?,00000001,00000000,00000000,00477251), ref: 0047721F

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004771AA
%s\%s_is1, xrefs: 004771C8

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 557493163-1598650737
Opcode ID: b82d9d429039fa0faf41379b8944ed99386d3b6b62f75bc5821b5694637a4715
Instruction ID: 119bab7e7863558edf985db16656470cca75908ce9bc52ac2ae4daa2b26c39e4
Opcode Fuzzy Hash: b82d9d429039fa0faf41379b8944ed99386d3b6b62f75bc5821b5694637a4715
Instruction Fuzzy Hash: B8218470B082445FDB11DBAACC51A9EBBE8EB48304F9184BAF514E7382D67899018B58

Function 0046B47C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046B577
Failed to proceed to next wizard page; aborting., xrefs: 0046B563

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: ca23865455054479bece7d23809b66e5d7218befa909e75e0beb64e52a8de696
Instruction ID: 9b1edd805dbe5cd36533ceb33ecd33e3a7f8e736828b1bce32abf65b6cd9515e
Opcode Fuzzy Hash: ca23865455054479bece7d23809b66e5d7218befa909e75e0beb64e52a8de696
Instruction Fuzzy Hash: 16313E70604204AFD711EB69D985FD977E4EB05318F5540BBF404DB392D739AE80C79A

Function 0044F510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 0044F5A5
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044F5D6

Strings

open, xrefs: 0044F5C9

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 9b694d104bd39caec24af49046efba30af57982181ecbedc8af8d07189365068
Instruction ID: 7664e7eee34533549192780f472559fc987875beaa2e323647491b220bf9e567
Opcode Fuzzy Hash: 9b694d104bd39caec24af49046efba30af57982181ecbedc8af8d07189365068
Instruction Fuzzy Hash: 09213270E00204BFDB00DF69C881A9EB7F9EB44704F6085BAF401E7392DB78DA458B58

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(00499420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(00499420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(00499420,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(00499420,00499420,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,00499420,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(00499420,00401A89,00000000,00401A82,?,?,0040222E,021D0650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: e7de354507ed4e6cf5b1b8008114530547b15fe9a7101cf90e4e4e7ef665774e
Instruction ID: 12af864456fc6e18ba26838f94293088e51f0754e67fcb84d7a0ea3e08d714e4
Opcode Fuzzy Hash: e7de354507ed4e6cf5b1b8008114530547b15fe9a7101cf90e4e4e7ef665774e
Instruction Fuzzy Hash: 3A1101317082046FEB25AB7E9F1A62A6BD4D795758B24087FF404F32D2D9BD8C02826C

Function 0049478E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004947C9

Strings

@, xrefs: 00494794
/INITPROCWND=$%x , xrefs: 004947F4

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 70d042b87374c406167e323b58bdc73c48e1ddc06c1fe95fe2f1b0a262533310
Instruction ID: 735601d2fada896008fd5524511032772b9365b7e30d79631b2ce25e9676cbd4
Opcode Fuzzy Hash: 70d042b87374c406167e323b58bdc73c48e1ddc06c1fe95fe2f1b0a262533310
Instruction Fuzzy Hash: 5A11D535A042489FDB05EBA5D841FAEBFE8EB89314F10447BE404E7281D73C9905CB58

Function 004468D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 00446986

Strings

Unknown Method, xrefs: 0044695F
NIL Interface Exception, xrefs: 00446928

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: cc70ab50da529c18ec1dcc47520dde115463f7e6343c95aeb6df2dc524bb02a2
Instruction ID: c0a577e7d0886ee6857b8a23773c11734a697d9d294b04f5fc6172ffe111bf62
Opcode Fuzzy Hash: cc70ab50da529c18ec1dcc47520dde115463f7e6343c95aeb6df2dc524bb02a2
Instruction Fuzzy Hash: 7A11E970A003049FDB00DFA58C42A6EBBBCEB4A304F92407BF500E7291CA789D04CB6A

Function 00494000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004940C8,?,004940BC,00000000,004940A3), ref: 0049406E
CloseHandle.KERNEL32(00494A90,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004940C8,?,004940BC,00000000), ref: 00494085

Part of subcall function 00493F58: GetLastError.KERNEL32(00000000,00493FF0,?,?,?,?), ref: 00493F7C

