Edit tour

Windows Analysis Report
powershell.zip

Overview

General Information

Sample name:	powershell.zip
Analysis ID:	1525203
MD5:	8de0dccc99caf13e75599ecf674a6ae3
SHA1:	c571effa7eacd36aeee80f50b2397252055785e4
SHA256:	806c84af366370a880e13aba9546e1ace4a41de51e5a6e2896382d830e1ccffd
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Classification

Process Tree

System is w10x64

unarchiver.exe (PID: 2408 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\powershell.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6304 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ymnnrtn0.425" "C:\Users\user\Desktop\powershell.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: classification engine

Classification label: clean2.winZIP@4/1@0/0

Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\powershell.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ymnnrtn0.425" "C:\Users\user\Desktop\powershell.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ymnnrtn0.425" "C:\Users\user\Desktop\powershell.zip"	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 9A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 4610000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 533			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 9437			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4204	Thread sleep count: 533 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4204	Thread sleep time: -266500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4204	Thread sleep count: 9437 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4204	Thread sleep time: -4718500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 0_2_0090B1D6 GetSystemInfo,

0_2_0090B1D6

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ymnnrtn0.425" "C:\Users\user\Desktop\powershell.zip"

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	2 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525203
Start date and time:	2024-10-03 21:14:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	powershell.zip
Detection:	CLEAN
Classification:	clean2.winZIP@4/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .zip Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: powershell.zip

Simulations

Behavior and APIs

Time	Type	Description
15:15:44	API Interceptor	4232938x Sleep call for process: unarchiver.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2717
Entropy (8bit):	4.935046767954709
Encrypted:	false
SSDEEP:	48:oZlYbkm/GF/GbF/GF/GpX/GhK/GF/Gp3Yb/K/GurIDzL1YK++++++++dyJI706mj:il8uxByM2J
MD5:	277D53EF8B423211DAA077983419FCC4
SHA1:	03BA99AF2BA660F1CBF06E62571FFC80787EA3C0
SHA-256:	FB4E150BA05222696EE9DA6FF060967FFDBE297098403F25D225331B46A9276E
SHA-512:	82C0DFB9FCFAF9BB5F399F94083B0992F922F4BF1BD741A510E25CB91EA6432AE745F5A56C3A324800A371A7719F9E64C4B6334892E927B44CAB9CE4308BF0F2
Malicious:	false
Reputation:	low
Preview:	10/03/2024 3:15 PM: Unpack: C:\Users\user\Desktop\powershell.zip..10/03/2024 3:15 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\ymnnrtn0.425..10/03/2024 3:15 PM: Received from standard out: ..10/03/2024 3:15 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/03/2024 3:15 PM: Received from standard out: ..10/03/2024 3:15 PM: Received from standard out: Scanning the drive for archives:..10/03/2024 3:15 PM: Received from standard out: 1 file, 107297 bytes (105 KiB)..10/03/2024 3:15 PM: Received from standard out: ..10/03/2024 3:15 PM: Received from standard out: Extracting archive: C:\Users\user\Desktop\powershell.zip..10/03/2024 3:15 PM: Received from standard error: ..10/03/2024 3:15 PM: Received from standard out: Compressed: 0..10/03/2024 3:15 PM: Get files..10/03/2024 3:15 PM: Nbr of files: 0..10/03/2024 3:15 PM: No files have been unarchived (invalid archive or unknown password)..10/03/2024 3:15 PM: Check Webdata..10/03/202

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
Entropy (8bit):	4.627125727949122
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	powershell.zip
File size:	107'297 bytes
MD5:	8de0dccc99caf13e75599ecf674a6ae3
SHA1:	c571effa7eacd36aeee80f50b2397252055785e4
SHA256:	806c84af366370a880e13aba9546e1ace4a41de51e5a6e2896382d830e1ccffd
SHA512:	f016c5f4b30189854dbf318923391e5768d96bd770db0263d28702446b4c8f5f0485e88f5492603c4e59287cbc62927790503603a19ebf469a602eed11fba429
SSDEEP:	1536:sj6KleHsR4/a+xzEsXLxvxlsd1+074gxY+qVPlm0ya:X1Mipt4rxHg
TLSH:	7FA39B235A9E18DF0104B456D808BE0978EE85FF3BBB665B0AE42D7B75F9424C1BC319
File Content Preview:	..&cls..@echo off..:: .............. ............, .................... .... ................ ............, ........................ .............. .............. .............. .. ............, .............. ........ .. .............. ........ ........,

