Edit tour

Windows Analysis Report
msimg32.dll

Overview

General Information

Sample name:	msimg32.dll
Analysis ID:	1528944
MD5:	26fc1bca08f774ae76ac140ada344686
SHA1:	bc93c170f1b131d9fa8c7ae835e583eeef3cf885
SHA256:	63a8464636601279443580899d9d0bae931360251992af15f040d98e2f1f8118
Tags:	dllTaxOrganizer2023user-JAMESWT_MHT
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7504 cmdline: loaddll32.exe "C:\Users\user\Desktop\msimg32.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7556 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7580 cmdline: rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7564 cmdline: rundll32.exe C:\Users\user\Desktop\msimg32.dll,AlphaBlend MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: msimg32.dll

ReversingLabs: Detection: 18%

Source: msimg32.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: msimg32.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: E:\building\360project\360sd\branches\beta\Build\x86\WhiteCache.pdb source: loaddll32.exe, 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.000000001013D000.00000002.00000001.01000000.00000003.sdmp, msimg32.dll

Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp, msimg32.dll	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp, msimg32.dll	String found in binary or memory: http://www.openssl.org/support/faq.html....................

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001804	0_2_10001804
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_1000521E	0_2_1000521E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100054A0	0_2_100054A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10008EA3	0_2_10008EA3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100054AB	0_2_100054AB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004AF0	0_2_10004AF0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004AFE	0_2_10004AFE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004B0E	0_2_10004B0E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004B31	0_2_10004B31
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004F43	0_2_10004F43
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001784	0_2_10001784
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004B8D	0_2_10004B8D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10004B98	0_2_10004B98
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100017BB	0_2_100017BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001804	3_2_10001804
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000521E	3_2_1000521E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100054A0	3_2_100054A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10008EA3	3_2_10008EA3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100054AB	3_2_100054AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004AF0	3_2_10004AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004AFE	3_2_10004AFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004B0E	3_2_10004B0E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004B31	3_2_10004B31
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004F43	3_2_10004F43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001784	3_2_10001784
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004B8D	3_2_10004B8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004B98	3_2_10004B98
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100017BB	3_2_100017BB

Source: msimg32.dll

Binary or memory string: OriginalFilenameWhiteCache.DLL, vs msimg32.dll

Source: msimg32.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal48.winDLL@8/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03

Source: msimg32.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\msimg32.dll,AlphaBlend

Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT filepath FROM BlackCache ORDER BY atime DESC LIMIT 2000%04d-%02d-%02d %02d:%02d:%02dSELECT filepath, mtime, size, atime FROM WhiteCache ORDER BY atime DESC LIMIT 2000COMMITDELETE FROM WhiteCache WHERE atime < datetime('now', '-%d hour', 'localtime')CREATE TABLE IF NOT EXISTS BlackCache (filepath varchar(300) UNIQUE,atime char(255));CREATE TABLE IF NOT EXISTS WhiteCache (filepath varchar(300) UNIQUE,mtime char(255),atime char(255),size INTEGER(8))BEGIN TRANSACTIONwhitecacheINSERT INTO BlackCache(filepath, atime) VALUES ('%q', datetime('now', 'localtime'))DELETE FROM BlackCache WHERE filepath = '%q'DELETE FROM WhiteCacheDELETE FROM WhiteCache WHERE filepath = '%q' UPDATE WhiteCache SET atime = datetime('now', 'localtime') WHERE filepath = '%q'INSERT INTO WhiteCache(filepath, size, mtime, atime) VALUES ('%q', %lld, '%4d-%02d-%02d %2d:%02d:%02d', datetime('now', 'localtime'))list<T> too long
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0SELECT 'CREATE UNIQUE INDEX vacuum_db.' \|\| substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'SELECT 'CREATE INDEX vacuum_db.' \|\| substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' SELECT 'CREATE TABLE vacuum_db.' \|\| substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0BEGIN EXCLUSIVE;PRAGMA vacuum_db.synchronous=OFFATTACH '' AS vacuum_db;cannot VACUUM from within a transactionwin32
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS BlackCache (filepath varchar(300) UNIQUE,atime char(255));
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: msimg32.dll

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\msimg32.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\msimg32.dll,AlphaBlend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\msimg32.dll,AlphaBlend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: msimg32.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: msimg32.dll

Static file information: File size 2338816 > 1048576

Source: msimg32.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x117400

Source: msimg32.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: msimg32.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: msimg32.dll

Static PE information: real checksum: 0x175e45 should be: 0x23e37f

Source: msimg32.dll

Static PE information: section name: .didat

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100AE25B push ecx; ret	0_2_100AE26E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10007B8B push 8DCB8153h; retf 0000h	0_2_10007B90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100AE25B push ecx; ret	3_2_100AE26E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10007B8B push 8DCB8153h; retf 0000h	3_2_10007B90

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	API coverage: 9.1 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 9.1 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	1 System Information Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
msimg32.dll	18%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label	Link
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html....................	loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp, msimg32.dll	false		unknown
http://www.openssl.org/support/faq.html	loaddll32.exe, 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1838411799.0000000010119000.00000002.00000001.01000000.00000003.sdmp, msimg32.dll	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528944
Start date and time:	2024-10-08 13:57:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	msimg32.dll
Detection:	MAL
Classification:	mal48.winDLL@8/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: msimg32.dll