Strings

D, xrefs: 00494048

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 5e8cb24f3e8bf3d66ffbf7d2dfb5841848a81618379680ee135b38856bc67f04
Instruction ID: 996ffa81ca357fd86b8a8e6ab065e51becafb63900a730331261561be8e9fb15
Opcode Fuzzy Hash: 5e8cb24f3e8bf3d66ffbf7d2dfb5841848a81618379680ee135b38856bc67f04
Instruction Fuzzy Hash: C5015EB1604248AFDF10EB95CC42EAEBBECEF49715F51003AFA04E72D1D6785E058A69

Function 0042DB9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DBB0
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DBF0

Strings

Inno Setup: No Icons, xrefs: 0042DBAE

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 886c508a9d064cc5beab33d3e6a293d326300040bac42146d69738b9499b2323
Instruction ID: 682b92bc92faed275b53e4216f5c62fda41dfbd69c800dfaa39ca812b50ffd36
Opcode Fuzzy Hash: 886c508a9d064cc5beab33d3e6a293d326300040bac42146d69738b9499b2323
Instruction Fuzzy Hash: 93018431B8933069F73045266D41B6B558C9B45B64F65403BFA41AA3C0D6DCDC44E36A

Function 0041EE14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EE63
73F85940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042EA14,?,00000001), ref: 0041EE69

Strings

*sE, xrefs: 0041EEA6

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CurrentF85940Thread
String ID: *sE
API String ID: 3526180387-3359606030
Opcode ID: 1ba73b8482d8c3e0c2ed08b216993e08e5ee7b6e87d0b77da0313bae5f1e9351
Instruction ID: 0bb20ecf203d2caaa18a69ea3b1dc52cc1b4ae2c1fbd5ea94b5f45832a100dbe
Opcode Fuzzy Hash: 1ba73b8482d8c3e0c2ed08b216993e08e5ee7b6e87d0b77da0313bae5f1e9351
Instruction Fuzzy Hash: AF015E74A18704AFD741CF66EC11996BBE8E749720B228877E804D3AA0E6385810DF18

Function 00473F68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406EB8: 6D167770.KERNEL32(00000000,00499628,004963B9,00000000,0049640E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

6D167830.KERNEL32(00000000,00000000,00000001,0049A160,?,004745B2,?,00000000,00474647,?,00000000,00474858,?,00000000,004748B5), ref: 00473FC6

Part of subcall function 00473E18: GetLastError.KERNEL32(00000000,00473F04,?,?,?,0049A144,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00473F8B,00000001), ref: 00473E39

Strings

DeleteFile, xrefs: 00473F7F
MoveFile, xrefs: 00473FA1

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: D167770D167830ErrorLast
String ID: DeleteFile$MoveFile
API String ID: 2031206815-139070271
Opcode ID: d84cc1cf191b3e9376ba6485c8f94635005e375395fb68a68016e8569e9140dd
Instruction ID: 4484f5f7e174d27cc8e42a5f2493440abee93dd7a9fbb535ddab3cf8dfb86aad
Opcode Fuzzy Hash: d84cc1cf191b3e9376ba6485c8f94635005e375395fb68a68016e8569e9140dd
Instruction Fuzzy Hash: 01F068A150415057DE10BE6985426DA63AC5F113DF710C07BF8487F382CA3D5E05A7AF

Function 00495CCC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047B190: FreeLibrary.KERNEL32(00000000,0047F642), ref: 0047B1A6

Part of subcall function 0047AE64: GetTickCount.KERNEL32 ref: 0047AEAC

Part of subcall function 00455D60: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 00455D7F

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00496621), ref: 00495D21
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00496621), ref: 00495D27

Strings

Detected restart. Removing temporary directory., xrefs: 00495CDB

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 749cc3d33bdf3b361d0c408671b169b992bd7346cb83ac5431a27821d89323e2
Instruction ID: ac90d92dc29ac610e287cd6e67729ee47fcf9364ebb0edaa1ca8ef4f7d7e2680
Opcode Fuzzy Hash: 749cc3d33bdf3b361d0c408671b169b992bd7346cb83ac5431a27821d89323e2
Instruction Fuzzy Hash: E5E0E572208A442EDA1277B6BC1A92F7F5CD74676CB61843BF40482552C92D4C14C67D

Function 00473AB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

6D1674B0.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00473CEF), ref: 00473ADD
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00473CEF), ref: 00473AF4

Part of subcall function 00452684: GetLastError.KERNEL32(00000000,004530F5,00000005,00000000,0045312A,?,?,00000000,00499628,00000004,00000000,00000000,00000000,?,0049606D,00000000), ref: 00452687