File Icon


Icon Hash:	90cececece8e8eb0

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: unarchiver.exePID: 2408, Parent PID: 1028

General

Target ID:	0
Start time:	15:15:11
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\powershell.zip"
Imagebase:	0x20000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: 7za.exePID: 6304, Parent PID: 2408

General

Target ID:	1
Start time:	15:15:11
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ymnnrtn0.425" "C:\Users\user\Desktop\powershell.zip"
Imagebase:	0xd0000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2992, Parent PID: 6304

General

Target ID:	2
Start time:	15:15:11
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: unarchiver.exePID: 2408, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0090B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0090B208

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5607373e8c43e922012f8d9f577eb3306023c17ce4bc3c8ac04e32d0448cbed2
Instruction ID: 164473d5747feddd487fe1ae4ab5fddcf2f453b50553dab6b34565014660013c
Opcode Fuzzy Hash: 5607373e8c43e922012f8d9f577eb3306023c17ce4bc3c8ac04e32d0448cbed2
Instruction Fuzzy Hash: 3701F2309042409FDB20CF19D984769FBE4EF10320F08C8AADD098F742D378E404CB62

Function 0090B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0090B2F3

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2658878a6cc07e60567d300cde47b20c1a90a28253499aed3457768fb50fa22b
Instruction ID: eee83a1ffc8c8cb7f6f7c8240801a65809521f47a89f0f5f657e5c704aea9b61
Opcode Fuzzy Hash: 2658878a6cc07e60567d300cde47b20c1a90a28253499aed3457768fb50fa22b
Instruction Fuzzy Hash: 5731C671404344AFEB228B65DC44FA7BFBCEF06314F04889AE985CB562D334A919CB71

Function 0090AB76 Relevance: 1.6, APIs: 1, Instructions: 100
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0090AC36

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 2d84c43735956e90c2f5a6f283fc2aec3285d5756d7e1dcaa7fad7e7f4dd8f0e
Instruction ID: e441c82fe0e56adb574e21a149b42701a9e292097db21e73027d3993c5ac2418
Opcode Fuzzy Hash: 2d84c43735956e90c2f5a6f283fc2aec3285d5756d7e1dcaa7fad7e7f4dd8f0e
Instruction Fuzzy Hash: 77318D7150E3C0AFD3138B358C65AA1BFB4AF47210F1A84DBD8C4CF5A3D2696819CB62

Function 0090AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0090ADA7

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 44f6b7541b5f0581155f569b901577af812a06ceaff99f17d9c894351041e765
Instruction ID: f368bc8eab207f15be8a21fdff4f53a420900b2b8e965a5583f3a5792f161f80
Opcode Fuzzy Hash: 44f6b7541b5f0581155f569b901577af812a06ceaff99f17d9c894351041e765
Instruction Fuzzy Hash: 2D31B571504344AFEB228B65CC44FA7BFACEF06314F04889AF985CB562D334A819CB71

Function 0090A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0090A67D

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bbf77dc1e0cd2a774a73a8b691564e639c91cad88a6cf4d329ac54c317e32345
Instruction ID: fbfa256f0b3e246672dcac51c95690f6f51b2193a0dbbd10095142fb7edd5b95
Opcode Fuzzy Hash: bbf77dc1e0cd2a774a73a8b691564e639c91cad88a6cf4d329ac54c317e32345
Instruction Fuzzy Hash: B8316F71504340AFE721CB65DD45F66BBE8EF09324F0888AEE9858B692D375E809CB71