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.928111133196447
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	msimg32.dll
File size:	2'338'816 bytes
MD5:	26fc1bca08f774ae76ac140ada344686
SHA1:	bc93c170f1b131d9fa8c7ae835e583eeef3cf885
SHA256:	63a8464636601279443580899d9d0bae931360251992af15f040d98e2f1f8118
SHA512:	4c66a99f6b10544917b40d7e3bb8968c1324e2a7d66f688528108bf86a8ea2651492de81de0f944bf0174da4e3e983c5f27c86a1d6dd72a7d51cd9554da4931a
SSDEEP:	49152:kVg6Rabpu4p1goweObvbeBiDw0u+45GPJ:kup7fweOriYDw0/DJ
TLSH:	42B5BE41F7C3C4FEC19665B8502AB2F55726A7B01F2381C7B6849E2E4E357C26A3E316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J@ma.@ma.@ma.."..Bma.I...]ma.^?..Cma.g...Gma.g...Uma.@m`.Voa.vKk..ma.I....ma.I....ma.I...Ama.^?..Ama.I...Ama.Rich@ma........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100aa3b6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5305DEC6 [Thu Feb 20 10:53:58 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	4437bd0776f3b515fff5184512f096fe

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FDDFC71AAF7h
call 00007FDDFC72BFF0h
push dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+10h]
mov edx, dword ptr [ebp+0Ch]
call 00007FDDFC71A9E1h
pop ecx
pop ebp
retn 000Ch
ret
mov eax, 100BC477h
mov dword ptr [10154CF4h], eax
mov dword ptr [10154CF8h], 100BBB01h
mov dword ptr [10154CFCh], 100BBAB5h
mov dword ptr [10154D00h], 100BBAEEh
mov dword ptr [10154D04h], 100BBA57h
mov dword ptr [10154D08h], eax
mov dword ptr [10154D0Ch], 100BC3EFh
mov dword ptr [10154D10h], 100BBA73h
mov dword ptr [10154D14h], 100BB9D5h
mov dword ptr [10154D18h], 100BB962h
ret
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword ptr [ebp+08h]
mov eax, dword ptr [1015A648h]
mov dword ptr [1015A648h], ecx
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007FDDFC71AA76h
call 00007FDDFC72CBBBh
cmp dword ptr [ebp+08h], 00000000h
mov dword ptr [1015A64Ch], eax
je 00007FDDFC71AAF7h
call 00007FDDFC72CB42h
fnclex
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[C++] VS2008 build 21022
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS98 (6.0) SP6 build 8804
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[EXP] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x148500	0x163	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15d000	0xdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x162000	0xe0f80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x16ba98	0x3768	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x166000	0xc89c	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x119ea0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15dc7c	0xba0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x161000	0x40	.didat
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x118000	0x117400	be13da8ff662b623a3826b6ad834f0ae	False	0.4294977828446732	data	6.139217151418847	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x119000	0x30000	0x2f800	3ebb4ae39b21d67ca99e9aab4f182595	False	0.2931794819078947	data	4.929547645604978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x149000	0x14000	0xec00	445ab38254c12e3b8c79515e3c266b45	False	0.2839645127118644	DIY-Thermocam raw data (Lepton 2.x), scale 9728-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset -0.000000, slope 11688517198388985585992515102703616.000000	4.635869792483619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x15d000	0x4000	0x4000	64bfd27ef8d1ba6532854e3b35bb3447	False	0.32421875	data	5.041899968325136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x161000	0x1000	0x400	6a589aa1ebb09d8b2ec70b67ea0a478b	False	0.11328125	firmware cc10 v1600 (revision 3926922752) pM\023 (region 2953844224), 614731024 bytes or less, UNKNOWN1 0xb0101600, at 0xf3a30d10 0 bytes , at 0 0 bytes	0.9998421395258815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x162000	0xe0f80	0xe1000	996c5329ba4eb38b89024bc4e9133537	False	0.6308648003472223	data	7.448466677680904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x162c18	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x162d4c	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x162e00	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x162f34	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x163068	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x16319c	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x1632d0	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x163404	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x163538	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x16366c	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x1637a0	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x1638d4	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x163a08	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x163b3c	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x163c70	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x163da4	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x163ed8	0x78c36	PC bitmap, Windows 3.x format, 62769 x 2 x 48, image size 495095, cbSize 494646, bits offset 54			0.7540604796157252
RT_BITMAP	0x1dcb10	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x1dcbc8	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x1dcd0c	0xb402	PC bitmap, Windows 3.x format, 6559 x 2 x 53, image size 46225, cbSize 46082, bits offset 54			0.48383316696323947
RT_ICON	0x1e8110	0x79c5	PC bitmap, Windows 3.x format, 3987 x 2 x 47, image size 31925, cbSize 31173, bits offset 54			0.46982966028293716
RT_ICON	0x1efad8	0x5834	PC bitmap, Windows 3.x format, 3157 x 2 x 41, image size 23045, cbSize 22580, bits offset 54			0.3520814880425155
RT_ICON	0x1f530c	0x2f6cb	PC bitmap, Windows 3.x format, 24623 x 2 x 40, image size 195167, cbSize 194251, bits offset 54			0.5134285022985725
RT_ICON	0x2249d8	0x1d22a	PC bitmap, Windows 3.x format, 15412 x 2 x 38, image size 119734, cbSize 119338, bits offset 54			0.4990782483366572
RT_DIALOG	0x241c04	0xe2	data	Chinese	China	0.6814159292035398
RT_DIALOG	0x241ce8	0x34	data	Chinese	China	0.9038461538461539
RT_STRING	0x241d1c	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x241d6c	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x241d98	0x82	data	Chinese	China	0.9307692307692308
RT_STRING	0x241e1c	0x1d6	data	Chinese	China	0.8148936170212766
RT_STRING	0x241ff4	0x160	data	Chinese	China	0.4971590909090909
RT_STRING	0x242154	0x12e	data	Chinese	China	0.652317880794702
RT_STRING	0x242284	0x50	data	Chinese	China	0.7125
RT_STRING	0x2422d4	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x242318	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x242380	0x1b8	data	Chinese	China	0.6568181818181819
RT_STRING	0x242538	0x104	data	Chinese	China	0.6038461538461538
RT_STRING	0x24263c	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x242660	0x30	data	Chinese	China	0.625
RT_RCDATA	0x242690	0x80	data	English	United States	1.0859375
RT_GROUP_CURSOR	0x242710	0x22	data	Chinese	China	1.1176470588235294
RT_GROUP_CURSOR	0x242734	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x242748	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x24275c	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x242770	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x242784	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x242798	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x2427ac	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x2427c0	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x2427d4	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x2427e8	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x2427fc	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x242810	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x242824	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x242838	0x14	data	Chinese	China	1.4
RT_VERSION	0x24284c	0x5d4	data	Chinese	China	0.25335120643431636
RT_MANIFEST	0x242e20	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786
None	0x242f7c	0x4	data	Chinese	China	3.0