Strings

CreateFile, xrefs: 00473AE9

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: CloseD1674ErrorHandleLast
String ID: CreateFile
API String ID: 3698161638-823142352
Opcode ID: 284d071117862ed726ba55d7bba9de4a496fc421262f18bbaffdd2f0bcf8c2fd
Instruction ID: 1d6785e2027f3e83bcc3d2e7d006167172d97316e03d07259a24fcdec049f32e
Opcode Fuzzy Hash: 284d071117862ed726ba55d7bba9de4a496fc421262f18bbaffdd2f0bcf8c2fd
Instruction Fuzzy Hash: ADE06D307403447BEA10EA69CCC6F497788AB05728F108162FA48AF3E2C5B9EC40865C

Function 00421C98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,hI,00000000,004219E4,00000000,00000000,00418568,00000000,00000001,?,?,0046430A,00000001,00000000,00000000,00469855), ref: 00421CBB
GetFocus.USER32 ref: 00421CC9

Strings

hI, xrefs: 00421C99

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: Focus
String ID: hI
API String ID: 2734777837-1175817223
Opcode ID: 4bf3c581c7c67873cf15edfb22c5ea133bb5f709077c4dd5f354b0e9100381d1
Instruction ID: 6a781247274b35bf802f0d5c88fcb4425cf39f3bc7fec05fcedd95d7989a6849
Opcode Fuzzy Hash: 4bf3c581c7c67873cf15edfb22c5ea133bb5f709077c4dd5f354b0e9100381d1
Instruction Fuzzy Hash: ADE09A35B002205ACB1027BA6886BAB21844B64348F58957FB501EB353DD7C8C80068C

Function 00454710 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 0045472F
Sleep.KERNEL32(?), ref: 0045473F
GetLastError.KERNEL32 ref: 00454752
GetLastError.KERNEL32 ref: 0045475C

Memory Dump Source

Source File: 00000003.00000002.1413617923.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1413602051.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413679261.0000000000497000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413710937.0000000000498000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413739647.0000000000499000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.1413755583.00000000004A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Youbak_MSN_PARTNER2036.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 3b7199aa55ff79edef1708ee7c6545ac8614deac4515c5237193eebac0f59ac7
Instruction ID: e1de459c0036e349104eec2680d3566c4b7f0ee349e0778c92ca85d7709bdcd9
Opcode Fuzzy Hash: 3b7199aa55ff79edef1708ee7c6545ac8614deac4515c5237193eebac0f59ac7
Instruction Fuzzy Hash: 6EF09036A00914574E31A9AE9A8196F628DDADB36E720012BED04DF203D679CC8996AD

Source: Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410581975.0000000001F61000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410461810.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1414237770.0000000001F61000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413320314.00000000021E8000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413350798.000000000221C000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413025183.0000000002214000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413288845.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1412703141.00000000021E8000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1413084543.0000000002218000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1412630705.0000000003100000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://msn.youbak.com
Source: Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410461810.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000003.1412630705.0000000003100000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://msn.youbak.com#
Source: Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410581975.0000000001F61000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1414237770.0000000001F61000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://msn.youbak.com2
Source: file.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: file.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Youbak_MSN_PARTNER2036.tmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000000.1411540739.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Youbak_MSN_PARTNER2036.tmp.2.dr	String found in binary or memory: http://www.innosetup.com/
Source: Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1411073569.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410907677.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000000.1411540739.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Youbak_MSN_PARTNER2036.tmp.2.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1411073569.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.exe, 00000002.00000003.1410907677.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Youbak_MSN_PARTNER2036.tmp, 00000003.00000000.1411540739.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Youbak_MSN_PARTNER2036.tmp.2.dr	String found in binary or memory: http://www.remobjects.com/psU

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe

C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp

C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp

C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
file.exe

Function 00403121 Relevance: 66.8, APIs: 22, Strings: 16, Instructions: 269
comfileshutdownCOMMON

Function 004053D0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 158
fileCOMMON

Function 004060FD Relevance: 5.4, APIs: 4, Instructions: 392
memoryCOMMON

Function 00405DDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 0040357E Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 216
registrylibrarystringCOMMON

Function 00402C74 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 184
COMMON

Function 00402EB2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 00401765 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 149
timeCOMMON

Function 00401F98 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Function 004015DB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Function 004057BE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 004052EF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Function 004030ED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Function 00405F14 Relevance: 5.2, APIs: 4, Instructions: 218
COMMON

Function 0040678D Relevance: 5.2, APIs: 4, Instructions: 218
COMMON