Function 0090AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0090ADA7

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 11710bde97dc8aa3725931edcb52f6fc70aae607aba8166780e0c6450904c52b
Instruction ID: a2462a484c42985af13407cbdc9fe10a309ab5fc68ff95db2700ae5a76340894
Opcode Fuzzy Hash: 11710bde97dc8aa3725931edcb52f6fc70aae607aba8166780e0c6450904c52b
Instruction Fuzzy Hash: 0D21B272500304AFEB31CF64CD45FABFBACEF04324F14886AE9458AA91D734E4188BB1

Function 0090A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A40C

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e1abc97721fe0368f2cda78bfef62e98e85dae86e09b58dba89e51064f683f69
Instruction ID: 36fdf07c08129ce73a514f649c5c7800b3ec0bbf0737e9ff235cc799ceecdeba
Opcode Fuzzy Hash: e1abc97721fe0368f2cda78bfef62e98e85dae86e09b58dba89e51064f683f69
Instruction Fuzzy Hash: 97216D75504744AFD721CF15DC84FA6BBFCEF45710F08849AE945CB2A2D364E908CBA2

Function 0090B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0090B2F3

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c0d45bdeab9c03d094d0e675812412a41a7064a4e4091381a5b4452a04e72ee1
Instruction ID: c25659d337ce9a616a904cbfdae37716981197869ed968d0985c1d340cd4321e
Opcode Fuzzy Hash: c0d45bdeab9c03d094d0e675812412a41a7064a4e4091381a5b4452a04e72ee1
Instruction Fuzzy Hash: 9B21B072500204AFEB31CF65DC44FABFBACEF08324F14886AE9458B651D734E5188BB1

Function 0090A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A8DE

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 67dffb9f0d99b60db17c12b000362228c411e95839c319625230d888123543d7
Instruction ID: d294ae61cf23728c372a9de15c6b447636910f33d8450c8725c7913b23e9fc36
Opcode Fuzzy Hash: 67dffb9f0d99b60db17c12b000362228c411e95839c319625230d888123543d7
Instruction Fuzzy Hash: 9121B8715093806FEB228B54DC44F66BFB8EF46714F0988DAE984CF553D274A909C772

Function 0090A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A9C1

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 435054d59366adac0b9c57551b0f01b18e9acc925d6bbad3d4c3c8e9d2725e32
Instruction ID: 030963af44eae76c992a354352c40bf4267741413b8e11bfd59e894dd0be3e43
Opcode Fuzzy Hash: 435054d59366adac0b9c57551b0f01b18e9acc925d6bbad3d4c3c8e9d2725e32
Instruction Fuzzy Hash: E121A371509380AFDB22CF65CD44F96BFB8EF06314F08889AE9858F152D375A408CBB2

Function 0090A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0090A67D

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 65a6e0acedc09fe86b3a0bb53b94d4ef7cb1ef3a6245106be82dd1e73027438d
Instruction ID: 34cf2a2120b6baca3590867f40b7f3188a95189eae612132110432a392f3f12f
Opcode Fuzzy Hash: 65a6e0acedc09fe86b3a0bb53b94d4ef7cb1ef3a6245106be82dd1e73027438d
Instruction Fuzzy Hash: 25218171500304AFEB21DF65DD45F66FBE8EF09314F088869E9458B691D776E808CBB2

Function 0090A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A815

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 58ce0133585c67700db67715b9c7bde4a852affc192fef8e14c4b3ba3fddc165
Instruction ID: c883a6bf1d941de54fdde98e968ee4982faefb0d7fbc41f8c6ee5c8a38a39114
Opcode Fuzzy Hash: 58ce0133585c67700db67715b9c7bde4a852affc192fef8e14c4b3ba3fddc165
Instruction Fuzzy Hash: C421D8B54083806FE7228B15DC41BA2BFBCEF47314F0884DAE9848B293D274AD09C772

Function 0090AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0090AA8B

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 1373e6670a661c6e9116c0db00808d7d8201b9dcac95b9b6481262dcbdb6265f
Instruction ID: 11c19327b63130213fcbef16880385f57e147b78270e8d8be7eb269a1ac4312e
Opcode Fuzzy Hash: 1373e6670a661c6e9116c0db00808d7d8201b9dcac95b9b6481262dcbdb6265f
Instruction Fuzzy Hash: D02183716083C45FDB12CB25DD55B96BFE8AF06314F0D84EAE884CF193D225D945CB62