Imports

DLL	Import
KERNEL32.dll	CompareStringW, GlobalGetAtomNameW, GetAtomNameW, lstrcmpA, lstrlenA, GetThreadLocale, SystemTimeToFileTime, SetThreadPriority, ResumeThread, SetEvent, SuspendThread, CreateEventW, lstrcmpW, GlobalFlags, GlobalAddAtomW, MoveFileW, GetStringTypeExW, lstrcmpiW, DuplicateHandle, GetCurrentProcess, FindClose, FindFirstFileW, GetVolumeInformationW, GetShortPathNameW, GlobalDeleteAtom, GlobalFindAtomW, FreeResource, CompareStringA, GetLocaleInfoW, EnumResourceLanguagesW, ConvertDefaultLocale, GetCurrentThread, SetErrorMode, GetFileAttributesExW, LocalFileTimeToFileTime, InterlockedDecrement, SetFileAttributesW, GetFileSizeEx, GetFileTime, GetModuleHandleA, GetPrivateProfileIntW, WritePrivateProfileStringW, GetPrivateProfileStringW, GetCurrentDirectoryW, RtlUnwind, RaiseException, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetDriveTypeA, FindFirstFileA, GetCommandLineA, HeapAlloc, HeapFree, HeapReAlloc, ExitThread, CreateThread, HeapSize, ExitProcess, GetModuleFileNameA, GetTimeZoneInformation, GetCurrentDirectoryA, SetCurrentDirectoryA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LCMapStringA, LCMapStringW, SetHandleCount, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, HeapDestroy, VirtualFree, FatalAppExitA, VirtualAlloc, SetConsoleCtrlHandler, GetConsoleCP, GetConsoleMode, SetStdHandle, InitializeCriticalSectionAndSpinCount, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, GetTimeFormatA, GetDateFormatA, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetProcessHeap, GetModuleHandleW, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, GlobalHandle, GlobalReAlloc, TlsGetValue, LocalAlloc, GetModuleFileNameW, GlobalFree, CopyFileW, GlobalSize, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageW, LocalFree, lstrlenW, MulDiv, SetLastError, GetVersionExA, GlobalMemoryStatus, GetStdHandle, GetFileType, GetVersion, InterlockedIncrement, CreateFileW, CreateFileA, GetSystemTimeAsFileTime, GetSystemTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, FreeLibrary, GetProcAddress, LoadLibraryW, LoadLibraryA, GetDiskFreeSpaceW, GetDiskFreeSpaceA, GetFullPathNameW, GetFullPathNameA, DeleteFileW, GetFileAttributesW, DeleteFileA, GetFileAttributesA, FormatMessageA, GetTempPathW, GetTempPathA, UnlockFile, LockFileEx, LockFile, GetFileSize, FlushFileBuffers, SetEndOfFile, WriteFile, SetFilePointer, GetLastError, ReadFile, Sleep, AreFileApisANSI, WideCharToMultiByte, MultiByteToWideChar, GetVersionExW, GetFileInformationByHandle, FileTimeToLocalFileTime, FileTimeToSystemTime, FindResourceW, LoadResource, LockResource, SizeofResource, GetCurrentThreadId, ReleaseSemaphore, WaitForSingleObject, CloseHandle, CreateSemaphoreW, InterlockedExchange, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, SetFileTime, InitializeCriticalSection
USER32.dll	GetNextDlgTabItem, CreateDialogIndirectParamW, SetCursor, ShowOwnedPopups, DeleteMenu, SetRectEmpty, InvalidateRect, GetDialogBaseUnits, TranslateAcceleratorW, BringWindowToTop, CreatePopupMenu, InsertMenuItemW, LoadAcceleratorsW, ReleaseCapture, GetMenuBarInfo, LoadMenuW, ReuseDDElParam, UnpackDDElParam, SetRect, SetTimer, KillTimer, WindowFromPoint, GetKeyNameTextW, MapVirtualKeyW, IsRectEmpty, GetSystemMenu, SetParent, UnionRect, GetDCEx, LockWindowUpdate, SetCapture, FillRect, PostQuitMessage, RegisterWindowMessageW, LoadIconW, SendDlgItemMessageA, WinHelpW, IsChild, GetCapture, GetClassLongW, SetPropW, GetPropW, RemovePropW, GetForegroundWindow, SetActiveWindow, BeginDeferWindowPos, EndDeferWindowPos, GetTopWindow, DestroyWindow, GetMessageTime, GetMessagePos, MapWindowPoints, ScrollWindow, TrackPopupMenuEx, TrackPopupMenu, SetMenu, SetScrollRange, GetScrollRange, SetForegroundWindow, ShowScrollBar, UpdateWindow, GetClientRect, PostMessageW, CreateWindowExW, GetClassInfoExW, EndDialog, RegisterClassW, AdjustWindowRectEx, ScreenToClient, EqualRect, DeferWindowPos, GetScrollInfo, SetScrollInfo, SetWindowPlacement, DefWindowProcW, CallWindowProcW, CopyRect, GetMenu, OffsetRect, IntersectRect, SystemParametersInfoA, IsIconic, GetWindowPlacement, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapW, ModifyMenuW, EnableMenuItem, CheckMenuItem, SetWindowPos, ScrollWindowEx, ShowWindow, MoveWindow, IsWindow, IsDialogMessageW, IsDlgButtonChecked, SetDlgItemTextW, SetDlgItemInt, SendDlgItemMessageW, GetDlgItemTextW, GetDlgItemInt, GetDlgItem, CheckRadioButton, CheckDlgButton, GetScrollPos, SetScrollPos, SetFocus, CharUpperW, DestroyIcon, GetFocus, ClientToScreen, GetWindow, GetUserObjectInformationW, GetProcessWindowStation, GetDesktopWindow, MessageBoxA, GetDlgCtrlID, GetWindowRect, GetClassNameW, PtInRect, SetWindowTextW, UnregisterClassW, SetWindowsHookExW, CallNextHookEx, GetMessageW, TranslateMessage, DispatchMessageW, GetActiveWindow, IsWindowVisible, GetKeyState, SystemParametersInfoW, DestroyMenu, GetMenuItemInfoW, InflateRect, EndPaint, BeginPaint, GetWindowDC, GrayStringW, DrawTextExW, DrawTextW, GetClassInfoW, TabbedTextOutW, RemoveMenu, GetSubMenu, GetMenuItemCount, InsertMenuW, GetMenuItemID, AppendMenuW, GetMenuStringW, GetMenuState, MessageBoxW, EnableWindow, IsWindowEnabled, GetLastActivePopup, PeekMessageW, GetCursorPos, ValidateRect, GetWindowTextLengthW, GetWindowTextW, LoadCursorW, GetSystemMetrics, GetDC, ReleaseDC, GetSysColor, GetSysColorBrush, UnhookWindowsHookEx, GetWindowThreadProcessId, SendMessageW, GetParent, GetWindowLongW, SetWindowLongW
GDI32.dll	PlayMetaFileRecord, GetObjectType, Escape, EnumMetaFile, PlayMetaFile, CreatePen, ExtCreatePen, CreateSolidBrush, CreateHatchBrush, CreateFontIndirectW, GetTextExtentPoint32W, CreateRectRgnIndirect, SetRectRgn, CombineRgn, GetMapMode, PatBlt, DPtoLP, GetCharWidthW, CreateFontW, StretchDIBits, GetTextMetricsW, GetBkColor, SelectPalette, GetStockObject, CreatePatternBrush, CreateDIBPatternBrushPt, ExtSelectClipRgn, PolyBezierTo, PolylineTo, PolyDraw, ArcTo, GetCurrentPositionEx, ScaleWindowExtEx, SetWindowExtEx, OffsetWindowOrgEx, SetWindowOrgEx, ExtTextOutW, TextOutW, RectVisible, PtVisible, StartDocW, GetPixel, GetWindowExtEx, CreateDCW, CreateBitmap, GetDCOrgEx, GetClipBox, SetTextColor, DeleteDC, DeleteObject, GetBitmapBits, BitBlt, GetObjectA, SelectObject, CreateCompatibleBitmap, GetDeviceCaps, CreateCompatibleDC, CreateDCA, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, CopyMetaFileW, SetBkColor, GetObjectW, SaveDC, RestoreDC, SetBkMode, SetPolyFillMode, SetROP2, GetViewportExtEx, SelectClipPath, CreateRectRgn, GetClipRgn, SelectClipRgn, SetColorAdjustment, SetArcDirection, SetMapperFlags, SetTextCharacterExtra, SetTextJustification, SetTextAlign, MoveToEx, LineTo, OffsetClipRgn, IntersectClipRect, ExcludeClipRect, SetMapMode, ModifyWorldTransform, SetWorldTransform, SetGraphicsMode, SetStretchBltMode, SetViewportOrgEx
ADVAPI32.dll	RegisterEventSourceA, ReportEventA, DeregisterEventSource, RegQueryValueExW, RegDeleteValueW, RegSetValueExW, RegEnumKeyW, RegDeleteKeyW, RegQueryValueW, RegOpenKeyExW, RegOpenKeyW, RegCreateKeyW, RegCreateKeyExW, RegSetValueW, RegCloseKey
SHLWAPI.dll	PathStripToRootW, PathIsUNCW, PathFindExtensionW, PathRemoveExtensionW, PathFindFileNameW, PathRemoveFileSpecW
WINSPOOL.DRV	DocumentPropertiesW, OpenPrinterW, ClosePrinter
COMDLG32.dll	GetFileTitleW
SHELL32.dll	ExtractIconW, DragFinish, DragQueryFileW, SHGetFileInfoW
ole32.dll	StringFromGUID2, CoDisconnectObject, OleDuplicateData, CoTreatAsClass, StringFromCLSID, CoTaskMemAlloc, ReleaseStgMedium, CoCreateInstance, ReadClassStg, ReadFmtUserTypeStg, OleRegGetUserType, WriteClassStg, WriteFmtUserTypeStg, SetConvertStg, CoTaskMemFree, CLSIDFromString, CoUninitialize, CoInitializeEx, CreateBindCtx
OLEAUT32.dll	SysStringLen, SysFreeString, SysAllocStringByteLen, SysStringByteLen, RegisterTypeLib, LoadTypeLib, LoadRegTypeLib, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayGetElemsize, SafeArrayGetDim, SafeArrayCreate, VariantClear, SafeArrayRedim, VariantChangeType, VariantCopy, SafeArrayAllocData, SafeArrayAllocDescriptor, SafeArrayCopy, SafeArrayGetElement, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayLock, SafeArrayUnlock, SafeArrayDestroy, SafeArrayDestroyData, SafeArrayDestroyDescriptor, VariantTimeToSystemTime, SystemTimeToVariantTime, SysAllocStringLen, VarDateFromStr, SysReAllocStringLen, VarCyFromStr, VarBstrFromCy, VarBstrFromDec, VarDecFromStr, VarBstrFromDate, VariantInit

Exports

Name	Ordinal	Address
AlphaBlend	1	0x1000133e

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Target ID:	0
Start time:	07:57:59
Start date:	08/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\msimg32.dll"
Imagebase:	0xa20000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:57:59
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:57:59
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:57:59
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\msimg32.dll,AlphaBlend
Imagebase:	0xa00000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:57:59
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\msimg32.dll",#1
Imagebase:	0xa00000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	46
Total number of Limit Nodes:	0

Executed Functions

Function 10001358 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XP, xrefs: 10008B90

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: XP
API String ID: 544645111-2561422682
Opcode ID: 37702690e01c811405fad730707145e0b326d92e57730367b35f08c4d44932e0
Instruction ID: 611a6762f14b55aea5511db577eefdb0ac20b78f84cdf096a6eb86895a98922a
Opcode Fuzzy Hash: 37702690e01c811405fad730707145e0b326d92e57730367b35f08c4d44932e0
Instruction Fuzzy Hash: E141B1B1D042958BF764CA14DC94AEEBBB4FB81350F1445FAD889A7280DB385BC2CF11

Function 10008B7D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XP, xrefs: 10008B90

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: XP
API String ID: 544645111-2561422682
Opcode ID: ea34c01b211c5b5aeb386a9f629e0103ef47ac8280f14558fa2cb1510652da17
Instruction ID: 9fe7c090af70a829392d2e3dd0dc4d125f2d6264c912b34b001928b877564150
Opcode Fuzzy Hash: ea34c01b211c5b5aeb386a9f629e0103ef47ac8280f14558fa2cb1510652da17
Instruction Fuzzy Hash: 2E41B3B1D042958BF764CA14DC94AEEBBB4FB81351F1445FAD889A7280DB385BC2CF51

Function 100088E5 Relevance: 1.7, APIs: 1, Instructions: 190
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,10008B7D,?,?), ref: 10008C6B

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f09b9a85c649f4156346158f34b6d6dec9454b537e54009a0950a0ab750368ff
Instruction ID: a58cbadcebaf1fb15d40fd1d273a569e5c7cbeacfae115c0c8c6e7fce1a4b34a
Opcode Fuzzy Hash: f09b9a85c649f4156346158f34b6d6dec9454b537e54009a0950a0ab750368ff
Instruction Fuzzy Hash: 0C911674A052698BEB24CB18CC90AEEB7B5FF85345F1481EAD888A7645DB346FC1CF41

Function 10008898 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a5c192a102c21aa4c71962cf714b8ecdfb5fc616cf5a1b6c62cb9b0eb9c5e9e9
Instruction ID: ee613b4e37b340d3dc2b3b2f7152747be1a662017f11d655da216d7fa73bef91
Opcode Fuzzy Hash: a5c192a102c21aa4c71962cf714b8ecdfb5fc616cf5a1b6c62cb9b0eb9c5e9e9
Instruction Fuzzy Hash: A741D5B5D042558BF724CA14DC94AEABBB9FB84310F1440F9D88D67240DB385BC2CF51

Function 100088BA Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 033d22dc57646c8bfee47c10602df6af31af338f8fb0bbded49fefd3ea9d6782
Instruction ID: 0260ad61eaae6c0e7b33091397af53ad9f8a6aa19526613c5235e9a0bbb394ff
Opcode Fuzzy Hash: 033d22dc57646c8bfee47c10602df6af31af338f8fb0bbded49fefd3ea9d6782
Instruction Fuzzy Hash: 3B41A375D042658BF760CA14DC95AEABBB9FB85350F1480FAD88CA7280DB385BC2CF51

Function 100084E5 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ce9433a9cd0873a8f9ebb8464afd3a66f385b63aa1df2b8ba2819b88ae900a46
Instruction ID: f0591f811cdcb7aadd8ffb48d0ceaf5db788c4e07c8e117eca818f826a0e4f08
Opcode Fuzzy Hash: ce9433a9cd0873a8f9ebb8464afd3a66f385b63aa1df2b8ba2819b88ae900a46
Instruction Fuzzy Hash: BB31A6B2D441559AF760CA14DC44AEB7B78FB85310F1541F6E88C97240DB385BC6CB62

Function 100084ED Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c035c18dfed2d51716e66ca40413ab05278cd7e64bf808d60742fe3a97c9f7ec
Instruction ID: 388b9e57ec8ef64c6d1315326e3cc2b25a16892a013fc780e664cf64172672dd
Opcode Fuzzy Hash: c035c18dfed2d51716e66ca40413ab05278cd7e64bf808d60742fe3a97c9f7ec
Instruction Fuzzy Hash: 7C31C5B2D041555AF760CA14DC84EEBBB79FB81310F1541F6D88CA7240DB386BC6CB62

Function 100080A5 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a330229bdc52a287c5f230264175908211db95fda7fc3c5d57a776f4416ceaeb
Instruction ID: d473adc397c26f8c8bd5239e59e118af5fedfaefe7c048f92b27b68c9a022d0c
Opcode Fuzzy Hash: a330229bdc52a287c5f230264175908211db95fda7fc3c5d57a776f4416ceaeb
Instruction Fuzzy Hash: CE31E9B2D042559AF764C614DC94AEBBB78FB45350F1441F9D88D53280DB385BC2CB51

Non-executed Functions

Function 10008EA3 Relevance: 82.7, Strings: 66, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 10008F69
o, xrefs: 100090B4
z, xrefs: 10008FF6
u, xrefs: 1000902E
e, xrefs: 10008EEA
e, xrefs: 10008FA8
u, xrefs: 1000912C
r, xrefs: 10009035
W, xrefs: 10008F1B
c, xrefs: 10009164
e, xrefs: 10008FFD
s, xrefs: 10008EF1
n, xrefs: 10008ED5
L, xrefs: 10009083
r, xrefs: 100090C2
o, xrefs: 1000908A
a, xrefs: 10009133
e, xrefs: 10008F14
r, xrefs: 10009148
e, xrefs: 10009019
l, xrefs: 1000913A
e, xrefs: 100090A6
e, xrefs: 10009043
u, xrefs: 10008EFF
F, xrefs: 10008EC7
e, xrefs: 10008F7E
R, xrefs: 10009012
u, xrefs: 10008F93
o, xrefs: 1000914F
k, xrefs: 10009098
c, xrefs: 10008F0D
V, xrefs: 10009110
L, xrefs: 10008F5B
W, xrefs: 10008F29
f, xrefs: 1000900B
c, xrefs: 100090C9
O, xrefs: 10009004
s, xrefs: 10008F85
i, xrefs: 10008ECE
d, xrefs: 10008F70
s, xrefs: 100090AD
r, xrefs: 10008F06
o, xrefs: 10008F8C
s, xrefs: 10009020
R, xrefs: 1000909F
r, xrefs: 1000911E
e, xrefs: 1000915D
u, xrefs: 100090BB
t, xrefs: 10009125
o, xrefs: 10009027
c, xrefs: 10009091
r, xrefs: 10008F9A
c, xrefs: 1000903C
S, xrefs: 10008FE8
o, xrefs: 10008F62
e, xrefs: 100090D0
R, xrefs: 10008F77
t, xrefs: 10009156
o, xrefs: 10008EF8
R, xrefs: 10008EE3
c, xrefs: 10008FA1
i, xrefs: 10009117
d, xrefs: 10008EDC
i, xrefs: 10008FEF
t, xrefs: 1000916B
P, xrefs: 10009141

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID: F$L$L$O$P$R$R$R$R$S$V$W$W$a$a$c$c$c$c$c$c$d$d$e$e$e$e$e$e$e$e$e$e$f$i$i$i$k$l$n$o$o$o$o$o$o$o$r$r$r$r$r$r$s$s$s$s$t$t$t$u$u$u$u$u$z
API String ID: 0-1690915965
Opcode ID: 237a0294c867410668c6be68ed8def6ff7a22daae462c640e5da228ee526b748
Instruction ID: 64e35be62fb6c71b29353e5c92be894fa1f12e3b01f82c207c803d524760944f
Opcode Fuzzy Hash: 237a0294c867410668c6be68ed8def6ff7a22daae462c640e5da228ee526b748
Instruction Fuzzy Hash: FAB16551D0C6E889F7218238DC583DAAE755F63344F0841E9D58C6BAC2D6FF0BD88B66

Function 10004AF0 Relevance: 5.2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n, xrefs: 10004B6C
8, xrefs: 10004B4E
n, xrefs: 10004B62
x, xrefs: 10004B76

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID: 8$n$n$x
API String ID: 0-2129689772
Opcode ID: 8c66304b11ea0c84e9fdfed38884582853b311ea7bd2482fe712cbf6f2cbf85f
Instruction ID: 35744b8ad74132fc85c14de192ffcff4f894e20b8ba50814342bea8920fcbca8
Opcode Fuzzy Hash: 8c66304b11ea0c84e9fdfed38884582853b311ea7bd2482fe712cbf6f2cbf85f
Instruction Fuzzy Hash: 327117B3C151654EF728CA24DDD9BEABB78EB40304F1582FA980CA6994CB7D5BC58E40

Function 10004AFE Relevance: 5.2, Strings: 4, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n, xrefs: 10004B6C
8, xrefs: 10004B4E
n, xrefs: 10004B62
x, xrefs: 10004B76

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID: 8$n$n$x
API String ID: 0-2129689772
Opcode ID: ef4eccde671744d995a4ab770f20b217212e28e75211a46f20bba954c8aeada1
Instruction ID: 1708a07f3d32eb0b3824fa454a575a1da98c686d45cb37aedcd036f4a5d086ea
Opcode Fuzzy Hash: ef4eccde671744d995a4ab770f20b217212e28e75211a46f20bba954c8aeada1
Instruction Fuzzy Hash: 177128B3C151654EF728CA24DDD9BEABB78EB40304F1582FAD80CA6994CB7C5BC58E40

Function 10004B0E Relevance: 5.2, Strings: 4, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n, xrefs: 10004B6C
8, xrefs: 10004B4E
n, xrefs: 10004B62
x, xrefs: 10004B76

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID: 8$n$n$x
API String ID: 0-2129689772
Opcode ID: e26d81c37fed1924ef3b8291622dac5523c92c48e8dfddcf48cec5241f085be9
Instruction ID: 899ebf995cbae82982a7bcfcaa5a68b4f68ef4d76a3da38dfc42ea9d1c0af299
Opcode Fuzzy Hash: e26d81c37fed1924ef3b8291622dac5523c92c48e8dfddcf48cec5241f085be9
Instruction Fuzzy Hash: 457117B3C151654EF728CA24DD99BEABB78EB40304F1582FAD40CA6994CB7D5BC58E40

Function 10004B31 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

n, xrefs: 10004B6C
8, xrefs: 10004B4E
n, xrefs: 10004B62
x, xrefs: 10004B76

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID: 8$n$n$x
API String ID: 0-2129689772
Opcode ID: 4476ae88f9e95ed8e9ab37c9d815adcb35beb46f60690a0d679902d44ab62cb8
Instruction ID: b0019d7ec0d21c0c245fdcce9376dbde12676df9431491d68896285ce4d11f82
Opcode Fuzzy Hash: 4476ae88f9e95ed8e9ab37c9d815adcb35beb46f60690a0d679902d44ab62cb8
Instruction Fuzzy Hash: 9E7126B3C111654EF728CA24DDE9BEABBB8FB40304F1582FAD40CA6590C7795AC58E40

Function 100017BB Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27425a427855d85367f2beb9357f494d353f3f8c68508a95b6c1e39ac87f1510
Instruction ID: 96bf6c75d20a21ac7d85c8ee696d36d98939d41bf2f8dafadda3c10f311fb5fb
Opcode Fuzzy Hash: 27425a427855d85367f2beb9357f494d353f3f8c68508a95b6c1e39ac87f1510
Instruction Fuzzy Hash: 047159B3C111654FF328CA24DDE9BEABBB8EB51314F1542FAD80C9A590CB785BC59E40

Function 10001804 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c207c071d3f4b11fc4a7f485f13452618530adc706e31020537c5897804b0b8
Instruction ID: a531411251e9c9f9f1938813b136a9fbaa734d29cbabe50d580c6156fba38616
Opcode Fuzzy Hash: 0c207c071d3f4b11fc4a7f485f13452618530adc706e31020537c5897804b0b8
Instruction Fuzzy Hash: 906138B3C111654FE728CA24DDE9BEABB78EB50304F1582FAD80CA6994C77C5BC58E40

Function 10004B8D Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4985db3b75d90e53c6e73390aff720c654499e3da92204480db9d3431a518f7
Instruction ID: 4399798888c0acf036961fc3db9e123ec742bcff51dde410ee6c596a20fc0d2d
Opcode Fuzzy Hash: d4985db3b75d90e53c6e73390aff720c654499e3da92204480db9d3431a518f7
Instruction Fuzzy Hash: D96139B3C111654FE728CA24DDE9BEABB78FB50304F1582FAD80CA6990C7785BC58E40

Function 10004B98 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8974d3c08b7f45540831a6a41264c50593e8dfad3a32d6224e6d671de40661
Instruction ID: 21ef12e608502a73b20a5564f73183f0e290c0606c05f8ca96d6fc3806c294ef
Opcode Fuzzy Hash: cb8974d3c08b7f45540831a6a41264c50593e8dfad3a32d6224e6d671de40661
Instruction Fuzzy Hash: 576109B3C111654FE728CA28DDE9BEABB78EF51304F1542FAD80C96994C7785BC58E40

Function 10001784 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887d4bd602528231486f327ab4b4c63c71532f96d5588541d996eb57daea70c5
Instruction ID: 19d006473d24a36de827db3a35c4b74eee1fc2b9e986247e11d5f0e3455fd67c
Opcode Fuzzy Hash: 887d4bd602528231486f327ab4b4c63c71532f96d5588541d996eb57daea70c5
Instruction Fuzzy Hash: 266107B3D025164FF728CA24CD99BEEBBB9EB90304F0981FAC409565D4D27D5BC18E41

Function 10004F43 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929fff42f546745741f6dc4b28e9df9511061e32490890805a383d172ecab2df
Instruction ID: 2f9355a75177429d570a5f172c27c2cd1758944d1f0ea8f5008e820960a42343
Opcode Fuzzy Hash: 929fff42f546745741f6dc4b28e9df9511061e32490890805a383d172ecab2df
Instruction Fuzzy Hash: 5C51F5B3D525164FF728CA24CD99BEFBBB9EB90304F0981F9C409566D4D2796BC18E40

Function 1000521E Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31da281026773874b2059841d8cc34def98cd4108142027cb5198b9d5ab474ce
Instruction ID: c1e2bfba30146fccd8bf6278edf98b9ad473ac5a9b4253084f64226de6a98c70
Opcode Fuzzy Hash: 31da281026773874b2059841d8cc34def98cd4108142027cb5198b9d5ab474ce
Instruction Fuzzy Hash: D941C7B3E011544BF73CCA29DD99AEABB79EBD1304F0141FEE40D5A690D6792BC58E00

Function 100054A0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a988fbc158e3e6ddd0f54e6090c29adb6c2ade1f2806b80f6a709f82f2170c4
Instruction ID: 2d638bc4f0a15c783222dfb1eb70cee194a828a202fa7c84714dfdc63bafe6cb
Opcode Fuzzy Hash: 2a988fbc158e3e6ddd0f54e6090c29adb6c2ade1f2806b80f6a709f82f2170c4
Instruction Fuzzy Hash: 0941A6B6C406684FE738CB24DDD9AEAB7B5EB50300F1442FED80D96A54D6756FC58E00

Function 100054AB Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1858880490.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1858862792.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858880490.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1858994541.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859064901.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859086881.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859104194.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859123910.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859144258.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1859163921.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea08d8722255b52792c55171dbda7f1518ff512d593181ebffc8254b65f9d2eb
Instruction ID: c1ddc07029ef4e9c140907fa1a40554bc1daa40c68e5f929788f79f07801f8d0
Opcode Fuzzy Hash: ea08d8722255b52792c55171dbda7f1518ff512d593181ebffc8254b65f9d2eb
Instruction Fuzzy Hash: 354192B6C406688FE738CF24DDD9AEAB7B5EB50300F1442EED40DA6A94D6756BC1CE00

Analysis Process: rundll32.exePID: 7564, Parent PID: 7504COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	46
Total number of Limit Nodes:	0

Executed Functions

Function 10001358 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XP, xrefs: 10008B90

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: XP
API String ID: 544645111-2561422682
Opcode ID: 37702690e01c811405fad730707145e0b326d92e57730367b35f08c4d44932e0
Instruction ID: 611a6762f14b55aea5511db577eefdb0ac20b78f84cdf096a6eb86895a98922a
Opcode Fuzzy Hash: 37702690e01c811405fad730707145e0b326d92e57730367b35f08c4d44932e0
Instruction Fuzzy Hash: E141B1B1D042958BF764CA14DC94AEEBBB4FB81350F1445FAD889A7280DB385BC2CF11

Function 10008B7D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XP, xrefs: 10008B90

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID: XP
API String ID: 544645111-2561422682
Opcode ID: ea34c01b211c5b5aeb386a9f629e0103ef47ac8280f14558fa2cb1510652da17
Instruction ID: 9fe7c090af70a829392d2e3dd0dc4d125f2d6264c912b34b001928b877564150
Opcode Fuzzy Hash: ea34c01b211c5b5aeb386a9f629e0103ef47ac8280f14558fa2cb1510652da17
Instruction Fuzzy Hash: 2E41B3B1D042958BF764CA14DC94AEEBBB4FB81351F1445FAD889A7280DB385BC2CF51

Function 100088E5 Relevance: 1.7, APIs: 1, Instructions: 190
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,10008B7D,?,?), ref: 10008C6B

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f09b9a85c649f4156346158f34b6d6dec9454b537e54009a0950a0ab750368ff
Instruction ID: a58cbadcebaf1fb15d40fd1d273a569e5c7cbeacfae115c0c8c6e7fce1a4b34a
Opcode Fuzzy Hash: f09b9a85c649f4156346158f34b6d6dec9454b537e54009a0950a0ab750368ff
Instruction Fuzzy Hash: 0C911674A052698BEB24CB18CC90AEEB7B5FF85345F1481EAD888A7645DB346FC1CF41

Function 10008898 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a5c192a102c21aa4c71962cf714b8ecdfb5fc616cf5a1b6c62cb9b0eb9c5e9e9
Instruction ID: ee613b4e37b340d3dc2b3b2f7152747be1a662017f11d655da216d7fa73bef91
Opcode Fuzzy Hash: a5c192a102c21aa4c71962cf714b8ecdfb5fc616cf5a1b6c62cb9b0eb9c5e9e9
Instruction Fuzzy Hash: A741D5B5D042558BF724CA14DC94AEABBB9FB84310F1440F9D88D67240DB385BC2CF51

Function 100088BA Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 033d22dc57646c8bfee47c10602df6af31af338f8fb0bbded49fefd3ea9d6782
Instruction ID: 0260ad61eaae6c0e7b33091397af53ad9f8a6aa19526613c5235e9a0bbb394ff
Opcode Fuzzy Hash: 033d22dc57646c8bfee47c10602df6af31af338f8fb0bbded49fefd3ea9d6782
Instruction Fuzzy Hash: 3B41A375D042658BF760CA14DC95AEABBB9FB85350F1480FAD88CA7280DB385BC2CF51

Function 100084E5 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ce9433a9cd0873a8f9ebb8464afd3a66f385b63aa1df2b8ba2819b88ae900a46
Instruction ID: f0591f811cdcb7aadd8ffb48d0ceaf5db788c4e07c8e117eca818f826a0e4f08
Opcode Fuzzy Hash: ce9433a9cd0873a8f9ebb8464afd3a66f385b63aa1df2b8ba2819b88ae900a46
Instruction Fuzzy Hash: BB31A6B2D441559AF760CA14DC44AEB7B78FB85310F1541F6E88C97240DB385BC6CB62

Function 100084ED Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c035c18dfed2d51716e66ca40413ab05278cd7e64bf808d60742fe3a97c9f7ec
Instruction ID: 388b9e57ec8ef64c6d1315326e3cc2b25a16892a013fc780e664cf64172672dd
Opcode Fuzzy Hash: c035c18dfed2d51716e66ca40413ab05278cd7e64bf808d60742fe3a97c9f7ec
Instruction Fuzzy Hash: 7C31C5B2D041555AF760CA14DC84EEBBB79FB81310F1541F6D88CA7240DB386BC6CB62

Function 100080A5 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1838413329.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.1838357101.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838413329.0000000010110000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010119000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.000000001013D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1838868667.0000000010148000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840628796.0000000010149000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840725276.0000000010153000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840794728.0000000010154000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1840934022.000000001015D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841078626.000000001015F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010162000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101DE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.00000000101F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1841185598.0000000010226000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a330229bdc52a287c5f230264175908211db95fda7fc3c5d57a776f4416ceaeb
Instruction ID: d473adc397c26f8c8bd5239e59e118af5fedfaefe7c048f92b27b68c9a022d0c
Opcode Fuzzy Hash: a330229bdc52a287c5f230264175908211db95fda7fc3c5d57a776f4416ceaeb
Instruction Fuzzy Hash: CE31E9B2D042559AF764C614DC94AEBBB78FB45350F1441F9D88D53280DB385BC2CB51

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report msimg32.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 7504, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 7512, Parent PID: 7504

General

Chronological Activities

Analysis Process: cmd.exePID: 7556, Parent PID: 7504

Windows Analysis Report
msimg32.dll

Function 10001358 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115
COMMON

Function 10008B7D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113
COMMON

Function 100088E5 Relevance: 1.7, APIs: 1, Instructions: 190
memoryCOMMON

Function 10008898 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 100088BA Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Function 100084E5 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 100084ED Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 100080A5 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 10008EA3 Relevance: 82.7, Strings: 66, Instructions: 225
COMMON

Function 10004AF0 Relevance: 5.2, Strings: 4, Instructions: 202
COMMON

Function 10004AFE Relevance: 5.2, Strings: 4, Instructions: 200
COMMON

Function 10004B0E Relevance: 5.2, Strings: 4, Instructions: 198
COMMON

Function 10001358 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115
COMMON

Function 10008B7D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113
COMMON

Function 100088E5 Relevance: 1.7, APIs: 1, Instructions: 190
memoryCOMMON

Function 10008898 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 100088BA Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Function 100084E5 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 100084ED Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 100080A5 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON