Edit tour

Windows Analysis Report
antispam_account.exe

Overview

General Information

Sample name:	antispam_account.exe
Analysis ID:	1533406
MD5:	ceef2ab4f8f6993c358ea309f87a96f5
SHA1:	dccca05c9833b78dc75c7045e80056b35815ae93
SHA256:	d30cab7db9542e23b3371e20d16758d0930e9d021e67745f6c53fd88135b6873
Tags:	exeuser-Racco42
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

PE file contains sections with non-standard names

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

antispam_account.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\antispam_account.exe" MD5: CEEF2AB4F8F6993C358EA309F87A96F5)

conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: antispam_account.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.9% probability

Source: antispam_account.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\lfkmf\source\repos\AddMachineAccount\x64\Release\AddMachineAccount.pdb source: antispam_account.exe

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E49EAC4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00007FF69E49EAC4

Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E4910D0	0_2_00007FF69E4910D0
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E49734C	0_2_00007FF69E49734C
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E496F3C	0_2_00007FF69E496F3C
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E498098	0_2_00007FF69E498098
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E49E06C	0_2_00007FF69E49E06C
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E496928	0_2_00007FF69E496928
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E497148	0_2_00007FF69E497148
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E496D38	0_2_00007FF69E496D38
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E49D558	0_2_00007FF69E49D558
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E49B200	0_2_00007FF69E49B200
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E4A6A28	0_2_00007FF69E4A6A28
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E4A2620	0_2_00007FF69E4A2620
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E49D9EC	0_2_00007FF69E49D9EC
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E498A38	0_2_00007FF69E498A38
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E498E70	0_2_00007FF69E498E70
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E496B2C	0_2_00007FF69E496B2C
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E49EAC4	0_2_00007FF69E49EAC4
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E4A2ABC	0_2_00007FF69E4A2ABC

Source: classification engine

Classification label: mal52.winEXE@2/1@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_03

Source: antispam_account.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\antispam_account.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: antispam_account.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\antispam_account.exe "C:\Users\user\Desktop\antispam_account.exe"
Source: C:\Users\user\Desktop\antispam_account.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\antispam_account.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_account.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_account.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_account.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_account.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_account.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\antispam_account.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: antispam_account.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: antispam_account.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: antispam_account.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: antispam_account.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: antispam_account.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: antispam_account.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: antispam_account.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: antispam_account.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: antispam_account.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\lfkmf\source\repos\AddMachineAccount\x64\Release\AddMachineAccount.pdb source: antispam_account.exe

Source: antispam_account.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: antispam_account.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: antispam_account.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: antispam_account.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: antispam_account.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E4910D0 LoadLibraryA,GetProcAddress,DsGetDcNameW,CoInitializeEx,IIDFromString,IIDFromString,VariantInit,GetProcAddress,CharLowerW,NetApiBufferFree,CoUninitialize,

0_2_00007FF69E4910D0

Source: antispam_account.exe

Static PE information: section name: _RDATA

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E49EAC4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00007FF69E49EAC4

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E491F90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF69E491F90

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E4910D0 LoadLibraryA,GetProcAddress,DsGetDcNameW,CoInitializeEx,IIDFromString,IIDFromString,VariantInit,GetProcAddress,CharLowerW,NetApiBufferFree,CoUninitialize,

0_2_00007FF69E4910D0

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E4A0FF4 GetProcessHeap,

0_2_00007FF69E4A0FF4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E491F90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF69E491F90
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E49C06C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF69E49C06C
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E492134 SetUnhandledExceptionFilter,	0_2_00007FF69E492134
Source: C:\Users\user\Desktop\antispam_account.exe	Code function: 0_2_00007FF69E491AB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF69E491AB4

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E4A6870 cpuid

0_2_00007FF69E4A6870

Source: C:\Users\user\Desktop\antispam_account.exe

Code function: 0_2_00007FF69E491E70 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF69E491E70

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
antispam_account.exe	24%	ReversingLabs	Win64.Trojan.Generic

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533406
Start date and time:	2024-10-14 17:22:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	antispam_account.exe
Detection:	MAL
Classification:	mal52.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 11 Number of non-executed functions: 40
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: antispam_account.exe

Process:	C:\Users\user\Desktop\antispam_account.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.8062389286533893
Encrypted:	false
SSDEEP:	3:BOzReDRF6M+iFM3KL:U0Rl+iFnL
MD5:	F0681ECA3C959C32563A58507B635587
SHA1:	E4761D465B8B9A917C2A343A8DC8D99668DB10CB
SHA-256:	9B811EC037ACC225656AEF2EBE45028FEAC63CAF4C2F55CAC5D5641C9BD6A8D0
SHA-512:	00BF6E14094A685505ED184597B095C67D97D412B6E8A0FC125CF4425E731123F1F41C9D388507A0A121D2E69ED45A1C222E4E7295A2007B809D37884326D011
Malicious:	false
Reputation:	low
Preview:	Failed to get domain/dns info.

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.209371083393372
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	antispam_account.exe
File size:	152'064 bytes
MD5:	ceef2ab4f8f6993c358ea309f87a96f5
SHA1:	dccca05c9833b78dc75c7045e80056b35815ae93
SHA256:	d30cab7db9542e23b3371e20d16758d0930e9d021e67745f6c53fd88135b6873
SHA512:	7004b759de8f31064cd8dca8b056b351c852a43bf5f42cc335984cbd7fc5127515535db603dca18edf7eedc2215e278f2650d3c853e29e488d9d2e46420d1cda
SSDEEP:	3072:i6RB21BKUFhj8g38ynuIXbRBaW/Cfs9a9xNaRl:Z21BKUFhognPXbzrCX9TIl
TLSH:	ADE36C0773E531F9E1778278C9615956EB72B8320720EB9F07A452762F232C19E3EB61
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........h.G...G...G.......B...............M...G...F....q..o....q..W....q..V.......L...G...%....r..F....r..F....r..F...RichG..........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001aa0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F9226F [Sun Sep 29 09:48:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	369e408dda3fe749f300537480ac9648

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7574BEE15Ch
dec eax
add esp, 28h
jmp 00007F7574BEDC07h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000175BBh]
dec eax
mov ecx, ebx
call dword ptr [000175AAh]
call dword ptr [000175B4h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000175A8h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001759Ch]
test eax, eax
je 00007F7574BEDD99h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00023072h]
call 00007F7574BEDE3Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00023159h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [000230E9h], eax
dec eax
mov eax, dword ptr [00023142h]
dec eax
mov dword ptr [00022FB3h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000230B7h], eax
mov dword ptr [00022F8Dh], C0000409h
mov dword ptr [00022F87h], 00000001h
mov dword ptr [00022F91h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x234d4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x29000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x26000	0x1374	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a000	0x67c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x219d0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x21890	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17190	0x17200	aa847e1a68f5ed040937a40cb4a72d35	False	0.5508657094594595	data	6.513984672774974	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0xae12	0xb000	14edd490b7752bedc3e7ca846a995eca	False	0.4627352627840909	data	4.973559381618019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x24000	0x1db0	0xc00	51a272b09c454fa33bdfd82ee498eb2d	False	0.13899739583333334	data	1.9245535089736694	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x26000	0x1374	0x1400	79eb0578d84bc30e6e05e13676033e50	False	0.4736328125	PEX Binary Archive	5.044588799850373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x28000	0x1f4	0x200	09997816be71bf515d5cfa9120306593	False	0.515625	data	3.6758072665844157	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x29000	0x1e0	0x200	7062a687748df9836bb994cee16a170a	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2a000	0x67c	0x800	9802de97d35cad1973a2df190f56cc3c	False	0.51611328125	data	4.91912831966337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x29060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	LoadLibraryA, GetProcAddress, WriteConsoleW, CreateFileW, CloseHandle, HeapReAlloc, HeapSize, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwindEx, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, EncodePointer, RaiseException, RtlPcToFileHeader, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetProcessHeap
USER32.dll	CharLowerW
ole32.dll	CoUninitialize, IIDFromString, CoInitializeEx
OLEAUT32.dll	VariantInit
NETAPI32.dll	DsGetDcNameW, NetApiBufferFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	11:23:01
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\antispam_account.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\antispam_account.exe"
Imagebase:	0x7ff69e490000
File size:	152'064 bytes
MD5 hash:	CEEF2AB4F8F6993C358EA309F87A96F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:23:01
Start date:	14/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10%
Total number of Nodes:	1204
Total number of Limit Nodes:	21

Executed Functions

Function 00007FF69E4910D0 Relevance: 68.6, APIs: 11, Strings: 28, Instructions: 361
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF69E491138
GetProcAddress.KERNEL32 ref: 00007FF69E49114B
DsGetDcNameW.NETAPI32 ref: 00007FF69E49117A
CoInitializeEx.OLE32 ref: 00007FF69E4911A1
IIDFromString.OLE32 ref: 00007FF69E4911BE
IIDFromString.OLE32 ref: 00007FF69E4911CF
NetApiBufferFree.NETAPI32 ref: 00007FF69E491788
CoUninitialize.OLE32 ref: 00007FF69E4917CD

Strings

CN=, xrefs: 00007FF69E4916F1
{E798DE2C-22E4-11D0-84FE-00C04FD8D503}, xrefs: 00007FF69E4911C8
defaultNamingContext, xrefs: 00007FF69E491228
Failed to get domain/dns info., xrefs: 00007FF69E491184
{FD8256D0-FD15-11CE-ABC4-02608C9E7553}, xrefs: 00007FF69E4911B7
ADsGetLastError, xrefs: 00007FF69E4912BC
ADsOpenObject failed. %i, xrefs: 00007FF69E4912F1
objectClass, xrefs: 00007FF69E49133D
servicePrincipalName, xrefs: 00007FF69E4915EC
unicodePwd, xrefs: 00007FF69E4916CC
Cleanup, xrefs: 00007FF69E491772
Error Code: %d Error Text: %ws Provider: %ws, xrefs: 00007FF69E49130E
sAMAccountName, xrefs: 00007FF69E4913B7
RestrictedKrbHost/, xrefs: 00007FF69E4914F5, 00007FF69E491551
dNSHostName, xrefs: 00007FF69E49148A
LDAP://rootDSE, xrefs: 00007FF69E4911E5
LDAP://CN=Computers,, xrefs: 00007FF69E491263
[+] Machine account %ls$ created with password: %ls , xrefs: 00007FF69E491766
HOST/, xrefs: 00007FF69E4914C5, 00007FF69E491525
Activeds.dll, xrefs: 00007FF69E491122
userAccountControl, xrefs: 00007FF69E4913E0
Failed to get defaultNamingContext., xrefs: 00007FF69E491239
GCmtHzw8uI$JnJB, xrefs: 00007FF69E49162E
SRVVSSKL, xrefs: 00007FF69E491106
ADsOpenObject, xrefs: 00007FF69E491141
Failed to create Computer object., xrefs: 00007FF69E491749
Computer, xrefs: 00007FF69E491324
Failed to get rootDSE., xrefs: 00007FF69E491202

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: FromString$AddressBufferFreeInitializeLibraryLoadNameProcUninitialize
String ID: ADsGetLastError$ADsOpenObject$ADsOpenObject failed. %i$Activeds.dll$CN=$Cleanup$Computer$Error Code: %d Error Text: %ws Provider: %ws$Failed to create Computer object.$Failed to get defaultNamingContext.$Failed to get domain/dns info.$Failed to get rootDSE.$GCmtHzw8uI$JnJB$HOST/$LDAP://CN=Computers,$LDAP://rootDSE$RestrictedKrbHost/$SRVVSSKL$[+] Machine account %ls$ created with password: %ls $dNSHostName$defaultNamingContext$objectClass$sAMAccountName$servicePrincipalName$unicodePwd$userAccountControl${E798DE2C-22E4-11D0-84FE-00C04FD8D503}${FD8256D0-FD15-11CE-ABC4-02608C9E7553}
API String ID: 2369814104-2916989051
Opcode ID: 19e617eec08ad8a9770e4212ce4c1261ccb40c5330b1ce0025d98db86c65fd1a
Instruction ID: db3e04512ff60dc9e036e1f5ee21b1c0376f27ca6454c048c677134b48e3bf58
Opcode Fuzzy Hash: 19e617eec08ad8a9770e4212ce4c1261ccb40c5330b1ce0025d98db86c65fd1a
Instruction Fuzzy Hash: 2B125E36A18A8399EB30CF60D8903ED3364FB54B98F904172EA4D97B99DF39D249C750

Function 00007FF69E49C500 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF69E49C856,?,?,00000003,00007FF69E495BF1), ref: 00007FF69E49C67C
GetProcAddress.KERNEL32(?,?,?,00007FF69E49C856,?,?,00000003,00007FF69E495BF1), ref: 00007FF69E49C688

Strings

api-ms-, xrefs: 00007FF69E49C5C6
ext-ms-, xrefs: 00007FF69E49C5D9

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 491068c7b5cbaab168200220cb32f14bdda44b8c13364c7e6ba561cb6432f9fb
Instruction ID: 4706f0c6be83524de0d934760ae853a13a9b495c0a8c119fad75a4f610c53a0a
Opcode Fuzzy Hash: 491068c7b5cbaab168200220cb32f14bdda44b8c13364c7e6ba561cb6432f9fb
Instruction Fuzzy Hash: EC412532B59A1341FA31CB16AA905B92391FFA9FE0F485175ED0DE7794EE3CE8058320

Function 00007FF69E4A2134 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF69E4A211F), ref: 00007FF69E4A2250
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF69E4A211F), ref: 00007FF69E4A22DB

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 36ebb8f8e2cfc4ff7e6c149da52c35b986b5250e86e960e34211276686a744d9
Instruction ID: 78f874d87ac76a46eaac51a9188a873d3ac40ccb2496ed4bd0b15709eefaf1f3
Opcode Fuzzy Hash: 36ebb8f8e2cfc4ff7e6c149da52c35b986b5250e86e960e34211276686a744d9
Instruction Fuzzy Hash: 9291D272E4865385FB708F6595C02BD2BA1EB69FB8F144179EE0E96684CF3CE481D324

Function 00007FF69E49AE74 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF69E49AE70), ref: 00007FF69E49AE85
TerminateProcess.KERNEL32(?,?,?,00007FF69E49AE70), ref: 00007FF69E49AE90
ExitProcess.KERNEL32 ref: 00007FF69E49AE9F

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 87aed8f10c6c6000dddaa58b7c6a882458171bf13033028fc21bbebc0850734e
Instruction ID: ef62eea59a3e817e41086988933113dd44bb3169aa840c3fdae9699d03824e27
Opcode Fuzzy Hash: 87aed8f10c6c6000dddaa58b7c6a882458171bf13033028fc21bbebc0850734e
Instruction Fuzzy Hash: 6BD06718B8860742EE746B7069D51792221DFA8F61B0154BCE91F96392DE2CA8499320

Function 00007FF69E491924 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E491C6C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69E491C80

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF69E49194D
__scrt_release_startup_lock.LIBCMT ref: 00007FF69E4919BB

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: ca167642192989a24d6340a96912226d03e942e6197ae367f1b2e418f3afb6b6
Instruction ID: 0f3815b76e2c36bd7f10d289e8ce3905448702c107846b8e403c3341861ebe37
Opcode Fuzzy Hash: ca167642192989a24d6340a96912226d03e942e6197ae367f1b2e418f3afb6b6
Instruction Fuzzy Hash: 40313A21E0864341FA34AB24A6D53B92391EF65F84F4545B4FA4DAB7DBDE2DE804C360

Function 00007FF69E4A1C84 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF69E4A1D37
GetLastError.KERNEL32 ref: 00007FF69E4A1D53

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 9b55fa9029197f70d8b37b6f0eb019ef2f42f51b284c92a3100e8322c962e09a
Instruction ID: db9344bf8e643ac581f86ef08d182d57e1d24c60ae74188108a7500ae80c5008
Opcode Fuzzy Hash: 9b55fa9029197f70d8b37b6f0eb019ef2f42f51b284c92a3100e8322c962e09a
Instruction Fuzzy Hash: 1C31D472A18A8286DB209F15E4802A97764FB68BA0F444072FB8EC7754DF3CE415C710

Function 00007FF69E49CF74 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF69E49CFED
GetFileType.KERNELBASE ref: 00007FF69E49D003

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: daa558b90cd69e4353a4188e09a708de5ea0f2d8865c0f75e7af0dad4205ff83
Instruction ID: b3f39a2b6c62edf33619d541e7f4b5e4aa8edcb223c5d84ba290c1d4f0d6ae03
Opcode Fuzzy Hash: daa558b90cd69e4353a4188e09a708de5ea0f2d8865c0f75e7af0dad4205ff83
Instruction Fuzzy Hash: BD318121A18B4681EB708F2596C42786650FB55FB4F680779EB6E973E4CF38E491C310

Function 00007FF69E491840 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_fmode.LIBCMT ref: 00007FF69E491857
_RTC_Initialize.LIBCMT ref: 00007FF69E491878

Part of subcall function 00007FF69E49A6FC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E49A72E

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 4702971cb94d821ecca20033a5084f20197d8a2ad3a1f3cc590cb54ff7f46001
Instruction ID: 5c2dfa7785cc1d408ddc7617b65c23a9f94cd2641e943a89ed1f2b17f0b95faf
Opcode Fuzzy Hash: 4702971cb94d821ecca20033a5084f20197d8a2ad3a1f3cc590cb54ff7f46001
Instruction Fuzzy Hash: FB114615E0820B45FA38BAB15ACA2B91194CF64F44F4604F4F61DFA2CBEE2CB8416376

Function 00007FF69E49FD84 Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF69E49A89E,?,?,?,00007FF69E49ABF2,?,?,?,?,00007FF69E491A13), ref: 00007FF69E49FD98
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF69E49A89E,?,?,?,00007FF69E49ABF2,?,?,?,?,00007FF69E491A13), ref: 00007FF69E49FE02

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: db970735c3359340a709ec3c5fbc5f26761b619722ac337746b7fdd4a290abb3
Instruction ID: 564c574c2f581cbbf6f240aca1e3758347c62b18173ca51650e5787e321e723d
Opcode Fuzzy Hash: db970735c3359340a709ec3c5fbc5f26761b619722ac337746b7fdd4a290abb3
Instruction Fuzzy Hash: B301E512F58B5341EE309F1665840796360EF64FF0B584670EF6E677C6DE2CE4428320

Function 00007FF69E49ADA5 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69E49ADD3

Part of subcall function 00007FF69E49AECC: GetModuleHandleExW.KERNEL32 ref: 00007FF69E49AEF1
Part of subcall function 00007FF69E49AECC: GetProcAddress.KERNEL32 ref: 00007FF69E49AF07
Part of subcall function 00007FF69E49AECC: FreeLibrary.KERNEL32 ref: 00007FF69E49AF2E

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 114a91c9eb3997d96d96b89e66a5f704b68acc46b5da7cfbcbf35f884bfc2da3
Instruction ID: ef3b3fc8281aebde1b197d7e6ea24854dc599ce39abfef1d673fafa711a7946b
Opcode Fuzzy Hash: 114a91c9eb3997d96d96b89e66a5f704b68acc46b5da7cfbcbf35f884bfc2da3
Instruction Fuzzy Hash: CC217C3AA04A028AEF348F74C4886EC33A0EB54F18F050676E61DA7AC5DF38D495C760

Function 00007FF69E491C6C Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69E491C80

Part of subcall function 00007FF69E492610: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF69E492618
Part of subcall function 00007FF69E492610: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF69E49261D

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: ec2570cafee743dcb2ab4d8c5ed2c8d6037c73c528d06cddfe88c48b82e924c5
Instruction ID: f3e564e358200f8581fe35a8a3e0bb569bcd13d8ba625a577505693e01790d92
Opcode Fuzzy Hash: ec2570cafee743dcb2ab4d8c5ed2c8d6037c73c528d06cddfe88c48b82e924c5
Instruction Fuzzy Hash: 56E0EC10D0D11340FE792A6127D22B802409F76F04F5100F9F94EF22D39D0E750653B6

Non-executed Functions

Function 00007FF69E4A2ABC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF69E4A2B0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E4A3176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E4A32EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E4A35AA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E4A37CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E4A3A07
memcpy_s.LIBCPMT ref: 00007FF69E4A3AE2
memcpy_s.LIBCPMT ref: 00007FF69E4A3B8D
memcpy_s.LIBCPMT ref: 00007FF69E4A3C5C

Strings

1#IND, xrefs: 00007FF69E4A2BF7
1#INF, xrefs: 00007FF69E4A2C33
1#QNAN, xrefs: 00007FF69E4A2C23
1#SNAN, xrefs: 00007FF69E4A2C1A

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: c5413e8b85f3f62e1b5e3c442f5b6e8201814dd53347c4e9641f5da6d242fb16
Instruction ID: 4e68483897b40a8790fe9446726c69beb643e6a047956d12be2a4a2d09b1d662
Opcode Fuzzy Hash: c5413e8b85f3f62e1b5e3c442f5b6e8201814dd53347c4e9641f5da6d242fb16
Instruction Fuzzy Hash: 44B2F372E582838BE7348E64D5807FD77A1FB64BA8F405175EA0D97A85EF38E900CB50

Function 00007FF69E491F90 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF69E491FAC
RtlCaptureContext.KERNEL32 ref: 00007FF69E491FD9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69E491FF3
RtlVirtualUnwind.KERNEL32 ref: 00007FF69E492034
IsDebuggerPresent.KERNEL32 ref: 00007FF69E492088
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69E4920A5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69E4920B0

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: bed88b21f03ced8f03b229f060e7a7e7857f38ae682025ac13353ea6e571365a
Instruction ID: bfcef84cc3ed062aac14081056bf0074d057e1d1a1c07821d2cb15eee3704874
Opcode Fuzzy Hash: bed88b21f03ced8f03b229f060e7a7e7857f38ae682025ac13353ea6e571365a
Instruction Fuzzy Hash: 40313072609B8286EB748F60E8807EE7364FB94B54F444479EB4E97B98DF38D548C720

Function 00007FF69E49C06C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF69E49C0E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69E49C0FD
RtlVirtualUnwind.KERNEL32 ref: 00007FF69E49C138
IsDebuggerPresent.KERNEL32 ref: 00007FF69E49C171
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69E49C17B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69E49C186

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 96b4b85298df9a7c94fc0ed32a4ff3fc3a8f8d2a756f0329476b0c0d7f2ce9a1
Instruction ID: af2ac05f753cf2a5113c670a24294c56f483caafbd94507a1351dbd23ed05b12
Opcode Fuzzy Hash: 96b4b85298df9a7c94fc0ed32a4ff3fc3a8f8d2a756f0329476b0c0d7f2ce9a1
Instruction Fuzzy Hash: E7316132658B8286EB70CF25E8802AE73A4FB94BA4F540175EB8D93B94DF3CD555CB10

Function 00007FF69E49EAC4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E49EB10
FindFirstFileExW.KERNEL32 ref: 00007FF69E49EC1A

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ba11f07c1f722e6a40a18cc6528af4eedad9e4f8f0aafa614391c8f36644ff59
Instruction ID: ef2a6b0246100c614aedf5011f215451a52d028db7ad57770eaf609c40c8103e
Opcode Fuzzy Hash: ba11f07c1f722e6a40a18cc6528af4eedad9e4f8f0aafa614391c8f36644ff59
Instruction Fuzzy Hash: 7BB1B622B1869341EE70DB2296842B96391EB64FE4F545272FA5DA7BC5DF3CE441C320

Function 00007FF69E491E70 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF69E491E9C
GetCurrentThreadId.KERNEL32 ref: 00007FF69E491EAA
GetCurrentProcessId.KERNEL32 ref: 00007FF69E491EB6
QueryPerformanceCounter.KERNEL32 ref: 00007FF69E491EC6

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a0b89811d2abefea6c0b216da11c3ecfe6413ee332165bab6c2f463ce680ac48
Instruction ID: 5a9682751f3c02617663a00bebb9fc1726e927a2cfa86f4745ba49d01bb216e5
Opcode Fuzzy Hash: a0b89811d2abefea6c0b216da11c3ecfe6413ee332165bab6c2f463ce680ac48
Instruction Fuzzy Hash: E4112122B54F0689EF10CF60F8942B933A4FB29B68F440E31EA5D86764DF78D5548390

Function 00007FF69E4A2620 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF69E4A2686
memcpy_s.LIBCPMT ref: 00007FF69E4A26B1

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 87e41b6fee5b2c220665e30f61e00f9c9c3ae2682d117da1368843bc324cf7e9
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: B6C1F672B5828787E7348F55A18466AB791F7A8FA4F448134EB4A83B84DF3CE901DB04

Function 00007FF69E4A6A28 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF69E4A6C77
RaiseException.KERNEL32 ref: 00007FF69E4A6C88

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 42800f7130fc09e1b5b148043ea866075d2b5c80eb62d1f6a2eafbe5d3518a0d
Instruction ID: e1d488c67fc6285906645cd88b8cb7f18df5c189506876d010d395c767bfc973
Opcode Fuzzy Hash: 42800f7130fc09e1b5b148043ea866075d2b5c80eb62d1f6a2eafbe5d3518a0d
Instruction Fuzzy Hash: DCB15E73604B898BEB25CF29C48636837A0F754FA8F1589B1EA5D8B7A4CF39D451C710

Function 00007FF69E49D9EC Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF69E49DAF9
gfff, xrefs: 00007FF69E49DB76

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: d1e6dff7fef3bdb59747c01a8fb3bbc0b4806479f45d7012dcbbb5270c54b796
Instruction ID: 4d1541c9473d4cdfe72c42537fed6814e177c533c89b9f694a00255e5b3d21cd
Opcode Fuzzy Hash: d1e6dff7fef3bdb59747c01a8fb3bbc0b4806479f45d7012dcbbb5270c54b796
Instruction Fuzzy Hash: 2F516962B1C2C346E7348E359E807697B91E7A4FA4F08C2B1EB988BAC5CF7DD4408710

Function 00007FF69E49D558 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF69E49D89A

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 91725199b9ae0a4c4f7012fb6020ed17a538c55d02ec2f85fc7811ec0ab5c42b
Instruction ID: 52eda47ff42e5f04a0d673bdf45ebaaa5c844837483cdee59170d1d4fe1e467b
Opcode Fuzzy Hash: 91725199b9ae0a4c4f7012fb6020ed17a538c55d02ec2f85fc7811ec0ab5c42b
Instruction Fuzzy Hash: 79A15862B087C686EB31CF29A9807AD7791EBA0F84F048171EE4D97785DE3DE405C711

Function 00007FF69E498098 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

, xrefs: 00007FF69E4982A2

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f58e7d2fba646c9d56e368a4f66ee4e796840259c2c138df35e78770f08e093e
Instruction ID: 08649992bb13617fd0f3551c278fae9cce2f2ad0b8b0825295b210c7a1122f06
Opcode Fuzzy Hash: f58e7d2fba646c9d56e368a4f66ee4e796840259c2c138df35e78770f08e093e
Instruction Fuzzy Hash: 2EB17F72A08A8395E7748F39C29427D3BA0EB69F48F184175EB4DA7795CF3AD440C722

Function 00007FF69E4A0FF4 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF69E4A0FF8

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 713265200b0f8676a1dac90bda99ea801f41fb4e271d729f4c08ea7d931f899d
Instruction ID: cc6b158d1f1765e2e4e8877dad01b8ad2a16783031560b2d027a696466f8d738
Opcode Fuzzy Hash: 713265200b0f8676a1dac90bda99ea801f41fb4e271d729f4c08ea7d931f899d
Instruction Fuzzy Hash: FAB09220E57A43C2EE992B117C8621823AABFA8B20F8885B8D10C81320DF2C20A58720

Function 00007FF69E498E70 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f2a61b33c2f5a9ff6fbf6eeeca1a1374fd0aaa3bccda5e65ef6e81077c1321
Instruction ID: ceeb0d4aac0545e5a047d82a422663c72bd8a562732355cf5f3b133ee7fb04f7
Opcode Fuzzy Hash: 12f2a61b33c2f5a9ff6fbf6eeeca1a1374fd0aaa3bccda5e65ef6e81077c1321
Instruction Fuzzy Hash: 78E19026A0824346EA788E29C2C413D37A2FB69F54F1451B5EF0DA77D9DF39E841C361

Function 00007FF69E498A38 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c052bf87743b0a4e9054d2403e673aa66a68402ee0a2fcaabadde92108fa48
Instruction ID: 1f9c188ee5bed636b0318d2fe64f9114954a3ed4e05f1a9d315b1c53d6e7c09c
Opcode Fuzzy Hash: 36c052bf87743b0a4e9054d2403e673aa66a68402ee0a2fcaabadde92108fa48
Instruction Fuzzy Hash: 08E1B472A0860395EB748A2CC2D537D2791EB69F54F1842B5FA0DA76D5CF3DE841C322

Function 00007FF69E49E06C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1f9992ca2b83fa0573aa7d428d943340b4a4b5419fb6f58666c6258925b0df
Instruction ID: 50b4ad72033417c2d1ca4a91b85c9993a41c2a4fcb3b40b0931f6266eb824a1e
Opcode Fuzzy Hash: ce1f9992ca2b83fa0573aa7d428d943340b4a4b5419fb6f58666c6258925b0df
Instruction Fuzzy Hash: DC811572A0C78286E774CB1996C137A6BD1FBA5F94F244275EA8D93B85CE3DE4008B10

Function 00007FF69E49734C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cd060b253cf035043fe50bbacb27ae17bc61c6d97ae5104e189b82c940c127
Instruction ID: e14050cf5601d2e484205fc83864b6a47dbc37d2d876d9396c2db5005917e05c
Opcode Fuzzy Hash: 69cd060b253cf035043fe50bbacb27ae17bc61c6d97ae5104e189b82c940c127
Instruction Fuzzy Hash: E551B832A1865382E7348F29C18923C37A0EB64F68F245171EE4DA7795DF3AE863C750

Function 00007FF69E496F3C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ff9c10f62d1b47ef5905391948ce9eac555b03b98ab0e7aa44716a88f8c3e2
Instruction ID: 79eaa2561fc26ca741fefef421204c3b497b86ad7d667d0aa6d560a9c956ab75
Opcode Fuzzy Hash: 43ff9c10f62d1b47ef5905391948ce9eac555b03b98ab0e7aa44716a88f8c3e2
Instruction Fuzzy Hash: 30518732A1865386E7348F29C19423837A1EB64FACF2441B1EE4DA7794DF3AE853C750

Function 00007FF69E496B2C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf95b503110b43d35bbcf95d68fe8087ba49051afeab174971cb0c306ff8024
Instruction ID: b47e25dbf1c2e7b31f9d91b1c66568b6b1d22fcabe11b196f314a88ae5d81df1
Opcode Fuzzy Hash: 1cf95b503110b43d35bbcf95d68fe8087ba49051afeab174971cb0c306ff8024
Instruction Fuzzy Hash: D4519B36A1465385E7348B29C19433837A0EB65FA8F2441B1EE4DAB794DF3AEC53C750

Function 00007FF69E496928 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712813fa3cdb594f0eb308bf8fb59a66a1630518c2f72753db9bc1e6f3e268fe
Instruction ID: ff89742e056e1ca6224b36ef3b4501dd524e2772b472267c0572fdaaea34f289
Opcode Fuzzy Hash: 712813fa3cdb594f0eb308bf8fb59a66a1630518c2f72753db9bc1e6f3e268fe
Instruction Fuzzy Hash: 5451CA72A1865286E7348F28C28473937A0EB55F98F2481B1DE4DAB794DF3AEC53C750

Function 00007FF69E497148 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273b73d5fb63701c19bb0bf1e59182d66848a0a0ab3d7cf47da5e148ab485331
Instruction ID: 43de5d1d099350413884b64303290cfd3b39190171a26e239dcb54594fdb7e89
Opcode Fuzzy Hash: 273b73d5fb63701c19bb0bf1e59182d66848a0a0ab3d7cf47da5e148ab485331
Instruction Fuzzy Hash: 7751BA36A1865386E7348B29C18973C37A0EB64F58F284171EE4DA7794DF3AE863C750

Function 00007FF69E496D38 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111b9a4e2f0511636ba9a42a30838a4c974f5a45ebe7d12396d731be4333c2c6
Instruction ID: f7e39f526b0fab456b18c2ad3ae176fd28fb89abe73425644597b0a1fa7815f7
Opcode Fuzzy Hash: 111b9a4e2f0511636ba9a42a30838a4c974f5a45ebe7d12396d731be4333c2c6
Instruction Fuzzy Hash: 2151AE7661465286EB748F29C28423837A0EB55F98F2541B1EE4CAB794CF3AEC52C750

Function 00007FF69E49B200 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 91e9a8959a486d16915ec3edadb5a2c8260f1535164ba97195848b35bf58a076
Instruction ID: 31436cf0e95f72e0ab83e5948a02ad1e38f095a2ce79d5a09fa848daf9bb604d
Opcode Fuzzy Hash: 91e9a8959a486d16915ec3edadb5a2c8260f1535164ba97195848b35bf58a076
Instruction Fuzzy Hash: 9741D862B14A5681EF24CF2AEAA416D7391FB58FD4B099036EE0DD7B58EF3CD4418344

Function 00007FF69E4A6870 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06765e3e769664596c98c1387e2f6e4fe9174840ac955173aff2e886965b2cc6
Instruction ID: 108500ec7ce70ea7109ab31006eaf556ef02dcb3dc41e196a314294a6ec3a338
Opcode Fuzzy Hash: 06765e3e769664596c98c1387e2f6e4fe9174840ac955173aff2e886965b2cc6
Instruction Fuzzy Hash: 59F06871B382968FDBA48F28A48262D77D5FB58780F94C579E58DC3B14DA3CD0509F14

Function 00007FF69E492134 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ca1d6a6832c669e6a29bba7dd95473a6ef9a4e19f238a5e2e873b8f2e182c5
Instruction ID: d1b3f74fe58db3360618b719b65f96dbc956eaa03cda52ce1e30ef3ccaf0c2d6
Opcode Fuzzy Hash: 39ca1d6a6832c669e6a29bba7dd95473a6ef9a4e19f238a5e2e873b8f2e182c5
Instruction Fuzzy Hash: F6A00121A4CC0390EA2C8F00BA911602230EBA4B60B4140B1E20DD10609E3CA514C328

Function 00007FF69E4961B0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E4961F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E4965B8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E496857

Strings

f, xrefs: 00007FF69E49643D
p, xrefs: 00007FF69E4962FA
f, xrefs: 00007FF69E4962F2
f, xrefs: 00007FF69E496288
p, xrefs: 00007FF69E496295

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 12d08c0c8612637774bc7bdd463a756b07fcc01c14ea46ebeb92567cf731375d
Instruction ID: 07f2536c6fefc2001da7600500e117cb57e00e33cffc5c1641a972aeeb896509
Opcode Fuzzy Hash: 12d08c0c8612637774bc7bdd463a756b07fcc01c14ea46ebeb92567cf731375d
Instruction Fuzzy Hash: 6E129771E0D14386FB349E15E2946797652FBA0FD4F8440F5F69A9A9C8DF3CE8808B20

Function 00007FF69E493790 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF69E4937EC

Part of subcall function 00007FF69E494734: __GetUnwindTryBlock.LIBCMT ref: 00007FF69E494777
Part of subcall function 00007FF69E494734: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF69E49479C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF69E4938C4
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF69E493B13
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E493C1F

Strings

csm, xrefs: 00007FF69E4938E7
csm, xrefs: 00007FF69E493806
csm, xrefs: 00007FF69E49386D

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9d2ab68f5844ecff8e78b121d5f9961d0fc8fa477ccde89421ed0d873669c760
Instruction ID: 4e4c51fa231708ec5012d801349ce30bb6fd177ce65779d27d6a1ecc168f612c
Opcode Fuzzy Hash: 9d2ab68f5844ecff8e78b121d5f9961d0fc8fa477ccde89421ed0d873669c760
Instruction Fuzzy Hash: 45D15032E0874686EB30DB6595802AD77A4FB66F98F000275FE4DA7B56DF38E450CB50

Function 00007FF69E492A44 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF69E492CF6,?,?,?,00007FF69E4929E8,?,?,?,00007FF69E4925F1), ref: 00007FF69E492AC9
GetLastError.KERNEL32(?,?,?,00007FF69E492CF6,?,?,?,00007FF69E4929E8,?,?,?,00007FF69E4925F1), ref: 00007FF69E492AD7
LoadLibraryExW.KERNEL32(?,?,?,00007FF69E492CF6,?,?,?,00007FF69E4929E8,?,?,?,00007FF69E4925F1), ref: 00007FF69E492B01
FreeLibrary.KERNEL32(?,?,?,00007FF69E492CF6,?,?,?,00007FF69E4929E8,?,?,?,00007FF69E4925F1), ref: 00007FF69E492B6F
GetProcAddress.KERNEL32(?,?,?,00007FF69E492CF6,?,?,?,00007FF69E4929E8,?,?,?,00007FF69E4925F1), ref: 00007FF69E492B7B

Strings

api-ms-, xrefs: 00007FF69E492AE9

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: cbbaaf9238a7b28753c96f16f4876fbf0f394f578af9b213cce3bfd2c1307ae4
Instruction ID: c01654bcb5e93e773a1828b016453c2bfd402078b4c382e8b6fccd7dfb1ada53
Opcode Fuzzy Hash: cbbaaf9238a7b28753c96f16f4876fbf0f394f578af9b213cce3bfd2c1307ae4
Instruction Fuzzy Hash: C2317021A1AA4391EE369F02B98057523D8FF68FA0F590575EE1D9A794DE3CE444C324

Function 00007FF69E49BC54 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69E49BC63
FlsGetValue.KERNEL32 ref: 00007FF69E49BC78
FlsSetValue.KERNEL32 ref: 00007FF69E49BC99
FlsSetValue.KERNEL32 ref: 00007FF69E49BCC6
FlsSetValue.KERNEL32 ref: 00007FF69E49BCD7
FlsSetValue.KERNEL32 ref: 00007FF69E49BCE8
SetLastError.KERNEL32 ref: 00007FF69E49BD03

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ba8e99addf97a3e009db974f25feb7acb3a06d1c3b8078238f1e2f9ace8986bd
Instruction ID: d5c02c12f11825febc04ff783ed4c54664e741ae3322ec54fd2f215d693c842b
Opcode Fuzzy Hash: ba8e99addf97a3e009db974f25feb7acb3a06d1c3b8078238f1e2f9ace8986bd
Instruction Fuzzy Hash: 43213A20E4C64342FA74A76167C507D5192EF74FB0F1447B8F92EA76D6DE2CB4024364

Function 00007FF69E4A622C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF69E4A625D
GetLastError.KERNEL32 ref: 00007FF69E4A6269
CloseHandle.KERNEL32 ref: 00007FF69E4A6281
CreateFileW.KERNEL32 ref: 00007FF69E4A62AC
WriteConsoleW.KERNEL32 ref: 00007FF69E4A62CB

Strings

CONOUT$, xrefs: 00007FF69E4A628D

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 6f1dcbecdf4b1e4fd58a35dea008d528d15142dd48fdd07ece926cacfd9cd830
Instruction ID: a0062c3ec2a79b364ce646b08fbcd8230b041278cc4e06b6ef90a94e16ffbc1d
Opcode Fuzzy Hash: 6f1dcbecdf4b1e4fd58a35dea008d528d15142dd48fdd07ece926cacfd9cd830
Instruction Fuzzy Hash: 13118121A58A5286EB608B42F88432973A0FBA8FF4F1442B4FA6DC7B94DF3CD4048754

Function 00007FF69E49BDCC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF69E49C435,?,?,?,?,00007FF69E49C4B3,?,?,00000000,00007FF69E49BEEA,?,?,?), ref: 00007FF69E49BDDB
FlsSetValue.KERNEL32(?,?,?,00007FF69E49C435,?,?,?,?,00007FF69E49C4B3,?,?,00000000,00007FF69E49BEEA,?,?,?), ref: 00007FF69E49BE11
FlsSetValue.KERNEL32(?,?,?,00007FF69E49C435,?,?,?,?,00007FF69E49C4B3,?,?,00000000,00007FF69E49BEEA,?,?,?), ref: 00007FF69E49BE3E
FlsSetValue.KERNEL32(?,?,?,00007FF69E49C435,?,?,?,?,00007FF69E49C4B3,?,?,00000000,00007FF69E49BEEA,?,?,?), ref: 00007FF69E49BE4F
FlsSetValue.KERNEL32(?,?,?,00007FF69E49C435,?,?,?,?,00007FF69E49C4B3,?,?,00000000,00007FF69E49BEEA,?,?,?), ref: 00007FF69E49BE60
SetLastError.KERNEL32(?,?,?,00007FF69E49C435,?,?,?,?,00007FF69E49C4B3,?,?,00000000,00007FF69E49BEEA,?,?,?), ref: 00007FF69E49BE7B

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: d09860916987003217397efd375fd118e2d3f65f3a6b55cd55b916f85a497808
Instruction ID: c3b534ec609b786ff9583b985ce74d1e486ee001a5f6c0c0351c81313b540a1d
Opcode Fuzzy Hash: d09860916987003217397efd375fd118e2d3f65f3a6b55cd55b916f85a497808
Instruction Fuzzy Hash: A1114920E4C64382FA74A7316AD543D2186DF74FB0F1546B4FA2EA76D6DE2CA4024360

Function 00007FF69E49AECC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF69E49AEF1
GetProcAddress.KERNEL32 ref: 00007FF69E49AF07
FreeLibrary.KERNEL32 ref: 00007FF69E49AF2E

Strings

CorExitProcess, xrefs: 00007FF69E49AF00
mscoree.dll, xrefs: 00007FF69E49AEE8

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bfb8e2e045aaa5d8a4d65f3051bd469de7b60ee180c7e05e45e1383d802046fe
Instruction ID: 6e220d8f2c2f346434b4e8b54ad3711c733505804c0b942195df53eac3dd2be1
Opcode Fuzzy Hash: bfb8e2e045aaa5d8a4d65f3051bd469de7b60ee180c7e05e45e1383d802046fe
Instruction Fuzzy Hash: 9EF04F65A5960381FE308B24B4C43B96360EFA4FB5F540675EAAD861E4CF2CD449D720

Function 00007FF69E4A6664 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF69E4A668C
_set_statfp.LIBCMT ref: 00007FF69E4A66A7
_set_statfp.LIBCMT ref: 00007FF69E4A66C3
_set_statfp.LIBCMT ref: 00007FF69E4A66FF

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 942a21358d56a6d6cb39be9b51b63afc88f8e41817038ac04a9af98e8427aae0
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 50118FA2ED8A1302F6751524D4D13793151EFB8BB4F4406F4FA6E8F2E6CE2CA8508320

Function 00007FF69E49BE94 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF69E49BFFB,?,?,00000000,00007FF69E49C296), ref: 00007FF69E49BEB3
FlsSetValue.KERNEL32(?,?,?,00007FF69E49BFFB,?,?,00000000,00007FF69E49C296), ref: 00007FF69E49BED2
FlsSetValue.KERNEL32(?,?,?,00007FF69E49BFFB,?,?,00000000,00007FF69E49C296), ref: 00007FF69E49BEFA
FlsSetValue.KERNEL32(?,?,?,00007FF69E49BFFB,?,?,00000000,00007FF69E49C296), ref: 00007FF69E49BF0B
FlsSetValue.KERNEL32(?,?,?,00007FF69E49BFFB,?,?,00000000,00007FF69E49C296), ref: 00007FF69E49BF1C

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d82967b0093e522171d61d00e694f9cbbf33dbceb67486b6bcec466325ac852b
Instruction ID: b9cac9e80e99947ffc2ca01af39d1dac9c07f6e62dd38a2f0d515405a9525ad1
Opcode Fuzzy Hash: d82967b0093e522171d61d00e694f9cbbf33dbceb67486b6bcec466325ac852b
Instruction Fuzzy Hash: 3511AC20F4960302FA78AB216BC64792181DF70FE0F4843B4F93DE66DADE2CB4024720

Function 00007FF69E49BD28 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF69E49BD39
FlsSetValue.KERNEL32 ref: 00007FF69E49BD58
FlsSetValue.KERNEL32 ref: 00007FF69E49BD80
FlsSetValue.KERNEL32 ref: 00007FF69E49BD91
FlsSetValue.KERNEL32 ref: 00007FF69E49BDA2

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 65f9adb9b0b19f8343b732aaaa21e263637aa2be1f56b4a32b4bef1b526b4f52
Instruction ID: 8ca8cce34a07fa26b4187a9a0fe152b9750991fcdde6ca8c05f38d6a851d8570
Opcode Fuzzy Hash: 65f9adb9b0b19f8343b732aaaa21e263637aa2be1f56b4a32b4bef1b526b4f52
Instruction Fuzzy Hash: 6C110C10E4820302F979A3615AD64B91181DF74F71F1947B8F93EEB2D6EE2CB4024775

Function 00007FF69E4923D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF69E4923FB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF69E492492
RtlUnwindEx.KERNEL32 ref: 00007FF69E4924EC

Strings

csm, xrefs: 00007FF69E492479

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b807eb808fdb2e15da36fa018c95533ac61eef16268ca53c2f541f9b3c74aaa2
Instruction ID: 51fe2dbf5b033eb13abd72b2c22f255eacf8d87fdff2f66e204f414401b11380
Opcode Fuzzy Hash: b807eb808fdb2e15da36fa018c95533ac61eef16268ca53c2f541f9b3c74aaa2
Instruction Fuzzy Hash: 3551A032A196038ADB28CB15F594A783395FB68FA8F508170FA4D97788EF3DE841C714

Function 00007FF69E493C60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF69E493CBF
_CallSETranslator.LIBVCRUNTIME ref: 00007FF69E493D0B

Strings

RCC, xrefs: 00007FF69E493CDB
MOC, xrefs: 00007FF69E493CD3

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 0015c3fc815786a6807c8109a6c457506ce591a4a26f1ae51aa01c347af6a682
Instruction ID: 5bea1cc7d59aa1286cf4a32ee383388d2ce4bebae6d504492226fac890a17b8c
Opcode Fuzzy Hash: 0015c3fc815786a6807c8109a6c457506ce591a4a26f1ae51aa01c347af6a682
Instruction Fuzzy Hash: 8C617F32908B8685DB30CB25E5807AAB7A0FBA5F94F044265FB9D93B56DF3CD194CB10

Function 00007FF69E494010 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF69E494038
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF69E494120

Strings

csm, xrefs: 00007FF69E49405A
csm, xrefs: 00007FF69E494172

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 6cf72d4d8f42cec05f346a57a3f86d1aab26b1a655db36c51017f6ed7c9e5421
Instruction ID: b8ae2a8a71b84f9c7edade0336d7bfc0b80873a04659eeeaf233ad21528eea1f
Opcode Fuzzy Hash: 6cf72d4d8f42cec05f346a57a3f86d1aab26b1a655db36c51017f6ed7c9e5421
Instruction Fuzzy Hash: 11519D3690828386EB748B61E6C827D7690FB65F94F148175EB8CA7B95CF3CE450CB50

Function 00007FF69E4A180C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF69E4A188B
WriteFile.KERNEL32 ref: 00007FF69E4A1B53
WriteFile.KERNEL32 ref: 00007FF69E4A1B99
GetLastError.KERNEL32 ref: 00007FF69E4A1C4F

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6c07ec55695532ce84805899ea55c6edc0c4037fb7ff4a5c537134dffbfe790f
Instruction ID: 84ad45d6fe8497d9994552c3cac867233068056909d2c0949d1845d453637536
Opcode Fuzzy Hash: 6c07ec55695532ce84805899ea55c6edc0c4037fb7ff4a5c537134dffbfe790f
Instruction Fuzzy Hash: DBD11572B08B9289E720CF75D5842AC37B1FB64BB8B444276EE5D97B99DE38D406C310

Function 00007FF69E49A6FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E49A72E

Part of subcall function 00007FF69E49C4C4: HeapFree.KERNEL32(?,?,00000000,00007FF69E4A086E,?,?,?,00007FF69E4A08AB,?,?,00000000,00007FF69E4A0DA5,?,?,?,00007FF69E4A0CD7), ref: 00007FF69E49C4DA
Part of subcall function 00007FF69E49C4C4: GetLastError.KERNEL32(?,?,00000000,00007FF69E4A086E,?,?,?,00007FF69E4A08AB,?,?,00000000,00007FF69E4A0DA5,?,?,?,00007FF69E4A0CD7), ref: 00007FF69E49C4E4

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF69E491895), ref: 00007FF69E49A74C

Strings

C:\Users\user\Desktop\antispam_account.exe, xrefs: 00007FF69E49A73A

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\antispam_account.exe
API String ID: 3580290477-1067520065
Opcode ID: ab94e42854c7bd0a14dc1ef185dedab96143f6ec4c4158bb59e6e6d00c116837
Instruction ID: 9ccc79e9f07034a829b83a05aa3688fad69bfa6596b621be4b37db0aa7053509
Opcode Fuzzy Hash: ab94e42854c7bd0a14dc1ef185dedab96143f6ec4c4158bb59e6e6d00c116837
Instruction Fuzzy Hash: 37419036A48B4385EB25DF26A6C11BC63A5EF64F94B484075FA0E97B85DF3CE4418320

Function 00007FF69E4A1EA4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF69E4A1FBB
GetLastError.KERNEL32 ref: 00007FF69E4A1FDD

Strings

U, xrefs: 00007FF69E4A1F67

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 9cc9f422ebc48c697ed0ea45326535c74e1c6765b0f377516223d34f1b8a491b
Instruction ID: 31af3e3130266f9667cdb5b04bac8e79627adacca1d34388b2932ed99230723f
Opcode Fuzzy Hash: 9cc9f422ebc48c697ed0ea45326535c74e1c6765b0f377516223d34f1b8a491b
Instruction Fuzzy Hash: DD419172A19A8281EB209F25E4843BAA7A1FBA8BA4F454071FE4DC7798DF3CD441C750

Function 00007FF69E494AB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF69E494B08
RaiseException.KERNEL32 ref: 00007FF69E494B49

Strings

csm, xrefs: 00007FF69E494B36

Memory Dump Source

Source File: 00000000.00000002.1405049352.00007FF69E491000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69E490000, based on PE: true

Associated: 00000000.00000002.1405021824.00007FF69E490000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405076003.00007FF69E4A9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405136216.00007FF69E4B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1405163546.00007FF69E4B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69e490000_antispam_account.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a6ec8bcaa6a19174eb367c356140e566403194152f40b68e0ecb328dd169b9a3
Instruction ID: d4037dcf806c5e16d41f7604828ecf859713f241bf3b49c7dd19a939d081030b
Opcode Fuzzy Hash: a6ec8bcaa6a19174eb367c356140e566403194152f40b68e0ecb328dd169b9a3
Instruction Fuzzy Hash: 88115B32618B8282EB608F15F58026977E4FB98F94F584270EB8D8BB68DF3CD551CB00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report antispam_account.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: antispam_account.exePID: 7268, Parent PID: 4084

General

Chronological Activities

Analysis Process: conhost.exePID: 7276, Parent PID: 7268

General

Chronological Activities

Disassembly

Analysis Process: antispam_account.exePID: 7268, Parent PID: 4084COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
antispam_account.exe

Function 00007FF69E4910D0 Relevance: 68.6, APIs: 11, Strings: 28, Instructions: 361
libraryloaderCOMMON

Function 00007FF69E49C500 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Function 00007FF69E4A2134 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Function 00007FF69E49AE74 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF69E491924 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Function 00007FF69E4A1C84 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Function 00007FF69E49CF74 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Function 00007FF69E491840 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Function 00007FF69E49FD84 Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Function 00007FF69E49ADA5 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00007FF69E491C6C Relevance: 1.5, APIs: 1, Instructions: 19
COMMON