Function 0090A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A40C

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3e13d9ea0e7d2a96beda240769e4414e11c4ce002b37b8b02eeb4416ea4565d3
Instruction ID: 2547de6dd6c8a0822cad96056bff85e8c2e84ac83def80c9d88bf02d1fb398f1
Opcode Fuzzy Hash: 3e13d9ea0e7d2a96beda240769e4414e11c4ce002b37b8b02eeb4416ea4565d3
Instruction Fuzzy Hash: 7E218E75600304AFEB30CE15CD84FA6F7ECEF04714F14886AE9458B6A1D774E909CAB2

Function 0090A147 Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0090A1C2

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 61609283b7c9586bd69e00f3d5984c3fc584e520e045d6098e7ac027e48bb7ef
Instruction ID: b76460d18efa61f522385095ffebc06d19d819336de769fd4a5b0fec6df2a751
Opcode Fuzzy Hash: 61609283b7c9586bd69e00f3d5984c3fc584e520e045d6098e7ac027e48bb7ef
Instruction Fuzzy Hash: 58110371508340AFD321CB15CC45F66BFB8EB86624F04849EEC448B682D330B905CBA2

Function 0090A962 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A9C1

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3f7113e520e7e43fd6dffe09329f347a7e31c91e204d39e06f0fa41b6cf79e8e
Instruction ID: 5cd8d6938aa323bd916e5e6c344fcf66abab505f4583ddbccbc78d9bea33875d
Opcode Fuzzy Hash: 3f7113e520e7e43fd6dffe09329f347a7e31c91e204d39e06f0fa41b6cf79e8e
Instruction Fuzzy Hash: F411B271500304AFEB31CF55DD44FAAFBA8EF08324F14886AE9498A691D374A448CBB2

Function 0090A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A8DE

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7e45d1ba58874e894279863720aa4b24bc477d58d81ec48c374d72a048e5522f
Instruction ID: 1624e97ecda6dc8706acd376e7002cfdc5a4badd2a5ed5de333d1ee9f2410d06
Opcode Fuzzy Hash: 7e45d1ba58874e894279863720aa4b24bc477d58d81ec48c374d72a048e5522f
Instruction Fuzzy Hash: 2B11C171500304AFEB31CF54DD44FA6FBA8EF48324F14C86AED498B691D374A9088BB2

Function 0090A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0090A30C

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b5b4182afcbcd55646623df819f12301c9b3ee30ca45ec0a5747ab92ffb444f6
Instruction ID: 1eeb81285bd2db441e8fbbb825e7ddab745d49afaddb9b4b1f1728028ab92dad
Opcode Fuzzy Hash: b5b4182afcbcd55646623df819f12301c9b3ee30ca45ec0a5747ab92ffb444f6
Instruction Fuzzy Hash: 4511A0754093C0AFDB228B25DC55A52BFB4EF57320F0980DBDD858F2A3D265A808CB72

Function 0090AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0090AFE4

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: b2ea05a81e63a4ce96b91347c2d7beaae9d2805735a2995566aa9ea6ec223cc8
Instruction ID: 85474b3465a2c28843c98f236939f0d5e03334116f02b69c3d26ce0e5661cb04
Opcode Fuzzy Hash: b2ea05a81e63a4ce96b91347c2d7beaae9d2805735a2995566aa9ea6ec223cc8
Instruction Fuzzy Hash: 8611A3715093C09FDB228B25DC45B52BFF8EF46220F0984DADD858B262D274A848DB61

Function 0090B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0090B208

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9513cb8137e3f85685a216ada029c76566e19cfc29db006a7a8593bd65d9b97c
Instruction ID: d982bff0785e96a45264da1112a24b36f79a044e1b39105a0465c4a35a67017b
Opcode Fuzzy Hash: 9513cb8137e3f85685a216ada029c76566e19cfc29db006a7a8593bd65d9b97c
Instruction Fuzzy Hash: 9F11A0714093809FDB22CF25DD44B56BFB4EF56220F0884DAED858F252D275A808CB62

Function 0090A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,F2E60B7A,00000000,00000000,00000000,00000000), ref: 0090A815

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 926097d3ed52ac9560ad28a6b73ace3fca07b7858fd0a7d70b71e5222f6388b3
Instruction ID: 58005429b9d211f797d465ec1ecc37e81c79e5f73e87bb9ee496714ff6890a19
Opcode Fuzzy Hash: 926097d3ed52ac9560ad28a6b73ace3fca07b7858fd0a7d70b71e5222f6388b3
Instruction Fuzzy Hash: A6010471500300AEEB308B05CD45FA6FBA8DF04724F14C4A6ED098B791D378E8088AB6

Function 0090AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0090AA8B

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 6fb011ae942d56f16402acfb9fd79dadfb3bdffe3b14272185f5a910d5307c2a
Instruction ID: 04fa246e356be1ce3554c4deef93538283f66bd087cf77c7b2d2c69e33afe3e5
Opcode Fuzzy Hash: 6fb011ae942d56f16402acfb9fd79dadfb3bdffe3b14272185f5a910d5307c2a
Instruction Fuzzy Hash: 0B1152716042459FEB20CF19D985B56FBD8EF04720F08C4AADD09CB691E778E844CBA2

Function 0090A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0090A1C2

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: de33d946f62b9d27c436a7deba948e10fab403833512f4327b5f52e542f27601
Instruction ID: 8bfcabf45cd789e8fbaa3470dbdb7ae67a1b4e49e9080abad2524051a2f5db44
Opcode Fuzzy Hash: de33d946f62b9d27c436a7deba948e10fab403833512f4327b5f52e542f27601
Instruction Fuzzy Hash: 3701F171600201ABD310DF16CC46B66FBE8FB88B20F14852AED088B741D331F815CBE1

Function 0090ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0090AC36

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: aa4c6d884123b897a7e90f581556acba5edcddfe975d7638d1a502ff1cd3cbaf
Instruction ID: 4c69ab79935e1e3fe41ecfd691ae4ed50126c079e2b91c716c208eb5ed72bddd
Opcode Fuzzy Hash: aa4c6d884123b897a7e90f581556acba5edcddfe975d7638d1a502ff1cd3cbaf
Instruction Fuzzy Hash: DB01B171640201ABD310DF16CD46B66FBE8FB89B20F14852AED089B741D731F915CBE1

Function 0090AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0090AFE4

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: c840c9819165a50f57740ca67c29870420609944b241efbfefe3577d43d7126b
Instruction ID: 3687060e0bc837ce19838ca98bc8e02494211612da77c10158dbe53ecc2fb5b2
Opcode Fuzzy Hash: c840c9819165a50f57740ca67c29870420609944b241efbfefe3577d43d7126b
Instruction Fuzzy Hash: 2201D1755002449FDB208F19D885766FBE8EF05320F08C4AADD098F792E379E848DEA2

Function 0090A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0090A30C

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6b672b6e5dc330d00850863a6a4a4c748922d54739d20d65dfbdf214b1faf7ce
Instruction ID: 7fc6839d1b867bba8f59390abd0b8042f06fbed655d139b38bbf443509e6fc67
Opcode Fuzzy Hash: 6b672b6e5dc330d00850863a6a4a4c748922d54739d20d65dfbdf214b1faf7ce
Instruction Fuzzy Hash: 18F0AF355043449FDB208F05D985B65FBE4EF04724F18C4AADD094F796E379E808DEA2

Function 00B90C99 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

[M', xrefs: 00B90D43, 00B90D48

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID: [M'
API String ID: 0-2875933700
Opcode ID: e543a7b6db0ff33ac6669acdfe5bc92e9f2ab58fed1d1b31f243cd4b07b3ca55
Instruction ID: a862d7dca7d33a0029e0b137c0bd837d79bfe9a9897bb60f8baa24cf0752aaad
Opcode Fuzzy Hash: e543a7b6db0ff33ac6669acdfe5bc92e9f2ab58fed1d1b31f243cd4b07b3ca55
Instruction Fuzzy Hash: 69213571B006548FCB25EB3984527EE7EE69FC6204B44887DD545CB391DF39ED0287A1

Function 00B90CA8 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

[M', xrefs: 00B90D43, 00B90D48

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID: [M'
API String ID: 0-2875933700
Opcode ID: faeaaa508553b0c2eef1f6a6c720bb2e0982ba4a10e58b10cf161da99e5133d5
Instruction ID: a6e779696cc8543dc2adf942ceadcecd5deceb53fcee053eddfa647c257b2170
Opcode Fuzzy Hash: faeaaa508553b0c2eef1f6a6c720bb2e0982ba4a10e58b10cf161da99e5133d5
Instruction Fuzzy Hash: 6A210231B007148FCB64EB39C5516AEBBE69FC6208B44883DC586DB381DF79ED0287A5

Function 0090A6D4 Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0090A748

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 86c3fbe78d5b55dda98dcdb6749d055784f6676817564733a35bedeae47504a2
Instruction ID: 6e426fde62e534e54f9eb6d59dc72c4a07af4811978f76af663d5d2748a3608b
Opcode Fuzzy Hash: 86c3fbe78d5b55dda98dcdb6749d055784f6676817564733a35bedeae47504a2
Instruction Fuzzy Hash: 0221D4B59093C09FDB138B25DC95752BFB8EF17320F0984DADC858F2A3D2649908CB62

Function 0090A716 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0090A748

Memory Dump Source

Source File: 00000000.00000002.4602831105.000000000090A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bad6847a3541340c7ea42b89b4eabf4ea0afd75816021b3c13ac41677360b37e
Instruction ID: 457597205bd5d86d2ad03ef638413c805812a73c8e7449d65670d5e27dae264c
Opcode Fuzzy Hash: bad6847a3541340c7ea42b89b4eabf4ea0afd75816021b3c13ac41677360b37e
Instruction Fuzzy Hash: BC0184759043449FDB20CF15D985765FBE4EF04324F18C4AADD098F792D379E844CAA2

Function 00B902C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81bbb730a8e7456f5208ec7c73753ef611f38172ec0399ef90c32d58abd7d9b
Instruction ID: 274e3170f4514d117e3a0d522d63b3ca718bc0ce0ea3f44d42eb12a6c0c13b0b
Opcode Fuzzy Hash: a81bbb730a8e7456f5208ec7c73753ef611f38172ec0399ef90c32d58abd7d9b
Instruction Fuzzy Hash: 42B15D35B11100CFCB14FB64E864A5A7BF2EF88352B59D66AE9069B36CDB349D01CB90

Function 00B90799 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da0a54a2fcc67d251711e56178471d62a479f23421fe1662170ea1998784eee
Instruction ID: 5ea00162f8403fd77658a88b825455a3af4cd2bea053a91b81b0bfca786f15e7
Opcode Fuzzy Hash: 3da0a54a2fcc67d251711e56178471d62a479f23421fe1662170ea1998784eee
Instruction Fuzzy Hash: 9CA15031B102018FDB54EB78D8657AE77F3EB88308F148479DA06973A8DB789D41CB51

Function 00B90B8F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 019639704f74199bc49bf83a5a65ef43a84d126bd303cd87a2ef30495275b4eb
Instruction ID: 0d9deb3b7ea70b7cbd55738ed58da444bd1e08699e12f30f36fdfe044985ee7e
Opcode Fuzzy Hash: 019639704f74199bc49bf83a5a65ef43a84d126bd303cd87a2ef30495275b4eb
Instruction Fuzzy Hash: AC11EE32B101196FCF44DBB4D8929DE7BF2AF88314B04497AE605E7375EB74980A8BC0

Function 00B90BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dcb20aa52dc0accabee421b02ff3173164a5f0489a77cc42ab9cb46e3e0101d
Instruction ID: c9c59bab113f83db01f3fa844222ba58589fe208a7fe7ae39ae3a10903df7c33
Opcode Fuzzy Hash: 8dcb20aa52dc0accabee421b02ff3173164a5f0489a77cc42ab9cb46e3e0101d
Instruction Fuzzy Hash: 3B119E32B10119AFCF44EBB4D89599E7BF6FB89314B054975E605E7238EB35A8058BC0

Function 00BB080A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602992849.0000000000BB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55542f6035ba3c4cd6b4e44369fef6697087f9f059c8cccefb8e9dbb2944429
Instruction ID: 9a0fbea80f69229b9948c65867c27ec1d7c70fae71ceb1f29f961bd176e705d9
Opcode Fuzzy Hash: d55542f6035ba3c4cd6b4e44369fef6697087f9f059c8cccefb8e9dbb2944429
Instruction Fuzzy Hash: CD01D8B240D3406FD7019B15AC41C57BFFCEF92524B08C4AEEC49CB602E265A908CBB3

Function 00BB05E4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602992849.0000000000BB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c544bf732aec25c25af1ed6d2fc85d6372e5603bbf00b01210b3678442363e
Instruction ID: e40e1bad063a205d02dc42fc503111a726dcfea3dd24a9b30db7508f0892910f
Opcode Fuzzy Hash: b6c544bf732aec25c25af1ed6d2fc85d6372e5603bbf00b01210b3678442363e
Instruction Fuzzy Hash: A9F0A9B65097806FD7128F16DC40863FFF8EF86620709C4AFEC498B612D225A908CB72

Function 00BB082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602992849.0000000000BB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8c9ef6fb86dca0c6b2ad35bf43879f4cb4d8a519b3af14f648a56439a00683
Instruction ID: 5e93417744d135a74ff166de3c2ceebd067ad6ba86a97093493b4d8db5b6f918
Opcode Fuzzy Hash: 1e8c9ef6fb86dca0c6b2ad35bf43879f4cb4d8a519b3af14f648a56439a00683
Instruction Fuzzy Hash: 77F082B2855204AB9340DF05ED45866FBECEF94521F14C56EEC088B700E276A9198AE2

Function 00B90C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60adfff783750eedab4b716b731b465253a8c4c6e9bc14a4765bfc5bccf8e6aa
Instruction ID: f0a122182506bee9c1fe5ae844f2a9a57d9494ed18c62ba1314ddf9712def824
Opcode Fuzzy Hash: 60adfff783750eedab4b716b731b465253a8c4c6e9bc14a4765bfc5bccf8e6aa
Instruction Fuzzy Hash: B6E0D831F192541FCB08DAF948515DD7FE59B85160F4444BDC048CB391FB3D88038380

Function 00BB0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602992849.0000000000BB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204268981c8a7f444e351d3d421603760c21c54355558f6de0be0288f542b29c
Instruction ID: b68e0b65be3337276face7dfcbaf610e1da16639e2489c01a25979ffa2115565
Opcode Fuzzy Hash: 204268981c8a7f444e351d3d421603760c21c54355558f6de0be0288f542b29c
Instruction Fuzzy Hash: 21E092B66456005B9650CF0AEC41462FBD8EB84630718C47FDC0D8BB01E239B508CEA5

Function 00B90C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d977ab1cfc81a8da227ed12d34c82e7738fa224b0b13c5f05503fa274b02b4f
Instruction ID: 5295bdcc15d3b8c21ca96e72509b10669a80262874a2281c7b6e8fe970f9e5d7
Opcode Fuzzy Hash: 9d977ab1cfc81a8da227ed12d34c82e7738fa224b0b13c5f05503fa274b02b4f
Instruction Fuzzy Hash: B9D01272F052182B8B58DAF9584159EBBEA9B85164B54447D9009D7350EE39980287C0

Function 00B90E08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48b81339e2b13b3dd6ae2928de990a0367680ecf2885f32bafaaa352e24621e
Instruction ID: 9d02c3e7872108f0626efe0f2e58202101978c50019af3b88fd77759f10c95ea
Opcode Fuzzy Hash: b48b81339e2b13b3dd6ae2928de990a0367680ecf2885f32bafaaa352e24621e
Instruction Fuzzy Hash: 0FE0EC312A93554FCB0AA6A4986A5D87FA15B86314F4985FA84448F2A7C628CC46C341

Function 00B90DD1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1593265d9b128a50c587e7ac67052799c58f7c4b6a7491ebeef3afd5fe739636
Instruction ID: 662bcaebd9a9a3edb10c597e7ddc021ac2b8d6ec06daf3ba5df159815ff825b5
Opcode Fuzzy Hash: 1593265d9b128a50c587e7ac67052799c58f7c4b6a7491ebeef3afd5fe739636
Instruction Fuzzy Hash: 2DE012303DD3814FDB07D77488669997FA15B92314F4A85FAC449CB2E7D668CC45C781

Function 009023F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602820327.0000000000902000.00000040.00000800.00020000.00000000.sdmp, Offset: 00902000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_902000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65e11c2a7389b5f0eb6b3c14718d58579e85e90514ad1ea744efb5fe331025d
Instruction ID: 88d255ce124e90fe21342657cefef86a0aa9d4f56416d1a52fef19d9012b7846
Opcode Fuzzy Hash: d65e11c2a7389b5f0eb6b3c14718d58579e85e90514ad1ea744efb5fe331025d
Instruction Fuzzy Hash: FCD05E792096D14FD3269B1CC6A8B9937DCAB51714F4A44F9AC00CB7B3C768D981D600

Function 009023BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602820327.0000000000902000.00000040.00000800.00020000.00000000.sdmp, Offset: 00902000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_902000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bda166da5a89581ad04d1c78b49a3345a10d6e0232f79a3e607efd87d97a8b
Instruction ID: af2a83ef46cff6a353005e54c4bdb675e800f8b7996bab1ec6e6c857869c5a50
Opcode Fuzzy Hash: f2bda166da5a89581ad04d1c78b49a3345a10d6e0232f79a3e607efd87d97a8b
Instruction Fuzzy Hash: D4D05E342002818FCB25DB0CD2D8F5937D8AB40B14F0644E8AC108B7A2C7B8D8C5DA00

Function 00B90E18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1e63027ec9f45c1eed82a78d9c9f23d1f5e73fb3db8803e948a8e33c77095e
Instruction ID: 777c1ec5e7964567abe3fdd9aff150e6aaead2e5ea25d96e551c4921acbd9b70
Opcode Fuzzy Hash: 5f1e63027ec9f45c1eed82a78d9c9f23d1f5e73fb3db8803e948a8e33c77095e
Instruction Fuzzy Hash: 21C012313602088FCB44B7B8D51AA2977D557C4704F89C4B555080B365CA74EC40C740

Function 00B90DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4602971301.0000000000B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bf1c8344a43a52afe6ce45e598e6fe65d5f9df065fca86f65b6f6520803ce7
Instruction ID: e0261f51c25c09971e349b81beab883a948bac2c6170e407cbb825190afabb3b
Opcode Fuzzy Hash: a7bf1c8344a43a52afe6ce45e598e6fe65d5f9df065fca86f65b6f6520803ce7
Instruction Fuzzy Hash: 84C012303602048FCB04B7B8D41AA2577D697C0714F49C4B495080B365CA74EC40D680

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report powershell.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\unarchiver.log

Static File Info

General

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: unarchiver.exePID: 2408, Parent PID: 1028

General

Chronological Activities

Analysis Process: 7za.exePID: 6304, Parent PID: 2408

General

Chronological Activities

Analysis Process: conhost.exePID: 2992, Parent PID: 6304

General

Chronological Activities

Disassembly

Analysis Process: unarchiver.exePID: 2408, Parent PID: 1028COMMON

Execution Graph

Graph

Callgraph

Executed Functions

Function 0090B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Function 0090B246 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Control-flow Graph

Windows Analysis Report
powershell.zip

Function 0090B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 0090AB76 Relevance: 1.6, APIs: 1, Instructions: 100
pipeCOMMON

Function 0090AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0090A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Function 0090AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0090A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Function 0090B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0090A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Function 0090A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 0090A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Function 0090A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Function 0090AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 0090A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Function 0090A147 Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Function 0090A962 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON