Edit tour

Windows Analysis Report
PumpBot.exe

Overview

General Information

Sample name:	PumpBot.exe
Analysis ID:	1545732
MD5:	6a0748cef7672d8c10da160a9f9d3e7c
SHA1:	41e707866b91bf5509091b0949fccaa8cbe73908
SHA256:	b8cf4fc945a0c0401f6931467f4ddf2f58a017e932a87b3ddaa0bb925ef78231
Tags:	exeuser-500mk500
Infos:

Detection

Score:	27
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Found pyInstaller with non standard icon

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

PumpBot.exe (PID: 5248 cmdline: "C:\Users\user\Desktop\PumpBot.exe" MD5: 6A0748CEF7672D8C10DA160A9F9D3E7C)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PumpBot.exe (PID: 5724 cmdline: "C:\Users\user\Desktop\PumpBot.exe" MD5: 6A0748CEF7672D8C10DA160A9F9D3E7C)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: PumpBot.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: PumpBot.exe, 00000000.00000003.2125146329.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: PumpBot.exe, 00000003.00000002.2145582822.00007FFD9456F000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr

Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A1000A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7A1000A34
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FE69E0 FindFirstFileExW,FindClose,	0_2_00007FF7A0FE69E0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A1000A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7A1000A34
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	3_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FE69E0 FindFirstFileExW,FindClose,	3_2_00007FF7A0FE69E0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	3_2_00007FF7A0FF6878

Source: PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.cot
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: PumpBot.exe, 00000000.00000003.2129857475.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A96000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2127164174.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: base_library.zip.0.dr	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: PumpBot.exe, 00000003.00000003.2136027886.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132744160.0000027395FE3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138908226.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2137615624.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143735264.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2136131181.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138196238.0000027395FF9000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2135642576.0000027395FF5000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134954861.0000027395FD3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143869403.000002739608C000.00000004.00001000.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134667028.0000027395FB7000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: PumpBot.exe, 00000003.00000003.2133579000.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: PumpBot.exe, 00000003.00000003.2136027886.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132744160.0000027395FE3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138908226.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2137615624.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143735264.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2136131181.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138196238.0000027395FF9000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2135642576.0000027395FF5000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134954861.0000027395FD3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: PumpBot.exe, 00000003.00000003.2136027886.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132744160.0000027395FE3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138908226.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2137615624.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143735264.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2136131181.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138196238.0000027395FF9000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2135642576.0000027395FF5000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134954861.0000027395FD3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: base_library.zip.0.dr	String found in binary or memory: https://mahler:8092/site-updates.py
Source: PumpBot.exe, 00000003.00000002.2145582822.00007FFD9456F000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: base_library.zip.0.dr	String found in binary or memory: https://www.python.org/
Source: PumpBot.exe, 00000000.00000003.2131474594.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134741386.0000027396860000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: PumpBot.exe, 00000003.00000002.2143869403.0000027396000000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.

Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FFFA88	0_2_00007FF7A0FFFA88
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A1004EA0	0_2_00007FF7A1004EA0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A1005DEC	0_2_00007FF7A1005DEC
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF6878	0_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FE58E0	0_2_00007FF7A0FE58E0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF2A18	0_2_00007FF7A0FF2A18
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A1000A34	0_2_00007FF7A1000A34
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A100324C	0_2_00007FF7A100324C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A100511C	0_2_00007FF7A100511C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF0150	0_2_00007FF7A0FF0150
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF6878	0_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF21DC	0_2_00007FF7A0FF21DC
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FFD1F8	0_2_00007FF7A0FFD1F8
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FE7420	0_2_00007FF7A0FE7420
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF8D00	0_2_00007FF7A0FF8D00
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF132C	0_2_00007FF7A0FF132C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF0354	0_2_00007FF7A0FF0354
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A1008BE8	0_2_00007FF7A1008BE8
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF16C4	0_2_00007FF7A0FF16C4
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF66C4	0_2_00007FF7A0FF66C4
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FEFD40	0_2_00007FF7A0FEFD40
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FFCD64	0_2_00007FF7A0FFCD64
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF0560	0_2_00007FF7A0FF0560
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A1002DB0	0_2_00007FF7A1002DB0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FFFA88	0_2_00007FF7A0FFFA88
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF2614	0_2_00007FF7A0FF2614
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FFD878	0_2_00007FF7A0FFD878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A10058A0	0_2_00007FF7A10058A0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF70FC	0_2_00007FF7A0FF70FC
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FEFF44	0_2_00007FF7A0FEFF44
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF0764	0_2_00007FF7A0FF0764
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF4FC0	0_2_00007FF7A0FF4FC0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF21DC	3_2_00007FF7A0FF21DC
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF132C	3_2_00007FF7A0FF132C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A1005DEC	3_2_00007FF7A1005DEC
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF2A18	3_2_00007FF7A0FF2A18
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A1000A34	3_2_00007FF7A1000A34
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A100324C	3_2_00007FF7A100324C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FFFA88	3_2_00007FF7A0FFFA88
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A100511C	3_2_00007FF7A100511C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF0150	3_2_00007FF7A0FF0150
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF6878	3_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FFD1F8	3_2_00007FF7A0FFD1F8
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FE7420	3_2_00007FF7A0FE7420
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF8D00	3_2_00007FF7A0FF8D00
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF0354	3_2_00007FF7A0FF0354
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A1008BE8	3_2_00007FF7A1008BE8
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A1004EA0	3_2_00007FF7A1004EA0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF16C4	3_2_00007FF7A0FF16C4
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF66C4	3_2_00007FF7A0FF66C4
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FEFD40	3_2_00007FF7A0FEFD40
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FFCD64	3_2_00007FF7A0FFCD64
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF0560	3_2_00007FF7A0FF0560
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A1002DB0	3_2_00007FF7A1002DB0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FFFA88	3_2_00007FF7A0FFFA88
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF2614	3_2_00007FF7A0FF2614
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FFD878	3_2_00007FF7A0FFD878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF6878	3_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A10058A0	3_2_00007FF7A10058A0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FE58E0	3_2_00007FF7A0FE58E0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF70FC	3_2_00007FF7A0FF70FC
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FEFF44	3_2_00007FF7A0FEFF44
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF0764	3_2_00007FF7A0FF0764
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF4FC0	3_2_00007FF7A0FF4FC0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3712F80	3_2_00007FFDA3712F80
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA37152E0	3_2_00007FFDA37152E0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA371F6E8	3_2_00007FFDA371F6E8
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3711AF0	3_2_00007FFDA3711AF0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3715B38	3_2_00007FFDA3715B38
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3711280	3_2_00007FFDA3711280
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3716E34	3_2_00007FFDA3716E34
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3712490	3_2_00007FFDA3712490
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3718CD0	3_2_00007FFDA3718CD0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA4335EE0	3_2_00007FFDA4335EE0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA4333CE0	3_2_00007FFDA4333CE0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA43335B0	3_2_00007FFDA43335B0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA43337D0	3_2_00007FFDA43337D0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA433C638	3_2_00007FFDA433C638
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA433763C	3_2_00007FFDA433763C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA4331000	3_2_00007FFDA4331000
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA5467508	3_2_00007FFDA5467508

Source: C:\Users\user\Desktop\PumpBot.exe	Code function: String function: 00007FF7A0FE1CB0 appears 38 times
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: String function: 00007FF7A0FE1C50 appears 90 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2126768882.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2125540722.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000000.00000003.2125146329.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs PumpBot.exe
Source: PumpBot.exe	Binary or memory string: OriginalFilename vs PumpBot.exe
Source: PumpBot.exe, 00000003.00000002.2145922625.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs PumpBot.exe
Source: PumpBot.exe, 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs PumpBot.exe
Source: PumpBot.exe, 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs PumpBot.exe
Source: PumpBot.exe, 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs PumpBot.exe

Source: classification engine

Classification label: sus27.winEXE@4/14@0/0

Source: C:\Users\user\Desktop\PumpBot.exe

Code function: 0_2_00007FF7A0FE6670 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7A0FE6670

Source: C:\Users\user\Desktop\PumpBot.exe

File created: C:\Users\user\Desktop\data

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_03

Source: C:\Users\user\Desktop\PumpBot.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI52482

Jump to behavior

Source: PumpBot.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PumpBot.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PumpBot.exe

File read: C:\Users\user\Desktop\PumpBot.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PumpBot.exe "C:\Users\user\Desktop\PumpBot.exe"
Source: C:\Users\user\Desktop\PumpBot.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PumpBot.exe	Process created: C:\Users\user\Desktop\PumpBot.exe "C:\Users\user\Desktop\PumpBot.exe"
Source: C:\Users\user\Desktop\PumpBot.exe	Process created: C:\Users\user\Desktop\PumpBot.exe "C:\Users\user\Desktop\PumpBot.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\PumpBot.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: PumpBot.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: PumpBot.exe

Static file information: File size 5957263 > 1048576

Source: PumpBot.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PumpBot.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PumpBot.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PumpBot.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PumpBot.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PumpBot.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PumpBot.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: PumpBot.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: PumpBot.exe, 00000000.00000003.2130927428.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: PumpBot.exe, 00000000.00000003.2131085002.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: PumpBot.exe, 00000000.00000003.2125146329.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: PumpBot.exe, 00000003.00000002.2145582822.00007FFD9456F000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: PumpBot.exe, 00000000.00000003.2125894783.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: PumpBot.exe, 00000000.00000003.2125324165.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: PumpBot.exe, 00000000.00000003.2126036451.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: libssl-1_1.dll.0.dr

Source: PumpBot.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PumpBot.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PumpBot.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PumpBot.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PumpBot.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: PumpBot.exe	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\PumpBot.exe

Process created: "C:\Users\user\Desktop\PumpBot.exe"

Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI52482\_socket.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\PumpBot.exe

Code function: 0_2_00007FF7A0FE2F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7A0FE2F20

Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\PumpBot.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI52482\_socket.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\PumpBot.exe

API coverage: 3.8 %

Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A1000A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7A1000A34
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FE69E0 FindFirstFileExW,FindClose,	0_2_00007FF7A0FE69E0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A1000A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF7A1000A34
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	3_2_00007FF7A0FF6878
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FE69E0 FindFirstFileExW,FindClose,	3_2_00007FF7A0FE69E0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	3_2_00007FF7A0FF6878

Source: C:\Users\user\Desktop\PumpBot.exe

Code function: 0_2_00007FF7A0FEAA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7A0FEAA2C

Source: C:\Users\user\Desktop\PumpBot.exe

Code function: 0_2_00007FF7A1002620 GetProcessHeap,

0_2_00007FF7A1002620

Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FEAA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7A0FEAA2C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FEA180 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7A0FEA180
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FF9C44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7A0FF9C44
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 0_2_00007FF7A0FEABD4 SetUnhandledExceptionFilter,	0_2_00007FF7A0FEABD4
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FEAA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7A0FEAA2C
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FEA180 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF7A0FEA180
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FF9C44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7A0FF9C44
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FF7A0FEABD4 SetUnhandledExceptionFilter,	3_2_00007FF7A0FEABD4
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA37233B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFDA37233B0
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA3723980 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFDA3723980
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA4339F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFDA4339F30
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA433A978 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FFDA433A978
Source: C:\Users\user\Desktop\PumpBot.exe	Code function: 3_2_00007FFDA547004C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FFDA547004C

Source: C:\Users\user\Desktop\PumpBot.exe

Process created: C:\Users\user\Desktop\PumpBot.exe "C:\Users\user\Desktop\PumpBot.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PumpBot.exe

Code function: 0_2_00007FF7A1008A30 cpuid

0_2_00007FF7A1008A30

Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\PumpBot.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI52482\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PumpBot.exe	Queries volume information: C:\Users\user\Desktop\data\.cache_dir\Ai Powered Bot Starter.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PumpBot.exe

Code function: 0_2_00007FF7A0FEA910 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7A0FEA910

Source: C:\Users\user\Desktop\PumpBot.exe

Code function: 0_2_00007FF7A1004EA0 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7A1004EA0

Source: C:\Users\user\Desktop\PumpBot.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PumpBot.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI52482\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI52482\unicodedata.pyd	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.openssl.org/H	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143869403.000002739608C000.00000004.00001000.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134667028.0000027395FB7000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cacerts.digicert.cot	PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mahler:8092/site-updates.py	base_library.zip.0.dr	false		unknown
http://www.robotstxt.org/norobots-rfc.txt	base_library.zip.0.dr	false		unknown
http://cacerts.digicert.co	PumpBot.exe, 00000000.00000003.2125741690.0000022791A89000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.python.org/download/releases/2.3/mro/.	PumpBot.exe, 00000003.00000002.2143869403.0000027396000000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		unknown
https://www.python.org/	base_library.zip.0.dr	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	PumpBot.exe, 00000003.00000003.2136027886.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132744160.0000027395FE3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138908226.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2137615624.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143735264.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2136131181.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138196238.0000027395FF9000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2135642576.0000027395FF5000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134954861.0000027395FD3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.openssl.org/H	PumpBot.exe, 00000000.00000003.2128335588.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr	false	URL Reputation: safe	unknown
https://www.python.org/dev/peps/pep-0205/	PumpBot.exe, 00000000.00000003.2131474594.0000022791A89000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134741386.0000027396860000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false		unknown
https://python.org/dev/peps/pep-0263/	PumpBot.exe, 00000003.00000002.2145582822.00007FFD9456F000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	false		unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	PumpBot.exe, 00000003.00000003.2136027886.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132744160.0000027395FE3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138908226.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2137615624.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143735264.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2136131181.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138196238.0000027395FF9000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2135642576.0000027395FF5000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134954861.0000027395FD3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	PumpBot.exe, 00000003.00000003.2133579000.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	PumpBot.exe, 00000003.00000003.2136027886.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132744160.0000027395FE3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138908226.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133468215.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132655496.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133298257.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133187866.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2137615624.0000027395FF6000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133063077.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000002.2143735264.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2136131181.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2138196238.0000027395FF9000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2135642576.0000027395FF5000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2134954861.0000027395FD3000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132757422.0000027395FDA000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2132799099.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp, PumpBot.exe, 00000003.00000003.2133579000.0000027395FB4000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545732
Start date and time:	2024-10-30 22:22:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PumpBot.exe
Detection:	SUS
Classification:	sus27.winEXE@4/14@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: PumpBot.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse
	leo.bat	Get hash	malicious	Braodo	Browse
	cat.bat	Get hash	malicious	Braodo	Browse
	chim.bat	Get hash	malicious	Braodo	Browse
	siu.bat	Get hash	malicious	Braodo	Browse
	rom.bat	Get hash	malicious	Unknown	Browse
	HjiFq7hzLA.lnk	Get hash	malicious	MalLnk	Browse
	205.bat	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_MEI52482\VCRUNTIME140.dll	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
	Bypass Apk.exe	Get hash	malicious	Unknown	Browse
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse
	rom.bat	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W32.PossibleThreat.28513.13103.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.16388.exe	Get hash	malicious	Unknown	Browse
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse
	H2f8SkAvdV.exe	Get hash	malicious	Blank Grabber, XWorm	Browse
	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI52482\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98224
Entropy (8bit):	6.452201564717313
Encrypted:	false
SSDEEP:	1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
MD5:	F34EB034AA4A9735218686590CBA2E8B
SHA1:	2BC20ACDCB201676B77A66FA7EC6B53FA2644713
SHA-256:	9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
SHA-512:	D27D5E65E8206BD7923CF2A3C4384FEC0FC59E8BC29E25F8C03D039F3741C01D1A8C82979D7B88C10B209DB31FBBEC23909E976B3EE593DC33481F0050A445AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Bypass Apk.exe, Detection: malicious, Browse Filename: Bypass Apk.exe, Detection: malicious, Browse Filename: sims-4-updater-v1.3.4.exe, Detection: malicious, Browse Filename: rom.bat, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.PossibleThreat.28513.13103.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.16388.exe, Detection: malicious, Browse Filename: v.1.6.3__x64__.msi, Detection: malicious, Browse Filename: v.1.5.4__x64__.msi, Detection: malicious, Browse Filename: H2f8SkAvdV.exe, Detection: malicious, Browse Filename: SolaraV3.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...%\|.a.........." .........`......p................................................{....`A.........................................B..4....J...............p..X....X...'..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.595094797707322
Encrypted:	false
SSDEEP:	1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
MD5:	86D1B2A9070CD7D52124126A357FF067
SHA1:	18E30446FE51CED706F62C3544A8C8FDC08DE503
SHA-256:	62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
SHA-512:	7DB4B7E0C518A02AE901F4B24E3860122ACC67E38E73F98F993FE99EB20BB3AA539DB1ED40E63D6021861B54F34A5F5A364907FFD7DA182ADEA68BBDD5C2B535
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Bypass Apk.exe, Detection: malicious, Browse Filename: Bypass Apk.exe, Detection: malicious, Browse Filename: sims-4-updater-v1.3.4.exe, Detection: malicious, Browse Filename: leo.bat, Detection: malicious, Browse Filename: cat.bat, Detection: malicious, Browse Filename: chim.bat, Detection: malicious, Browse Filename: siu.bat, Detection: malicious, Browse Filename: rom.bat, Detection: malicious, Browse Filename: HjiFq7hzLA.lnk, Detection: malicious, Browse Filename: 205.bat, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.>...m...m...m.}<m...m.p.l...m.jRm...m.p.l...m.p.l...m.p.l...mup.l...m.}.l...m...m...mup.l...mup.l...mupPm...mup.l...mRich...m................PE..d.....,d.........." .........\..............................................P............`......................................... ...H...h........0....... ..,......../...@......`...T...............................8............................................text.............................. ..`.rdata...=.......>..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	254744
Entropy (8bit):	6.564308911485739
Encrypted:	false
SSDEEP:	6144:3LT2sto29vTlN5cdIKdo4/3VaV8FlBa9qWMa3pLW1A/T8O51j4iab9M:H2s/9vTlPcdk4vVtFU98iIu
MD5:	20C77203DDF9FF2FF96D6D11DEA2EDCF
SHA1:	0D660B8D1161E72C993C6E2AB0292A409F6379A5
SHA-256:	9AAC010A424C757C434C460C3C0A6515D7720966AB64BAD667539282A17B4133
SHA-512:	2B24346ECE2CBD1E9472A0E70768A8B4A5D2C12B3D83934F22EBDC9392D9023DCB44D2322ADA9EDBE2EB0E2C01B5742D2A83FA57CA23054080909EC6EB7CF3CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........76..VX..VX..VX.....VX..#Y..VX..#]..VX..#\..VX..#[..VX.t#Y..VX...Y..VX..VY.+VX.t#[..VX.t#U..VX.t#X..VX.t#...VX.t#Z..VX.Rich.VX.........................PE..d.....,d.........." .....\|...:.......................................................r....`..........................................T..P...0U...................'......./......<...0...T...............................8............................................text....{.......\|.................. ..`.rdata..............................@..@.data....)...p...$...X..............@....pdata...'.......(...\|..............@..@.rsrc...............................@..@.reloc..<...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64792
Entropy (8bit):	6.223467179037751
Encrypted:	false
SSDEEP:	1536:/smKJPganCspF1dqZAC2QjP2RILOIld7SyEPxDF:/smKpgNoF1dqZDnjP2RILOIv2xB
MD5:	D4674750C732F0DB4C4DD6A83A9124FE
SHA1:	FD8D76817ABC847BB8359A7C268ACADA9D26BFD5
SHA-256:	CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9
SHA-512:	97D57CFB80DD9DD822F2F30F836E13A52F771EE8485BC0FD29236882970F6BFBDFAAC3F2E333BBA5C25C20255E8C0F5AD82D8BC8A6B6E2F7A07EA94A9149C81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..b?..b?..b?......b?..>..b?..:..b?..;..b?..<..b?.2.>..b?..>..b?.7.>..b?..b>.pb?.2.2..b?.2.?..b?.2....b?.2.=..b?.Rich.b?.........PE..d.....,d.........." .....P...........<....................................................`............................................P...0............................/......T....k..T............................k..8............`.. ............................text....N.......P.................. ..`.rdata..4P...`...R...T..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158488
Entropy (8bit):	6.8491143497239655
Encrypted:	false
SSDEEP:	3072:j0k3SXjD9aWpAn3rb7SbuDlvNgS4fWqEznfo9mNoFTSlXZ8Ax5ILZ1GIxq:j0kiXjD9v8X7Euk4wYOFTafxn
MD5:	7447EFD8D71E8A1929BE0FAC722B42DC
SHA1:	6080C1B84C2DCBF03DCC2D95306615FF5FCE49A6
SHA-256:	60793C8592193CFBD00FD3E5263BE4315D650BA4F9E4FDA9C45A10642FD998BE
SHA-512:	C6295D45ED6C4F7534C1A38D47DDC55FEA8B9F62BBDC0743E4D22E8AD0484984F8AB077B73E683D0A92D11BF6588A1AE395456CFA57DA94BB2A6C4A1B07984DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.M...M...M...D..I.......O.......F.......E.......N.......N.......O...M...(.......w.......L.......L.......L...RichM...................PE..d...&.,d.........." .....`..........p3...............................................4....`.............................................L.......x....`.......@.......<.../...p..D...H{..T............................{..8............p...............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data........0......................@....pdata.......@......................@..@.rsrc........`.......0..............@..@.reloc..D....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79128
Entropy (8bit):	6.284790077237953
Encrypted:	false
SSDEEP:	1536:ZmtvsXhgzrojAs9/s+S+pGLypbyxk/DDTBVILLwX7SyiPx9:c56OzyAs9/sT+pGLypb+k/XFVILLwX4f
MD5:	819166054FEC07EFCD1062F13C2147EE
SHA1:	93868EBCD6E013FDA9CD96D8065A1D70A66A2A26
SHA-256:	E6DEB751039CD5424A139708475CE83F9C042D43E650765A716CB4A924B07E4F
SHA-512:	DA3A440C94CB99B8AF7D2BC8F8F0631AE9C112BD04BADF200EDBF7EA0C48D012843B4A9FB9F1E6D3A9674FD3D4EB6F0FA78FD1121FAD1F01F3B981028538B666
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:...:...:...3.i.<...h...8...h...6...h...2...h...9.......8...:.......q...=.......;.......;.......;.......;...Rich:...........PE..d.....,d.........." .....l...........%.......................................P............`.............................................P............0....... ..<......../...@..........T..............................8............................................text...fj.......l.................. ..`.rdata..Ts.......t...p..............@..@.data...............................@....pdata..<.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160536
Entropy (8bit):	6.027748879187965
Encrypted:	false
SSDEEP:	3072:OwYiZ+PtocHnVXhLlasuvMETxoEBA+nbUtGnBSonJCNI5ILC7Gax1:FYk+PtocHVxx/uvPCEwhGJ
MD5:	7910FB2AF40E81BEE211182CFFEC0A06
SHA1:	251482ED44840B3C75426DD8E3280059D2CA06C6
SHA-256:	D2A7999E234E33828888AD455BAA6AB101D90323579ABC1095B8C42F0F723B6F
SHA-512:	BFE6506FEB27A592FE9CF1DB7D567D0D07F148EF1A2C969F1E4F7F29740C6BB8CCF946131E65FE5AA8EDE371686C272B0860BD4C0C223195AAA1A44F59301B27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C.-...-...-.....-...,...-...(...-...)...-.......-.W.,...-.R.,...-...,...-...,...-.W. ...-.W.-...-.W....-.W./...-.Rich..-.................PE..d.....,d.........." ................l*..............................................%.....`.............................................d...........`.......P.......D.../...p..8.......T...............................8............................................text...(........................... ..`.rdata..6...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..8....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1066352
Entropy (8bit):	5.671261187425041
Encrypted:	false
SSDEEP:	12288:cgYJu4KXWyBC6S4IE/8A4a2YW63dOVwx/fpEWer/3u+E0SLMNA:cgYJiVB+La2VlVwx/fpEWe7u+E/MNA
MD5:	09A3FF9CE0B161D6C00993BBBECC5CDA
SHA1:	F268EAF07FDDF61CA6F2864A8EB5C2F4AEEB3799
SHA-256:	10A109D61278F442E1B9CB4482275D651F66A6077C9BA6C0285D08BD942582A9
SHA-512:	4D615FF20431DBD3261AF9ECC1A18329665CA8ACD3A15F89392AA81795E3A2E54BEBD7ECAB42A039547EC0DC8706EF4C512FEA98299488FE810108307BE2AE9F
Malicious:	false
Preview:	PK..........!..,..5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI52482\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3450648
Entropy (8bit):	6.098075450035195
Encrypted:	false
SSDEEP:	98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
MD5:	9D7A0C99256C50AFD5B0560BA2548930
SHA1:	76BD9F13597A46F5283AA35C30B53C21976D0824
SHA-256:	9B7B4A0AD212095A8C2E35C71694D8A1764CD72A829E8E17C8AFE3A55F147939
SHA-512:	CB39AA99B9D98C735FDACF1C5ED68A4D09D11F30262B91F6AA48C3F8520EFF95E499400D0CE7E280CA7A90FF6D7141D2D893EF0B33A8803A1CADB28BA9A9E3E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].q...q...q....M..q.......q.......q.......q.......q...q..[q.......q.......q.......s.......q....!..q.......q..Rich.q..........................PE..d......c.........." ..."..$.................................................. 5......%5...`.........................................../..h...Z4.@.....4.\|.....2......x4../....4..O....-.8.............................-.@............P4..............................text.....$.......$................. ..`.rdata..&.....%.......$.............@..@.data...!z....2..,....1.............@....pdata........2.......2.............@..@.idata..^#...P4..$....3.............@..@.00cfg..u.....4.......3.............@..@.rsrc...\|.....4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	704792
Entropy (8bit):	5.5573527806738126
Encrypted:	false
SSDEEP:	12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
MD5:	BEC0F86F9DA765E2A02C9237259A7898
SHA1:	3CAA604C3FFF88E71F489977E4293A488FB5671C
SHA-256:	D74CE01319AE6F54483A19375524AA39D9F5FD91F06CF7DF238CA25E043130FD
SHA-512:	FFBC4E5FFDB49704E7AA6D74533E5AF76BBE5DB297713D8E59BD296143FE5F145FBB616B343EED3C48ECEACCCCC2431630470D8975A4A17C37EAFCC12EDD19F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1}q.1}q.1}q.8..=}q.~.p.3}q.z.p.3}q.~.t.=}q.~.u.9}q.~.r.5}q...p.2}q.1}p..\|q...u..}q...q.0}q.....0}q...s.0}q.Rich1}q.........PE..d......c.........." ...".D...T......<................................................i....`..........................................A...N..@U..........s........N......./......h.......8...............................@............@..@............................text....B.......D.................. ..`.rdata.../...`...0...H..............@..@.data...AM.......D...x..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............l..............@..@.rsrc...s............n..............@..@.reloc..q............v..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\python310.dll

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4458776
Entropy (8bit):	6.460390021076921
Encrypted:	false
SSDEEP:	49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
MD5:	63A1FA9259A35EAEAC04174CECB90048
SHA1:	0DC0C91BCD6F69B80DCDD7E4020365DD7853885A
SHA-256:	14B06796F288BC6599E458FB23A944AB0C843E9868058F02A91D4606533505ED
SHA-512:	896CAA053F48B1E4102E0F41A7D13D932A746EEA69A894AE564EF5A84EF50890514DECA6496E915AAE40A500955220DBC1B1016FE0B8BCDDE0AD81B2917DEA8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<...<...<...I...<...Sc..<...I...<...I...<...I...<...D...<...D...<...<...=..+I../<..+I...<..+Ia..<..+I...<..Rich.<..........................PE..d.....,d.........." .....V#..v!...............................................E.....".D...`.........................................`.<.....@.=.\|.....D......`B.......C../....D..t....$.T...........................P.$.8............p#.8............................text...bT#......V#................. ..`.rdata...B...p#..D...Z#.............@..@.data... .....=.......=.............@....pdata.......`B......HA.............@..@PyRuntim`....pD......VC.............@....rsrc.........D......ZC.............@..@.reloc...t....D..v...dC.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\select.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29976
Entropy (8bit):	6.627859470728624
Encrypted:	false
SSDEEP:	768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
MD5:	A653F35D05D2F6DEBC5D34DADDD3DFA1
SHA1:	1A2CEEC28EA44388F412420425665C3781AF2435
SHA-256:	DB85F2F94D4994283E1055057372594538AE11020389D966E45607413851D9E9
SHA-512:	5AEDE99C3BE25B1A962261B183AE7A7FB92CB0CB866065DC9CD7BB5FF6F41CC8813D2CC9DE54670A27B3AD07A33B833EAA95A5B46DAD7763CA97DFA0C1CE54C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!.F.O.F.O.F.O.O...D.O...N.D.O...J.M.O...K.N.O...L.B.O...N.D.O.F.N...O...N.C.O...B.G.O...O.G.O....G.O...M.G.O.RichF.O.................PE..d.....,d.........." .........0......................................................;\....`.........................................`@..L....@..x....p.......`.......F.../......H....2..T............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc........p.......:..............@..@.reloc..H............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI52482\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1123608
Entropy (8bit):	5.3853088605790385
Encrypted:	false
SSDEEP:	12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
MD5:	81D62AD36CBDDB4E57A91018F3C0816E
SHA1:	FE4A4FC35DF240B50DB22B35824E4826059A807B
SHA-256:	1FB2D66C056F69E8BBDD8C6C910E72697874DAE680264F8FB4B4DF19AF98AA2E
SHA-512:	7D15D741378E671591356DFAAD4E1E03D3F5456CBDF87579B61D02A4A52AB9B6ECBFFAD3274CEDE8C876EA19EAEB8BA4372AD5986744D430A29F50B9CAFFB75D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$z.eJ).eJ).eJ)...).eJ)..K(.eJ)..O(.eJ)..N(.eJ)..I(.eJ)\|.K(.eJ)..K(.eJ).eK).eJ)\|.G(.eJ)\|.J(.eJ)\|..).eJ)\|.H(.eJ)Rich.eJ)........................PE..d.....,d.........." .....B.......... *.......................................@......Q.....`.............................................X............ ..........H......../...0.......`..T........................... a..8............`..x............................text...9A.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..H...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\PumpBot.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.499329235946603
Encrypted:	false
SSDEEP:	3:vkeF4IABFReNmI4FnjG7QUAuF5QEyn:tKMmI41G763
MD5:	52628A56C7D1B2860954588F73617CC1
SHA1:	94C0FB15145C69BE6193D90CE83D4D2E0EE23486
SHA-256:	6BBCA8AD9E0BE5142D8D9065B6458E6BDE878F43E59DADB277AF2252A551432F
SHA-512:	2ADE96298BA7F98774C7D0E594D52E7E5B9195326577BB76B7E1B39C0003F4D67E88CAEA935F80317CEBA8D5A33E059C13AA8F39A0069DC1B96AB48FA1BE6810
Malicious:	false
Preview:	[5724] Failed to execute script 'AiBotPortable' due to unhandled exception!..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.979158530118126
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PumpBot.exe
File size:	5'957'263 bytes
MD5:	6a0748cef7672d8c10da160a9f9d3e7c
SHA1:	41e707866b91bf5509091b0949fccaa8cbe73908
SHA256:	b8cf4fc945a0c0401f6931467f4ddf2f58a017e932a87b3ddaa0bb925ef78231
SHA512:	8a48662feba2df3c426dcd086a5401d3344334098cfc002bf3c63b8920e5af05d1780da470fe672395b5acc60bb41a5a86e40b746f1ddd867010e1aa2255da61
SSDEEP:	98304:uJIfoZMD/x/0feyGutbQ940BDlgwdnpka9R/k9t+2MGt+NqkBUAcILzE:uJPuDfyGuwBdnpkYRM6IkO2L
TLSH:	AE56239472900CD4D8B2E23FB9C39616E5FE74124385DA83537887662E13BB4BE7A743
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............p...p...p...s...p...u.=.p...t...p.......p...u...p...t...p...s...p...q...p...q...p.B.t...p.B.r...p.Rich..p................

File Icon


Icon Hash:	2b6de5e46c5d5b5b

Static PE Info

General

Entrypoint:	0x14000a6a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E87CD8 [Mon Sep 16 18:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	ba5546933531fafa869b1f86a4e2a959

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9BCCEB424Ch
dec eax
add esp, 28h
jmp 00007F9BCCEB3E4Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F9BCCEB4794h
test eax, eax
je 00007F9BCCEB4003h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F9BCCEB3FE7h
dec eax
cmp ecx, eax
je 00007F9BCCEB3FF6h
xor eax, eax
dec eax
cmpxchg dword ptr [00041E8Ch], ecx
jne 00007F9BCCEB3FD0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F9BCCEB3FD9h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00041E77h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00041E67h], al
call 00007F9BCCEB4593h
call 00007F9BCCEB56C2h
test al, al
jne 00007F9BCCEB3FE6h
xor al, al
jmp 00007F9BCCEB3FF6h
call 00007F9BCCEC2AA1h
test al, al
jne 00007F9BCCEB3FEBh
xor ecx, ecx
call 00007F9BCCEB56D2h
jmp 00007F9BCCEB3FCCh
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00041E2Ch], 00000000h
mov ebx, ecx
jne 00007F9BCCEB4049h
cmp ecx, 01h
jnbe 00007F9BCCEB404Ch
call 00007F9BCCEB46FAh
test eax, eax
je 00007F9BCCEB400Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bb94	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x10eb6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x20e8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x63000	0x75c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39350	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39210	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x350	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28890	0x28a00	7c71956ea75242f33df45f4d2c19a4d8	False	0.5562019230769231	zlib compressed data	6.489977853279916	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x1271a	0x12800	d7969543917262a5d4ea29600d053f8c	False	0.5159549197635135	data	5.846291126830796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x103f8	0xe00	9bd2cebaa3285e8e266c4c373a15119d	False	0.13337053571428573	DOS executable (block device driver \377\3)	1.808915577448681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x20e8	0x2200	f2a57235499cb8c84daf2de6f18a85eb	False	0.4756433823529412	data	5.330974160786823	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x15c	0x200	32c20bb907888de565d4d8836d097016	False	0.392578125	data	2.795351059303424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x10eb6	0x11000	a1a418bfd2049edd6f6cf58ba898b516	False	0.21599264705882354	data	3.8280613293862067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x63000	0x75c	0x800	b7279c82d58eeae8dc663879402c6f2e	False	0.54296875	data	5.238892234772638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x520e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 30236 x 30236 px/m	0.20968886785756535
RT_GROUP_ICON	0x62910	0x14	data	1.15
RT_MANIFEST	0x62924	0x592	XML 1.0 document, ASCII text, with CRLF line terminators	0.4488078541374474

Imports

DLL

Import

KERNEL32.dll

GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, WriteConsoleW, GetProcAddress, GetModuleFileNameW, SetDllDirectoryW, FreeLibrary, GetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, SetEndOfFile

ADVAPI32.dll

ConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

Target ID:	0
Start time:	17:22:59
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\PumpBot.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PumpBot.exe"
Imagebase:	0x7ff7a0fe0000
File size:	5'957'263 bytes
MD5 hash:	6A0748CEF7672D8C10DA160A9F9D3E7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:22:59
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:23:00
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\PumpBot.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PumpBot.exe"
Imagebase:	0x7ff7a0fe0000
File size:	5'957'263 bytes
MD5 hash:	6A0748CEF7672D8C10DA160A9F9D3E7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	66

Executed Functions

Function 00007FF7A1004EA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7A1004EE5

Part of subcall function 00007FF7A1004838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A100484C

Part of subcall function 00007FF7A0FF9F78: RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
Part of subcall function 00007FF7A0FF9F78: GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

Part of subcall function 00007FF7A0FF9F30: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7A0FF9F0F,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FF9F39
Part of subcall function 00007FF7A0FF9F30: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7A0FF9F0F,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FF9F5E

_get_daylight.LIBCMT ref: 00007FF7A1004ED4

Part of subcall function 00007FF7A1004898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A10048AC

_get_daylight.LIBCMT ref: 00007FF7A100514A
_get_daylight.LIBCMT ref: 00007FF7A100515B
_get_daylight.LIBCMT ref: 00007FF7A100516C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A10053AC), ref: 00007FF7A1005193

Strings

Eastern Summer Time, xrefs: 00007FF7A1005251
Eastern Standard Time, xrefs: 00007FF7A1005239

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
Instruction ID: 0f9a1f0af36f8161cb05eb05e908e1f79921774425f34aa93328cad302c2d29f
Opcode Fuzzy Hash: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
Instruction Fuzzy Hash: AFD1B322A1A24286F714FF21D8401BEB761FF44794FC24436EA4D876A5DFBCE861CB60

Function 00007FF7A0FE58E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF7A0FE58AD), ref: 00007FF7A0FE597A
GetCurrentProcessId.KERNEL32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE5980

Part of subcall function 00007FF7A0FE5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7A0FE2817,?,?,?,?,?,?), ref: 00007FF7A0FE5B2A
Part of subcall function 00007FF7A0FE5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE5B47

Part of subcall function 00007FF7A0FF6818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF6831

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7A0FE5A31

Strings

TMP, xrefs: 00007FF7A0FE5918, 00007FF7A0FE59D9, 00007FF7A0FE5A67
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7A0FE5958
_MEI%d, xrefs: 00007FF7A0FE5988
TMP, xrefs: 00007FF7A0FE593E

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 1556224225-1116378104
Opcode ID: c805534fc36cce2f638f5d4b2e31efb0a3bdcbd638384fcea02245f06552b5c8
Instruction ID: cebb1cccd155b11647ee9f3fe8f8850719d04f2aacddb4991d83dfd92378d86f
Opcode Fuzzy Hash: c805534fc36cce2f638f5d4b2e31efb0a3bdcbd638384fcea02245f06552b5c8
Instruction Fuzzy Hash: EF513721F0F64784FA55BB32A9552BAD2825F49BC0FC64835EC0E677A6ED6CF5018720

Function 00007FF7A1005DEC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A1005B20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005B61
Part of subcall function 00007FF7A1005B20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005BDF
Part of subcall function 00007FF7A1005B20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005C30

CreateFileW.KERNELBASE ref: 00007FF7A1005EF2
CreateFileW.KERNEL32 ref: 00007FF7A1005F42
GetLastError.KERNEL32 ref: 00007FF7A1005F72
GetFileType.KERNELBASE ref: 00007FF7A1005F87
GetLastError.KERNEL32 ref: 00007FF7A1005F91
CloseHandle.KERNEL32 ref: 00007FF7A1005FC4
CloseHandle.KERNEL32 ref: 00007FF7A1006127
CreateFileW.KERNEL32 ref: 00007FF7A100615C
GetLastError.KERNEL32 ref: 00007FF7A100616B

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
Instruction ID: cabf71382365bf184d8244860535987e9305c2f5e8bd34971652b538fc87f96e
Opcode Fuzzy Hash: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
Instruction Fuzzy Hash: C5C1F333B29A4285FB10EF64C4906AD7771FB48B98B864239DE1E977A5CF78E061C710

Function 00007FF7A100511C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7A100514A

Part of subcall function 00007FF7A1004898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A10048AC

_get_daylight.LIBCMT ref: 00007FF7A100515B

Part of subcall function 00007FF7A1004838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A100484C

_get_daylight.LIBCMT ref: 00007FF7A100516C

Part of subcall function 00007FF7A1004868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A100487C

Part of subcall function 00007FF7A0FF9F78: RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
Part of subcall function 00007FF7A0FF9F78: GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A10053AC), ref: 00007FF7A1005193

Strings

Eastern Summer Time, xrefs: 00007FF7A1005251
Eastern Standard Time, xrefs: 00007FF7A1005239

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
Instruction ID: 47abae04dbd86ed4a8925197b82e92c99b289b65f8c3b1ed7feef163d7268bc1
Opcode Fuzzy Hash: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
Instruction Fuzzy Hash: B6516232A1A64286F710FF21D9815AAF760BF48784FC24535EA4D837B5DFBCE5218B60

Function 00007FF7A0FFFA88 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 036bb9af6ac8c728884dbc430cc13962f440282e35d529492d92ee50b2a68dd9
Instruction ID: e9d6edd6e220f5fa71bba9a9be91186b58e73eb1afb88089c4d0639be50e1de4
Opcode Fuzzy Hash: 036bb9af6ac8c728884dbc430cc13962f440282e35d529492d92ee50b2a68dd9
Instruction Fuzzy Hash: 6002C123B1F64349FB54BB31A44027AA680AF41B90FD74A35DE5E663F1DE7CB8258720

Function 00007FF7A0FE17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7A0FE185C
_fread_nolock.LIBCMT ref: 00007FF7A0FE190E

Part of subcall function 00007FF7A0FEE6D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE6E4

Strings

fseek, xrefs: 00007FF7A0FE1836
MEI, xrefs: 00007FF7A0FE17EF
Failed to read cookie!, xrefs: 00007FF7A0FE1867
malloc, xrefs: 00007FF7A0FE18EA
fread, xrefs: 00007FF7A0FE186E
Cannot read Table of Contents., xrefs: 00007FF7A0FE1995
Could not read full TOC!, xrefs: 00007FF7A0FE1919
Failed to seek to cookie position!, xrefs: 00007FF7A0FE182F
Could not allocate buffer for TOC!, xrefs: 00007FF7A0FE18E3
Error on file., xrefs: 00007FF7A0FE193D

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _fread_nolock$_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 3405171723-4158440160
Opcode ID: 3dd81e11b18fc9e391ce97d87c5df179014315260915c8fdf2366e990ec26e09
Instruction ID: f3b2b437746adf8f79a4e9085ceba0e554a670209a17395f392f15e4b237b199
Opcode Fuzzy Hash: 3dd81e11b18fc9e391ce97d87c5df179014315260915c8fdf2366e990ec26e09
Instruction Fuzzy Hash: C3516972A0E606C6EF14EF39D45027DB3A0FB48B84B928935D90D933A9DE6CE550CB60

Function 00007FF7A0FE1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open target file!, xrefs: 00007FF7A0FE148A
fseek, xrefs: 00007FF7A0FE1500
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7A0FE1559
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A0FE14F9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A0FE14CA
malloc, xrefs: 00007FF7A0FE1560
fopen, xrefs: 00007FF7A0FE1491
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A0FE15E5
fread, xrefs: 00007FF7A0FE15EC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7A0FE15D5
fwrite, xrefs: 00007FF7A0FE15DC

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 6a700ff59d1eae3cd4f1897966358a388e1f51ee3372cc3160cad33ce14096f4
Instruction ID: eb7a6a3adedc0293e9a2355b9cbcf134823dbbb4a0d86bbb805e83dafde25f6d
Opcode Fuzzy Hash: 6a700ff59d1eae3cd4f1897966358a388e1f51ee3372cc3160cad33ce14096f4
Instruction Fuzzy Hash: D7518D71B0E643C1FE20AB22A8106BAA360BB85B94FCA4831DD1D577B5EE7CF1558720

Function 00007FF7A0FE6A60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF7A0FE59BA,?,00007FF7A0FE58AD), ref: 00007FF7A0FE6AA0
OpenProcessToken.ADVAPI32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6AB1
GetTokenInformation.KERNELBASE(?,00007FF7A0FE58AD(TokenIntegrityLevel)), ref: 00007FF7A0FE6AD3
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7A0FE6ADD
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF7A0FE6B1A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7A0FE6B2C
CloseHandle.KERNEL32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6B44
LocalFree.KERNEL32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6B76
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7A0FE6B9D
CreateDirectoryW.KERNELBASE(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6BAE

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7A0FE6B59
S-1-3-4, xrefs: 00007FF7A0FE6B4F

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 04a4952acd007a2d57849bf4a7f549880b035f2fca275a5dfd27a02a5c87a0f0
Instruction ID: 34c951fb6fe23c871b6cb8ccc3a4473ff7589764b1697779b4b38b7ac6d21359
Opcode Fuzzy Hash: 04a4952acd007a2d57849bf4a7f549880b035f2fca275a5dfd27a02a5c87a0f0
Instruction Fuzzy Hash: AE41713161D687C2E710EF20E8446AAB361FB84794F854631EA5E577A4DF7CE448CB20

Function 00007FF7A0FE6130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A0FE6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7A0FE2B60,?,?,?,?,?,?), ref: 00007FF7A0FE617F
GetStartupInfoW.KERNEL32 ref: 00007FF7A0FE619E

Part of subcall function 00007FF7A0FF92E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF92F8

Part of subcall function 00007FF7A0FF705C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF70C3

GetCommandLineW.KERNEL32 ref: 00007FF7A0FE623E
CreateProcessW.KERNELBASE ref: 00007FF7A0FE6280
WaitForSingleObject.KERNEL32 ref: 00007FF7A0FE6294
GetExitCodeProcess.KERNELBASE ref: 00007FF7A0FE62A4

Strings

CreateProcessW, xrefs: 00007FF7A0FE62B7
Error creating child process!, xrefs: 00007FF7A0FE62B0

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
Instruction ID: 8425f22972fb6c4705125320dc8d2d1ed0a894da8e2768be2501cc697fa55419
Opcode Fuzzy Hash: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
Instruction Fuzzy Hash: CE411232A0D78685EB20AB74E4452AAF360FF94360F914735E6AD47BE5DF7CE0548B10

Function 00007FF7A0FE1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A0FE2CD0: GetModuleFileNameW.KERNEL32(?,00007FF7A0FE27C9,?,?,?,?,?,?), ref: 00007FF7A0FE2D01

SetDllDirectoryW.KERNEL32 ref: 00007FF7A0FE29D5

Part of subcall function 00007FF7A0FE5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7A0FE2817,?,?,?,?,?,?), ref: 00007FF7A0FE5B2A
Part of subcall function 00007FF7A0FE5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE5B47

Strings

MEI, xrefs: 00007FF7A0FE2917
_MEIPASS2, xrefs: 00007FF7A0FE2803, 00007FF7A0FE286C, 00007FF7A0FE2B1B, 00007FF7A0FE2B2B
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7A0FE295C
Failed to convert DLL search path!, xrefs: 00007FF7A0FE29BD
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7A0FE28BE
_PYI_ONEDIR_MODE, xrefs: 00007FF7A0FE282C, 00007FF7A0FE2857

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 9cc289c9195a371b6f24d31b42917e49a42ba6d60d8658c917f02b3ce32f2aaf
Instruction ID: 556024dbc34c0ee8d1bb4e0d7e29e77bd2abc92c444237f0d78aef6c86a688b3
Opcode Fuzzy Hash: 9cc289c9195a371b6f24d31b42917e49a42ba6d60d8658c917f02b3ce32f2aaf
Instruction Fuzzy Hash: E6C1C721A1E683C5FA60BB3194512FDA350BF44784FC64832EA4D677B6EF6CF6058720

Function 00007FF7A0FE1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7A0FE111F
malloc, xrefs: 00007FF7A0FE10F8, 00007FF7A0FE1126
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7A0FE1249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7A0FE10B4
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7A0FE10F1
1.2.13, xrefs: 00007FF7A0FE107E

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 0-1655038675
Opcode ID: af04965e2dbcd0d8e1621cd66b39530d0b4f4ad9fcd8e07e4d45104bc70e5302
Instruction ID: a97d040d534db438bebab68bced4857eaa38be83f8eebe72435ab77c63a8cc1b
Opcode Fuzzy Hash: af04965e2dbcd0d8e1621cd66b39530d0b4f4ad9fcd8e07e4d45104bc70e5302
Instruction Fuzzy Hash: 2151C632A0E643C5EA60BB22A8403BAB390BB84794FC64935DE4D977A5EE3CF455C710

Function 00007FF7A0FFDF30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF7A0FFE2CA,?,?,-00000018,00007FF7A0FFA383,?,?,?,00007FF7A0FFA27A,?,?,?,00007FF7A0FF54E2), ref: 00007FF7A0FFE0AC
GetProcAddress.KERNEL32(?,00000000,?,00007FF7A0FFE2CA,?,?,-00000018,00007FF7A0FFA383,?,?,?,00007FF7A0FFA27A,?,?,?,00007FF7A0FF54E2), ref: 00007FF7A0FFE0B8

Strings

ext-ms-, xrefs: 00007FF7A0FFE009
api-ms-, xrefs: 00007FF7A0FFDFF6

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
Instruction ID: 1c7500e100ee5bbf0150a1dd0151a66337301a0330c1dab55b15992dc5929fad
Opcode Fuzzy Hash: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
Instruction Fuzzy Hash: 1D413622B1F60389FB11EB269810676A392BF44BD0F8B4935DD0D673A8EE7CF4458324

Function 00007FF7A0FFB08C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFB4B9

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
Instruction ID: 5463a08a91887a50ee6141645eb6728bde037d314db34532b84ed4c981d69689
Opcode Fuzzy Hash: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
Instruction Fuzzy Hash: EBC1F523A0E68789E721AF3594402BEB751EB81B80FD74535DA4E237B1CE7DF8458720

Function 00007FF7A0FFC590 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7A0FFC57B), ref: 00007FF7A0FFC6AC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7A0FFC57B), ref: 00007FF7A0FFC737

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
Instruction ID: 832ec93f454a20827ddc5828f4ba714b060c8656d84a89a966b9ee70d3a1a9c4
Opcode Fuzzy Hash: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
Instruction Fuzzy Hash: 7691C633E0D66389F750AF7585402BDABA0AB44B88F964539DE0E63BA4DF38F445C760

Function 00007FF7A0FFE95C Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7A0FFEA4C
_get_daylight.LIBCMT ref: 00007FF7A0FFEA5D
_get_daylight.LIBCMT ref: 00007FF7A0FFEA6E
_isindst.LIBCMT ref: 00007FF7A0FFEB39

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
Instruction ID: b4e5ad5adfec3c391d48c4afc958090ac7912b07d988daa0485b3257c4703373
Opcode Fuzzy Hash: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
Instruction Fuzzy Hash: 7B510473F0A2124AFB14EF3898A56BCB761AB40358F960535DE1E66BF9DA38B4058710

Function 00007FF7A0FF46E8 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF4715
CreateFileW.KERNELBASE ref: 00007FF7A0FF4754
CloseHandle.KERNEL32 ref: 00007FF7A0FF4789

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 3d6046d72fa2396df0887b114e3627fe285c38a7a8010f89346fd758d181b2b8
Instruction ID: 7b4cf955cf47064b45d86a929a05718054c887a9a782bb0d7f586b49600da0fc
Opcode Fuzzy Hash: 3d6046d72fa2396df0887b114e3627fe285c38a7a8010f89346fd758d181b2b8
Instruction Fuzzy Hash: 4841B023D1D7828BE710AB309510369B360FB957A4F519734EB9C13BE5DF6CB5A08720

Function 00007FF7A0FEA51C Relevance: 4.6, APIs: 3, Instructions: 102COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7A0FEA530

Part of subcall function 00007FF7A0FEA6FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7A0FEA71E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7A0FEA545
__scrt_release_startup_lock.LIBCMT ref: 00007FF7A0FEA5B3

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3058843127-0
Opcode ID: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
Instruction ID: c58678816773adc8572dea1502ebecdbe9700d085d6e65ea43cb223496a5cdc2
Opcode Fuzzy Hash: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
Instruction Fuzzy Hash: 23312C21A0E203C6FA14BB3195513BAA391AF82784FCA4836E60D673F7DE6CF4458671

Function 00007FF7A0FF89E8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7A0FF89E4), ref: 00007FF7A0FF89F9
TerminateProcess.KERNEL32(?,?,?,00007FF7A0FF89E4), ref: 00007FF7A0FF8A04
ExitProcess.KERNEL32 ref: 00007FF7A0FF8A13

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
Instruction ID: e58afa806e5413096c3b60ff6178302a5b6c7e66f9f89971266415482ff021cf
Opcode Fuzzy Hash: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
Instruction Fuzzy Hash: 4ED05E11F0E7039AFB043B30588517AA3119F48700F861838C80F123B3CD7CB46E4A20

Function 00007FF7A0FEE6FC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE740
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE837

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
Instruction ID: 068edfd8a15634ee4025c715f4c78251d1ef34f81c57ba5f54519f62b7455db1
Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
Instruction Fuzzy Hash: 5C51E621B0F643C6E768BA35A41067AA191AF44BA4F9A4E34DD7C137EDCE3CF5018620

Function 00007FF7A0FFBA48 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7A0FFBAC1
GetFileType.KERNELBASE ref: 00007FF7A0FFBAD7

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
Instruction ID: c8ab889cbf557ce8dee64d8b6bab9c487f281dd83bad44e83d157a8321022d64
Opcode Fuzzy Hash: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
Instruction Fuzzy Hash: 4E318122A1DB4785E7609B248580179AA50FB45BB0FAA1739DB6E173F4CF38F4A1D310

Function 00007FF7A0FFB764 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7A0FFB750,00000000,?,?,?,00007FF7A0FE1023,00007FF7A0FFB859), ref: 00007FF7A0FFB7B0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7A0FFB750,00000000,?,?,?,00007FF7A0FE1023,00007FF7A0FFB859), ref: 00007FF7A0FFB7BA

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
Instruction ID: ce2c76060ca20c109cf52a75ca96723dbe856da5695de0d865951e3ac6113a0d
Opcode Fuzzy Hash: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
Instruction Fuzzy Hash: 6411B26361DA8385DA10AB35A444069F361AB84BF4F954731EE7D17BE9CE7CE0548740

Function 00007FF7A0FF6AE8 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FF6965), ref: 00007FF7A0FF6B0B
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FF6965), ref: 00007FF7A0FF6B21

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: ac061897d341fb700666fc9327f8304620b74f462cdcac4e9011de69f9e9d462
Instruction ID: f2ec509b48f983b81f7af627457856376eb2f66d0c5778e75230e3b62bb5160b
Opcode Fuzzy Hash: ac061897d341fb700666fc9327f8304620b74f462cdcac4e9011de69f9e9d462
Instruction Fuzzy Hash: 2301822250D652C6E7506B24E40123AF7A1FB81761F910635F7A9416E4DF7DE050DF20

Function 00007FF7A0FF9F78 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
Instruction ID: 3390cfc0aa41ed6c4d80c58cff6af36a246291e23286fcd9c43fb636b25bf55a
Opcode Fuzzy Hash: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
Instruction Fuzzy Hash: 8BE08651F0F60387FF14BBB15844075E2515F84700BC64434D90EA63B1DE6CB8998730

Function 00007FF7A0FF6850 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?,?,?,?,?), ref: 00007FF7A0FF6854
GetLastError.KERNEL32(?,?,?,?,?), ref: 00007FF7A0FF685E

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: f10b0acbf04ce372ff2bba8e22346aa2cd94a9581c077f1b6ddec38c1268e9e8
Instruction ID: d54d0d15181a73b2087a2f8a8387555f5220ad4a8498c81f8fb4f35c661e242e
Opcode Fuzzy Hash: f10b0acbf04ce372ff2bba8e22346aa2cd94a9581c077f1b6ddec38c1268e9e8
Instruction Fuzzy Hash: 29D0C911E5E50385F61477751C05179A1A02F44760FD20A38D029913F0EE6CF4994621

Function 00007FF7A0FF70D4 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF7A0FF70D8
GetLastError.KERNEL32 ref: 00007FF7A0FF70E2

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: d9df61864aacf0c38aa57b7a7eccc268b2766f97fd3960567bd6780660c5006e
Instruction ID: 9f5cc4d21d8aa431d659cbf09e3c68c90835ce1fff198d696662bdeb92cdc138
Opcode Fuzzy Hash: d9df61864aacf0c38aa57b7a7eccc268b2766f97fd3960567bd6780660c5006e
Instruction Fuzzy Hash: E6D0C911E1E64389FA14377518850BAA6905F44720FD60A74E529903F0EF5DB1990521

Function 00007FF7A0FFA188 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7A0FFA005,?,?,00000000,00007FF7A0FFA0BA), ref: 00007FF7A0FFA1F6
GetLastError.KERNEL32(?,?,?,00007FF7A0FFA005,?,?,00000000,00007FF7A0FFA0BA), ref: 00007FF7A0FFA200

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
Instruction ID: f7b6f67864904d42c8c7961f79971157b68a2f8aac4c15b4abb84a1d20cfcb6c
Opcode Fuzzy Hash: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
Instruction Fuzzy Hash: 37212663F1E24348FE50B33098C027AE2819F84BA0F874636DA2E133E6DE6CB4444710

Function 00007FF7A0FE5DF0 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A0FE6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

_findclose.LIBCMT ref: 00007FF7A0FE6049

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 628285328bb618edcfe9754a4ff814bb64e2feda71a532fcc2d8bd8f687e193b
Instruction ID: 6206cf02c9e34784d3f2995bdcabe25b4df59dba4b49e97f01b35f8a639c9ef9
Opcode Fuzzy Hash: 628285328bb618edcfe9754a4ff814bb64e2feda71a532fcc2d8bd8f687e193b
Instruction Fuzzy Hash: 8F719252E1DAC681E611DB2CC5052FDA360F7A8B4CF95E725DB8C126A2EF28F2D5C700

Function 00007FF7A0FFB4DC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFB504

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
Instruction ID: 5073d467be95b4380257440a31eedc2bbf81d6638c0b249d5825f81afbf83e9d
Opcode Fuzzy Hash: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
Instruction Fuzzy Hash: 1A41B53390E2438BEA24AB39E550179F3A0EB55780F991935D68E937E4DF6CF402C761

Function 00007FF7A0FE6360 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7A0FE640A

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 993a316b67e1a5470b37351ffa5bd549d8cb4e822877a3b89e8fb3a25b8ef871
Instruction ID: 843732166087193c3b4bd479b930939bf04d785a9dc1d593b277d9c581659430
Opcode Fuzzy Hash: 993a316b67e1a5470b37351ffa5bd549d8cb4e822877a3b89e8fb3a25b8ef871
Instruction Fuzzy Hash: CF215121B0E69785EA15FB3269043BAE651BF45BD4FCA4830EE0D277A6CE7DF045C214

Function 00007FF7A0FFAF6C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFAFF2

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
Instruction ID: 0f2d716754e0fe45d6c2ce7c67bf32f5d412338b1a4540310b4de1b779e73c7f
Opcode Fuzzy Hash: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
Instruction Fuzzy Hash: 37318F63A1E60389E7117B75884127DA650AB40B94FD3093AEA2D273F2DE7DF8418770

Function 00007FF7A0FF8919 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7A0FF8947

Part of subcall function 00007FF7A0FF8A40: GetModuleHandleExW.KERNEL32 ref: 00007FF7A0FF8A65
Part of subcall function 00007FF7A0FF8A40: GetProcAddress.KERNEL32 ref: 00007FF7A0FF8A7B
Part of subcall function 00007FF7A0FF8A40: FreeLibrary.KERNEL32 ref: 00007FF7A0FF8AA2

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
Instruction ID: bc1fc2dcc68eb3ed5005af2896d0d64da5a7f992fb900c706428ee22377883fe
Opcode Fuzzy Hash: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
Instruction Fuzzy Hash: 3D219132A0A7038DEB24AF74C4402FC77A0EB04718F891A35D65D16BE5DF78E445C755

Function 00007FF7A0FF5538 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF549D

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
Instruction ID: a8e39c0ad3a5b0698e442d1a8dedbb73d4212c6d20efc95fd47c80e04b83a9b8
Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
Instruction Fuzzy Hash: B711C223E0E64349EA60FF61951027DE260AF81F80F9A4835EB8C677A6CF3DF4404760

Function 00007FF7A10057DC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A10057FF

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
Instruction ID: 1ac43b42f8a601f90f49a0f267b1950a43f1cb6800720d07b62f342ef253a118
Opcode Fuzzy Hash: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
Instruction Fuzzy Hash: 4221C532A19A4287E760AF28D44037AB7B0FB84B54F954234EB5D876E5DF7CD4118F10

Function 00007FF7A0FEE97C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE9D0

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
Instruction ID: 3efcb3ce69b49dab7a9395bf4b0d01a3fffb160dc92fb1e0024ea8bafc60127d
Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
Instruction Fuzzy Hash: DD01A522A0D75381EA44BB72A90016DE695AF95FE0F894A31DE5C63BEACE3CF4018710

Function 00007FF7A0FF64DC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF651A

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ec6a8bbc8393b9a035b98e996b47f7bdc6c1af4ae5fba4cb41e2bad1113de79b
Instruction ID: c4b0075b040b12ec91bc3148c51252f3effc3e208f057d22309f06e670712943
Opcode Fuzzy Hash: ec6a8bbc8393b9a035b98e996b47f7bdc6c1af4ae5fba4cb41e2bad1113de79b
Instruction Fuzzy Hash: 02018E62E0F24344FA60B7756A44139E290AF00798FCE0939EA1DB27EADE6CF8504620

Function 00007FF7A0FF6818 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF6831

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d8ddd072cb9aeb27808c6bd09a31392064f42f391621abce153dcee42f6a1f6e
Instruction ID: 0056be54ce09d4be0b36bd6e4dc79f873d16c22242240485a03e0735e38c7784
Opcode Fuzzy Hash: d8ddd072cb9aeb27808c6bd09a31392064f42f391621abce153dcee42f6a1f6e
Instruction Fuzzy Hash: BBE0EC92E0E2074AF6147AB44DC257891109F94380FD6483CD949663E7DE1DB8499631

Function 00007FF7A0FE6490 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 739fc36d95d46a0547d4d4511d317fb5cae8f37791182581b6b727d6f7db331d
Instruction ID: 1a1973ca1a1dc73f9cd64fa8b89bef9eb9fe2ade4fd59b7ea4bb233115c63fce
Opcode Fuzzy Hash: 739fc36d95d46a0547d4d4511d317fb5cae8f37791182581b6b727d6f7db331d
Instruction Fuzzy Hash: 91419C16E1D7C6C1E611AB3499012BCA360FBA5784F86A732EF8D12257EF28F1D8C310

Function 00007FF7A0FFDEB8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7A0FFAA16,?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E), ref: 00007FF7A0FFDF0D

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
Instruction ID: 60d25a15de4bb44a908ee8fadc611ec979f646ae0b6a7ab853fa07482e191d90
Opcode Fuzzy Hash: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
Instruction Fuzzy Hash: C7F06242B0F20348FF547B7158506B5E2965F55B40FCE4835C90EA63F1DE6CF4968230

Function 00007FF7A0FFCC2C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7A0FEF1E4,?,?,?,00007FF7A0FF06F6,?,?,?,?,?,00007FF7A0FF275D), ref: 00007FF7A0FFCC6A

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
Instruction ID: 7b8295c527dde28eafc97f38e9c7d7b79d26541761fcf5aebc551f257abbd478
Opcode Fuzzy Hash: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
Instruction Fuzzy Hash: D0F05E12B0F29748FE1577725A40676B2805F457A0F8A0A34DD2E553F1DE6CB4519670

Non-executed Functions

Function 00007FF7A0FE2F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2F36
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2F75
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2F9A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2FBF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2FE7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE300F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE3037
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE305F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE3087

Strings

Py_UTF8Mode, xrefs: 00007FF7A0FE30AD
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7A0FE34D9
Failed to get address for PySys_GetObject, xrefs: 00007FF7A0FE35C9
GetProcAddress, xrefs: 00007FF7A0FE2F4F
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7A0FE3731
Failed to get address for Py_SetPath, xrefs: 00007FF7A0FE31B9
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF7A0FE3579
Failed to get address for PyDict_GetItemString, xrefs: 00007FF7A0FE3259
Failed to get address for Py_UTF8Mode, xrefs: 00007FF7A0FE30C9
Failed to get address for Py_SetProgramName, xrefs: 00007FF7A0FE3209
PyDict_GetItemString, xrefs: 00007FF7A0FE323D
Py_FrozenFlag, xrefs: 00007FF7A0FE2F90
PyErr_Print, xrefs: 00007FF7A0FE32B5
Py_OptimizeFlag, xrefs: 00007FF7A0FE302D
PyList_Append, xrefs: 00007FF7A0FE33CD
Failed to get address for PyUnicode_Join, xrefs: 00007FF7A0FE37A9
Failed to get address for Py_VerboseFlag, xrefs: 00007FF7A0FE3071
Failed to get address for Py_SetPythonHome, xrefs: 00007FF7A0FE3231
PySys_SetPath, xrefs: 00007FF7A0FE35FD
PyUnicode_AsUTF8, xrefs: 00007FF7A0FE3765
PySys_AddWarnOption, xrefs: 00007FF7A0FE355D
Failed to get address for PySys_SetObject, xrefs: 00007FF7A0FE35F1
Py_NoSiteFlag, xrefs: 00007FF7A0FE2FDD
Failed to get address for Py_FrozenFlag, xrefs: 00007FF7A0FE2FAC
PyUnicode_DecodeFSDefault, xrefs: 00007FF7A0FE373D
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF7A0FE35A1
PyModule_GetDict, xrefs: 00007FF7A0FE3445
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF7A0FE3099
Py_GetPath, xrefs: 00007FF7A0FE31C5
Failed to get address for Py_DecRef, xrefs: 00007FF7A0FE3119
Failed to get address for PyModule_GetDict, xrefs: 00007FF7A0FE3461
Py_SetProgramName, xrefs: 00007FF7A0FE31ED
PyImport_ImportModule, xrefs: 00007FF7A0FE33A5
PySys_GetObject, xrefs: 00007FF7A0FE35AD
Py_IgnoreEnvironmentFlag, xrefs: 00007FF7A0FE2FB5
PyErr_Restore, xrefs: 00007FF7A0FE3305
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7A0FE36B9
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7A0FE3669
PyUnicode_Replace, xrefs: 00007FF7A0FE37B5
Failed to get address for PyErr_Print, xrefs: 00007FF7A0FE32D1
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7A0FE33C1
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF7A0FE2FD1
Failed to get address for PyMem_RawFree, xrefs: 00007FF7A0FE36E1
Py_UnbufferedStdioFlag, xrefs: 00007FF7A0FE307D
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF7A0FE2F48
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7A0FE3759
PyErr_NormalizeException, xrefs: 00007FF7A0FE332D
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7A0FE3691
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF7A0FE2FF9
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7A0FE3641
Failed to get address for PyLong_AsLong, xrefs: 00007FF7A0FE3439
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7A0FE3781
PyList_New, xrefs: 00007FF7A0FE33F5
Py_NoUserSiteDirectory, xrefs: 00007FF7A0FE3005
PyObject_CallFunction, xrefs: 00007FF7A0FE346D
PyErr_Occurred, xrefs: 00007FF7A0FE328D
Failed to get address for PyErr_Fetch, xrefs: 00007FF7A0FE32F9
PyObject_CallFunctionObjArgs, xrefs: 00007FF7A0FE3495
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7A0FE3551
PySys_SetObject, xrefs: 00007FF7A0FE35D5
Py_DontWriteBytecodeFlag, xrefs: 00007FF7A0FE2F2F
Failed to get address for PyErr_Clear, xrefs: 00007FF7A0FE3281
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7A0FE3709
PyUnicode_FromFormat, xrefs: 00007FF7A0FE36ED
Py_IncRef, xrefs: 00007FF7A0FE314D
PyImport_ExecCodeModule, xrefs: 00007FF7A0FE337D
PyObject_Str, xrefs: 00007FF7A0FE350D
Failed to get address for Py_Initialize, xrefs: 00007FF7A0FE3191
Failed to get address for PyErr_Occurred, xrefs: 00007FF7A0FE32A9
PyLong_AsLong, xrefs: 00007FF7A0FE341D
Failed to get address for PyList_Append, xrefs: 00007FF7A0FE33E9
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7A0FE3489
Failed to get address for PyList_New, xrefs: 00007FF7A0FE3411
Failed to get address for PyErr_Restore, xrefs: 00007FF7A0FE3321
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7A0FE3501
PyErr_Fetch, xrefs: 00007FF7A0FE32DD
Failed to get address for Py_IncRef, xrefs: 00007FF7A0FE3169
Py_DecodeLocale, xrefs: 00007FF7A0FE369D
PyImport_AddModule, xrefs: 00007FF7A0FE3355
Py_Initialize, xrefs: 00007FF7A0FE3175
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF7A0FE2F87
PyUnicode_Join, xrefs: 00007FF7A0FE378D
PyUnicode_Decode, xrefs: 00007FF7A0FE3715
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7A0FE3399
Py_SetPath, xrefs: 00007FF7A0FE319D
Py_VerboseFlag, xrefs: 00007FF7A0FE3055
Failed to get address for PyObject_Str, xrefs: 00007FF7A0FE3529
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7A0FE37D1
Py_DecRef, xrefs: 00007FF7A0FE30FD
PyMarshal_ReadObjectFromString, xrefs: 00007FF7A0FE364D
Failed to get address for Py_BuildValue, xrefs: 00007FF7A0FE30F1
Py_BuildValue, xrefs: 00007FF7A0FE30D5
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF7A0FE3021
Failed to get address for Py_GetPath, xrefs: 00007FF7A0FE31E1
PySys_SetArgvEx, xrefs: 00007FF7A0FE3585
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7A0FE3349
Py_SetPythonHome, xrefs: 00007FF7A0FE3215
PyEval_EvalCode, xrefs: 00007FF7A0FE3625
PyUnicode_FromString, xrefs: 00007FF7A0FE3675
PyErr_Clear, xrefs: 00007FF7A0FE3265
Py_Finalize, xrefs: 00007FF7A0FE3125
Failed to get address for PySys_SetPath, xrefs: 00007FF7A0FE3619
Failed to get address for PyImport_AddModule, xrefs: 00007FF7A0FE3371
Py_FileSystemDefaultEncoding, xrefs: 00007FF7A0FE2F6B
PyMem_RawFree, xrefs: 00007FF7A0FE36C5
Failed to get address for Py_Finalize, xrefs: 00007FF7A0FE3141
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7A0FE34B1
PyObject_GetAttrString, xrefs: 00007FF7A0FE34E5
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF7A0FE3049
PyRun_SimpleStringFlags, xrefs: 00007FF7A0FE3535
PyObject_SetAttrString, xrefs: 00007FF7A0FE34BD

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
Instruction ID: 894c70b344a960cb9a0167f8d7b024dc209ea6b856359841b0bad061bb578792
Opcode Fuzzy Hash: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
Instruction Fuzzy Hash: 9C42DE68A0FB47D1FB54FB14A948176B3A1AF04781BCA5435D84E06378FFECB5689B20

Function 00007FF7A100324C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7A100329A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1003906
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1003A7C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1003D3A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1003F5A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1004197
memcpy_s.LIBCPMT ref: 00007FF7A1004272
memcpy_s.LIBCPMT ref: 00007FF7A100431D
memcpy_s.LIBCPMT ref: 00007FF7A10043EC

Strings

1#SNAN, xrefs: 00007FF7A10033AA
1#IND, xrefs: 00007FF7A1003387
1#QNAN, xrefs: 00007FF7A10033B3
1#INF, xrefs: 00007FF7A10033C3

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 94a7ddbc9dfde8fb095d9bbce1265888f255539b2e0e0fd568165e141f3b5970
Instruction ID: 769a1b235eed9712141b0513d7f44674e35308b3b72741cd6d90a3e68f133985
Opcode Fuzzy Hash: 94a7ddbc9dfde8fb095d9bbce1265888f255539b2e0e0fd568165e141f3b5970
Instruction Fuzzy Hash: 5EB20572B192828FF7259E24D4407FEB7A1FB44348F825135DA0D5BA94DFB8AA10CF54

Function 00007FF7A0FE6670 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(WideCharToMultiByte,00007FF7A0FE1CE4,?,?,00000000,00007FF7A0FE6904), ref: 00007FF7A0FE6697
FormatMessageW.KERNEL32 ref: 00007FF7A0FE66C6
WideCharToMultiByte.KERNEL32 ref: 00007FF7A0FE671C

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7A0FE6726
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7A0FE6739
No error messages generated., xrefs: 00007FF7A0FE66D0
WideCharToMultiByte, xrefs: 00007FF7A0FE6670, 00007FF7A0FE672D
PyInstaller: FormatMessageW failed., xrefs: 00007FF7A0FE66E3
FormatMessageW, xrefs: 00007FF7A0FE66D7

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorLast$ByteCharFormatMessageMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2383786077-2573406579
Opcode ID: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
Instruction ID: 7f02f95556f4eb5cbe42aea558fc1df5f2e19fd4a4f97b92b7f33852a94631cb
Opcode Fuzzy Hash: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
Instruction Fuzzy Hash: 1121AF31A1EA47C1FB60BB25E8446AAB365FB48384FC60135E54D927B4EF7CE1198B20

Function 00007FF7A0FEAA2C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7A0FEAA48
RtlCaptureContext.KERNEL32 ref: 00007FF7A0FEAA75
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A0FEAA8F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A0FEAAD0
IsDebuggerPresent.KERNEL32 ref: 00007FF7A0FEAB24
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FEAB45
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FEAB50

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
Instruction ID: 65c4408e85e13c48355ea3a47fa881d158b505ddd24887d27d1ebb40e3841358
Opcode Fuzzy Hash: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
Instruction Fuzzy Hash: F2316572609B82C6EB609F60E8403EEB365FB84744F85443ADA4D57794DF7CD658C720

Function 00007FF7A0FF9C44 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7A0FF9CBD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A0FF9CD5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A0FF9D10
IsDebuggerPresent.KERNEL32 ref: 00007FF7A0FF9D49
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FF9D53
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FF9D5E

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
Instruction ID: 410f41abf22ace8a9b9ee82eae3ff362fcb1bdbe64dd3d3d72de2daa626ece71
Opcode Fuzzy Hash: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
Instruction Fuzzy Hash: 0F315132619B82C6E760DF25E8402EEB3A4FB88794F950536EA8D53B64DF3CD155CB10

Function 00007FF7A1000A34 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1000A80
FindFirstFileExW.KERNEL32 ref: 00007FF7A1000B8A

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
Instruction ID: b25d6f7195e529e0be4cd2f455d680eb5e8fcd52451b616e01b757171ced677c
Opcode Fuzzy Hash: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
Instruction Fuzzy Hash: D6B1C72AB1EA8641FB60BB2194005BEF350EB44BD4F854132E94F57BE9DE7CE451CB20

Function 00007FF7A1002DB0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7A1002E16
memcpy_s.LIBCPMT ref: 00007FF7A1002E41

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 413e53abe3a835b59a801d283ee1d98d2f57f10aaac7921013a377831f66b63b
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 5DC11572B1A2868BE725DF19A04466BF7A1F788784F828138DB4E47754DB7DE911CF00

Function 00007FF7A1008BE8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7A1008E37
RaiseException.KERNEL32 ref: 00007FF7A1008E48

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: ce95b3d84f14f29cd4e01f3d624d654ffebb0793079cdf733c9da6505e2ad06c
Instruction ID: 6ca02552d587428e44eaa527fa8cc24991fb14b2013c0cf8ec8d3477e8f1ee70
Opcode Fuzzy Hash: ce95b3d84f14f29cd4e01f3d624d654ffebb0793079cdf733c9da6505e2ad06c
Instruction Fuzzy Hash: FBB1B073A01B998BEB15DF29C84536E7BA0F740B48F158922DB5D83BB4CB79D861CB10

Function 00007FF7A0FE69E0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7A0FE6A11
FindClose.KERNEL32 ref: 00007FF7A0FE6A20

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0b7e5a9930ef76a70c4e782aa580d8521c3892be20b9910ca6b4e20049941746
Instruction ID: d7a343d4ce8f52a35c456f4129c416dbf6bcec078992dbb504a5aaa8cad8ef09
Opcode Fuzzy Hash: 0b7e5a9930ef76a70c4e782aa580d8521c3892be20b9910ca6b4e20049941746
Instruction Fuzzy Hash: 52F0F432A1E686C6F760EF70E89836BB350AB44764F864735E66D127E4DF3CE0188B10

Function 00007FF7A0FF2A18 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7A0FF2B86
, xrefs: 00007FF7A0FF2DC8

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 12f3629fc0db3b94ce06ee7fe38b00bcc3d57b8cb20d1c91e47922b02d0d68b8
Instruction ID: 06ccbec6a59059b0564c97c5fc3ee29df31c882e874162f7148984a50b8f210a
Opcode Fuzzy Hash: 12f3629fc0db3b94ce06ee7fe38b00bcc3d57b8cb20d1c91e47922b02d0d68b8
Instruction Fuzzy Hash: 0EE1943390E6478AEBA8AE35805017DB3A0FB45B58F964935DE4E277B4DF29F841C720

Function 00007FF7A0FFD1F8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7A0FFD382
e+000, xrefs: 00007FF7A0FFD305

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 7f3e0c3824b7b5cf876389fd48d0d53d421d0873473af5a4edca9f3cc5d4c2f0
Instruction ID: 489132a5a59218ac27cab9499e431e00a259d1c156e7cac2a9eb8d569bec96a3
Opcode Fuzzy Hash: 7f3e0c3824b7b5cf876389fd48d0d53d421d0873473af5a4edca9f3cc5d4c2f0
Instruction Fuzzy Hash: 26517823B1E6C24AE7249E359800769FB92E744B94F8A8631CB9857BE5CF3DF400C711

Function 00007FF7A0FFCD64 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7A0FFD0A6

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
Instruction ID: 357dfcd97f2c64a07a58075db417fe4afc55c3e5288d43b230159fd7b3e8d060
Opcode Fuzzy Hash: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
Instruction Fuzzy Hash: CBA15763A0E7974AEB21DB3591007A9F792EB50B84F468432DE4D577E5EE3DE402C321

Function 00007FF7A0FF70FC Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7A0FF711B

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 549cbbde4d05edb679bd0e1e8d8321e2e2e00e2b49b4b0b32e90adc79d383972
Instruction ID: 2a9c23f25177135ba4763725bf3017521e70d1edc9912c72277db3e444e2f2c3
Opcode Fuzzy Hash: 549cbbde4d05edb679bd0e1e8d8321e2e2e00e2b49b4b0b32e90adc79d383972
Instruction Fuzzy Hash: D251D316F0E30345FA68BA36598057AE291AF50BC4FCA4834DE0E677F5EE7DF4168620

Function 00007FF7A1002620 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7A1002624

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 5644672d7aec8b178d5bd48a95ace976e45fdc56d1edf0a539dccc581205543b
Instruction ID: 10679c59ff535538733e286be5083fe723bf0d77db4bcc8e016ca36f63b41c6a
Opcode Fuzzy Hash: 5644672d7aec8b178d5bd48a95ace976e45fdc56d1edf0a539dccc581205543b
Instruction Fuzzy Hash: 43B09220E07B02C2FB083B216C82615B3A47F58B20FDA4078C10C40330DFAC24BA5B20

Function 00007FF7A0FF21DC Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7d821e27f440e8d5d3622ff09e7c05bc36f3fd6b9038f787498be69d76432a
Instruction ID: e7bcf9cddad72d98170b949407246c96520d00beeb4e34e4f1fd8de60fd915e4
Opcode Fuzzy Hash: 7d7d821e27f440e8d5d3622ff09e7c05bc36f3fd6b9038f787498be69d76432a
Instruction Fuzzy Hash: DAE1A573A0E6038DF7A8AA38855437CA791AB45B54F9A4A35CA0D663F5CF2DF841C720

Function 00007FF7A0FF2614 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f3b43ccd68eb767627d2655b116bae7479589a7f74a5058ab0c91b2e39ac12
Instruction ID: 853f6af17829300ead8476e84a33afadbe31d80ea6f51d0dc23693f54835cdb1
Opcode Fuzzy Hash: c2f3b43ccd68eb767627d2655b116bae7479589a7f74a5058ab0c91b2e39ac12
Instruction Fuzzy Hash: DAD1D533A0E64389EBA8AA35805027DA7A0FB05B48F964935CE0D677B4DF3DF841D760

Function 00007FF7A0FE7420 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b723f182358e09e7314f6f73ac964ac7abcdc7414507ad18988289416ad7b41b
Instruction ID: 20dacfd6bc6176b876ea43758f19ee7b8515b511c4eedf3989e3ee106d57a128
Opcode Fuzzy Hash: b723f182358e09e7314f6f73ac964ac7abcdc7414507ad18988289416ad7b41b
Instruction Fuzzy Hash: C2C1E6722241E08BE689EB29F45987A73D2F788309FD9403AEB8747785CA3DE414D760

Function 00007FF7A0FF132C Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5c392cbfffe41992f0743bc4a0c2c3fe46246456b6811ff0c5dafdd99ec142
Instruction ID: 3d17c9a60d650b385788bf73f28e4c6ac2c81dd080fc6da169718b28177c7f8c
Opcode Fuzzy Hash: 6c5c392cbfffe41992f0743bc4a0c2c3fe46246456b6811ff0c5dafdd99ec142
Instruction Fuzzy Hash: 11B18E73A0E68689EF64DF39C05023DBBA0FB45B48F5A0535DA4E673A9DF29E440C720

Function 00007FF7A0FF16C4 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85060b88648c64536cd03416e20448513b0a4375a109c0566769b76d71526d0c
Instruction ID: ef91cfb99f44eb25054133534c4b7a7b4c044b1777dae6a0ee924e2961392047
Opcode Fuzzy Hash: 85060b88648c64536cd03416e20448513b0a4375a109c0566769b76d71526d0c
Instruction Fuzzy Hash: CEB19E73A0E68689EB65AF39C05023CBBA0F745F48FA60535CA4E673A5CF79E441C760

Function 00007FF7A0FFD878 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ad0bfc87d4107bda453f5e7c9a116e1e97c6e992cf3a610b4e267b4cffcaca
Instruction ID: c1272e3c84bdbda763af44f6e2bb3b2a52306680ad637abf9f0d1a42d261c7c9
Opcode Fuzzy Hash: 59ad0bfc87d4107bda453f5e7c9a116e1e97c6e992cf3a610b4e267b4cffcaca
Instruction Fuzzy Hash: 7A81F473A0E7828AEB74DF299040369B692FB857D4F954635DA9D53BA9CF3CE400CB10

Function 00007FF7A10058A0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8dfee0b8021c5070d705f5e50186fe905afbb1e28c839da737e773f9c2d0648d
Instruction ID: 34f65db68a731fabc98acffb42cd2870d267cc460f3a60567ade0338d9b68518
Opcode Fuzzy Hash: 8dfee0b8021c5070d705f5e50186fe905afbb1e28c839da737e773f9c2d0648d
Instruction Fuzzy Hash: 0C611D22E1E38245F764A528848433FF7A1AF41770FDA4239D65EC76E5DEEDE8508B20

Function 00007FF7A0FF0354 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
Instruction ID: 1f971dcb417bea481079485db07f538bd8c35c81760a786ed281ab3443b46afc
Opcode Fuzzy Hash: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
Instruction Fuzzy Hash: 0C51B177A1E6578AE7249B39C040238B3A0EB44B68F694531CE8C277B5CB7AFC52C750

Function 00007FF7A0FEFF44 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
Instruction ID: 1e94f4ae017dd50f25d4f946a596396c6b48a6b850277649d9115c55aa64187b
Opcode Fuzzy Hash: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
Instruction Fuzzy Hash: 2F518037A1EA52C6E7249B39D040328A7A0EB85B68F654631DA4D277A4CF3AFC52C750

Function 00007FF7A0FF0764 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
Instruction ID: 2765c3fa52ad2999dc4dad6d091df1c59be7995c760d0b4f9c95a2acb353bff7
Opcode Fuzzy Hash: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
Instruction Fuzzy Hash: 47516177A1E6538AE7249B39C040239A3A0EB54B68F664531CA4D277A5DB3AFC43C790

Function 00007FF7A0FF0150 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
Instruction ID: 3566af218783fce917167628d6c70b96247f2d353469023902ed10798d664341
Opcode Fuzzy Hash: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
Instruction Fuzzy Hash: 3A51B337A1E6528AE7649B39C04423DA7A1EB44B58FA59531CE4C277B4CF3AFC42C760

Function 00007FF7A0FEFD40 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
Instruction ID: 2ff37a4da00de5490b33b97d05c594c08fa0ff6f251391ad88dcf837bc9e5309
Opcode Fuzzy Hash: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
Instruction Fuzzy Hash: 7A519133A1E652C6E7349F39C440328B7A0EB45B58FA64531CA4C677B5CB3AF866C790

Function 00007FF7A0FF0560 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
Instruction ID: 038ff01127008787ac2dbec83f2288c616df70bcf7b369ce21ce9ab7dc6f9fbc
Opcode Fuzzy Hash: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
Instruction Fuzzy Hash: E451B637A1E6568AE7249B38C040238A3A1EB84B58F694531CE4D677B4DF3AFC53CB50

Function 00007FF7A0FF4FC0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
Instruction ID: 47021bb4cab0baa89f11dbc579b0a3203d8812605c8e991274dfd794d963ee7d
Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
Instruction Fuzzy Hash: 82419153D4F64B0CE955993807007B8A680AF63FA0D9A6AB4EE99373F7CD0D7587C160

Function 00007FF7A0FF8D00 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 71af8a295fdb51eaf04f4fd3d3cb7b5e4e2b88d375af3dc160b99af84fd8c420
Instruction ID: 69fe04271dbf29c26f1b45983dea2b2cbcab12cf14ff74c2c312956438dd8179
Opcode Fuzzy Hash: 71af8a295fdb51eaf04f4fd3d3cb7b5e4e2b88d375af3dc160b99af84fd8c420
Instruction Fuzzy Hash: 52414863B19A4586FF04DF3AD914169B391BB48FD0B8A9432EE0D97B64EE3CD1428300

Function 00007FF7A0FF66C4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff02aa40d47e1f81f312e06ee07fce20c9eb6e0e746124aa9fd8eb4087d69ca8
Instruction ID: 1ad1cfcc142395a1427da151860067f456bf369a51501425548976b9a8feae15
Opcode Fuzzy Hash: ff02aa40d47e1f81f312e06ee07fce20c9eb6e0e746124aa9fd8eb4087d69ca8
Instruction Fuzzy Hash: 1B31A33371EB4386E714BF35A84012EA695AF84BA0F95463CEA4E63BE5DF3CE4124714

Function 00007FF7A1008A30 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7304cda62ef4e3fce1e8e531a8e9660a3231e70ec23179b9d25e44c0445acc
Instruction ID: 7ee7d7c1462b4b6111138f6ab402369257b9f97d1ba268260bce0e3f9b8fa594
Opcode Fuzzy Hash: 0a7304cda62ef4e3fce1e8e531a8e9660a3231e70ec23179b9d25e44c0445acc
Instruction Fuzzy Hash: 9BF06871B292568AEB989F69E40262A77D0F7083C0F90C07AD68D83F24D67C94608F14

Function 00007FF7A0FEABD4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
Instruction ID: 6978234b67a65d668135e19dc442e943d05118cf71b876c7d4cad4305754ece1
Opcode Fuzzy Hash: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
Instruction Fuzzy Hash: BAA0012990E803D0E644AB20A860161A321BB98340B8A0532D04D511B0AE6CB8608760

Function 00007FF7A0FE4730 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A0FE6310: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE6333

GetProcAddress.KERNEL32 ref: 00007FF7A0FE50C7
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5106
GetProcAddress.KERNEL32 ref: 00007FF7A0FE512B
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5150
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5178
GetProcAddress.KERNEL32 ref: 00007FF7A0FE51A0
GetProcAddress.KERNEL32 ref: 00007FF7A0FE51C8
GetProcAddress.KERNEL32 ref: 00007FF7A0FE51F0
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5218

Strings

Tcl_CreateThread, xrefs: 00007FF7A0FE51E6
Failed to get address for Tcl_Free, xrefs: 00007FF7A0FE554A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7A0FE52CA
GetProcAddress, xrefs: 00007FF7A0FE50E0
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7A0FE54AA
Tcl_DeleteInterp, xrefs: 00007FF7A0FE51BE
Tcl_GetCurrentThread, xrefs: 00007FF7A0FE520E
Failed to get address for Tk_Init, xrefs: 00007FF7A0FE5572
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7A0FE531A
Tcl_ThreadAlert, xrefs: 00007FF7A0FE5326
Tcl_MutexUnlock, xrefs: 00007FF7A0FE525E
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7A0FE545A
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7A0FE5342
Tcl_FinalizeThread, xrefs: 00007FF7A0FE5196
Tcl_EvalObjv, xrefs: 00007FF7A0FE54DE
Tcl_Alloc, xrefs: 00007FF7A0FE5506
Tcl_ThreadQueueEvent, xrefs: 00007FF7A0FE52FE
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7A0FE5482
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7A0FE51DA
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7A0FE5202
Failed to get address for Tcl_Finalize, xrefs: 00007FF7A0FE518A
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7A0FE536A
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF7A0FE477A
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7A0FE540A
Tcl_Init, xrefs: 00007FF7A0FE50C0
Tcl_GetVar2, xrefs: 00007FF7A0FE534E
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7A0FE527A
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7A0FE559A
Tcl_FindExecutable, xrefs: 00007FF7A0FE5121
Tcl_Finalize, xrefs: 00007FF7A0FE516E
Tcl_ConditionNotify, xrefs: 00007FF7A0FE52AE
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7A0FE5118
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7A0FE54FA
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7A0FE52F2
Tcl_DoOneEvent, xrefs: 00007FF7A0FE5146
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7A0FE54D2
Tcl_NewByteArrayObj, xrefs: 00007FF7A0FE5416
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7A0FE513D
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7A0FE5162
Tk_GetNumMainWindows, xrefs: 00007FF7A0FE557E
Tcl_CreateObjCommand, xrefs: 00007FF7A0FE539E
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7A0FE5252
Failed to get address for Tcl_GetString, xrefs: 00007FF7A0FE53E2
Failed to get address for Tcl_Alloc, xrefs: 00007FF7A0FE5522
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7A0FE51B2
Tcl_Free, xrefs: 00007FF7A0FE552E
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7A0FE522A
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7A0FE52A2
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7A0FE53BA
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7A0FE5432
Tcl_CreateInterp, xrefs: 00007FF7A0FE50FC
Tcl_MutexLock, xrefs: 00007FF7A0FE5236
Tcl_GetObjResult, xrefs: 00007FF7A0FE5466
Tcl_ConditionFinalize, xrefs: 00007FF7A0FE5286
Tcl_NewStringObj, xrefs: 00007FF7A0FE53EE
Tcl_EvalFile, xrefs: 00007FF7A0FE548E
Failed to get address for Tcl_Init, xrefs: 00007FF7A0FE50D9
Tcl_EvalEx, xrefs: 00007FF7A0FE54B6
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7A0FE5392
Tk_Init, xrefs: 00007FF7A0FE5556
Tcl_GetString, xrefs: 00007FF7A0FE53C6
Tcl_ConditionWait, xrefs: 00007FF7A0FE52D6
Tcl_SetVar2Ex, xrefs: 00007FF7A0FE543E
Tcl_SetVar2, xrefs: 00007FF7A0FE5376

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
Instruction ID: 1e1312ffbf3155ff6f875402f7222400617e2bf4cb4dbc8870ed8000b53fe5c1
Opcode Fuzzy Hash: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
Instruction Fuzzy Hash: 96E1D564E0FB03C0FB54FB54A950176B3A2AF04B90BDB9471D90D167B4EFACB5689B20

Function 00007FF7A0FE6BF0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7A0FE6C2C

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF7A0FE6CA6
Out of memory., xrefs: 00007FF7A0FE6C70, 00007FF7A0FE6D12
Failed to encode filename as ANSI., xrefs: 00007FF7A0FE6D45
WideCharToMultiByte, xrefs: 00007FF7A0FE6D4C
Failed to get ANSI buffer size., xrefs: 00007FF7A0FE6CED
win32_utils_from_utf8, xrefs: 00007FF7A0FE6C69
Failed to get wchar_t buffer size., xrefs: 00007FF7A0FE6C39
MultiByteToWideChar, xrefs: 00007FF7A0FE6C40, 00007FF7A0FE6CAD
win32_wcs_to_mbs, xrefs: 00007FF7A0FE6D0B

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
API String ID: 203985260-1562484376
Opcode ID: 3649c6f93bb09270b823ff22ec7b0eec6d42e79460650eefbf3c7b929506c9f8
Instruction ID: 4dbc4542f05a7c0d9f5d8de521071bb6d408ef0a3d75bc4fbf6a0370f0e743a5
Opcode Fuzzy Hash: 3649c6f93bb09270b823ff22ec7b0eec6d42e79460650eefbf3c7b929506c9f8
Instruction Fuzzy Hash: BD41AC31A0EA4781F720BB26AC4007AB7A1AB94BD0FD64935E94D57BB5EF7CF1118720

Function 00007FF7A0FEF5C8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEF608
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEF9D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEFC6F

Strings

f, xrefs: 00007FF7A0FEF70A
p, xrefs: 00007FF7A0FEF6AD
p, xrefs: 00007FF7A0FEF712
f, xrefs: 00007FF7A0FEF6A0
f, xrefs: 00007FF7A0FEF855

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
Instruction ID: 1376f2ed82f21cc8a3053e6375fd8c82302e73d3daa04c5f69775688a4e2ed8a
Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
Instruction Fuzzy Hash: 72129122E0E143C6FB207A34E45477AF651EB80754FD64832D68A667E4DF3CF4A88B21

Function 00007FF7A0FE12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF7A0FE1319
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A0FE1312
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A0FE12E2
malloc, xrefs: 00007FF7A0FE1353
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A0FE13E2
fread, xrefs: 00007FF7A0FE13E9
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7A0FE134C

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 0-3659356012
Opcode ID: 66106678d73968f8f9bf7a6153e1cbcb228120b56c71b69a984f9e797006a6c3
Instruction ID: 740288d7a6f258cde2a65b09df276193882e5df21fa283da16f27b5c43a81cd6
Opcode Fuzzy Hash: 66106678d73968f8f9bf7a6153e1cbcb228120b56c71b69a984f9e797006a6c3
Instruction Fuzzy Hash: 05417331A0E643C5FE10EB26A8402AAE3A1FB447D0FD64832DA4D57B65EE7CF541C710

Function 00007FF7A0FECF90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7A0FECFED

Part of subcall function 00007FF7A0FEDF00: __GetUnwindTryBlock.LIBCMT ref: 00007FF7A0FEDF43
Part of subcall function 00007FF7A0FEDF00: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7A0FEDF68

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7A0FED0C5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7A0FED31A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7A0FED426

Strings

csm, xrefs: 00007FF7A0FED007
csm, xrefs: 00007FF7A0FED06E
csm, xrefs: 00007FF7A0FED0E8

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
Instruction ID: 35646820e0ffd6beca7f766515bdad3345d96875fc14ce1adb297487633da4fa
Opcode Fuzzy Hash: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
Instruction Fuzzy Hash: 28E18132A0E742CAEB20AB7594402ADB7A0FB44B98F410935EF4D67BA5CF38F581C751

Function 00007FF7A0FE67C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE685F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE68AF

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7A0FE68D8
Out of memory., xrefs: 00007FF7A0FE68E1
Failed to get UTF-8 buffer size., xrefs: 00007FF7A0FE68F1
WideCharToMultiByte, xrefs: 00007FF7A0FE68F8
win32_utils_to_utf8, xrefs: 00007FF7A0FE68E8

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 8d77172852237fffccb974c6d54fb7d37946d1ed41806d5f964de7f541550d5e
Instruction ID: 5c4f35b75a9974c4a8a0ead7dab40317ae771b5907a4ae1a0061a937b4fc281f
Opcode Fuzzy Hash: 8d77172852237fffccb974c6d54fb7d37946d1ed41806d5f964de7f541550d5e
Instruction Fuzzy Hash: 72418F32A0EB86C5E720EF21B84016AF7A4FB84790F9A4535DA8D53BA5DF3CE456C710

Function 00007FF7A0FE6EC0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00007FF7A0FE2D35,?,?,?,?,?,?), ref: 00007FF7A0FE6F01

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

WideCharToMultiByte.KERNEL32(00000000,00007FF7A0FE2D35,?,?,?,?,?,?), ref: 00007FF7A0FE6F75

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7A0FE6F7F
Out of memory., xrefs: 00007FF7A0FE6F3B
Failed to get UTF-8 buffer size., xrefs: 00007FF7A0FE6F0E
WideCharToMultiByte, xrefs: 00007FF7A0FE6F15, 00007FF7A0FE6F86
win32_utils_to_utf8, xrefs: 00007FF7A0FE6F42

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1717984340-27947307
Opcode ID: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
Instruction ID: 868a5c692a679927c1a713e24e5e62ccca2b5dcaf26b81d3eb04cf931a0dba97
Opcode Fuzzy Hash: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
Instruction Fuzzy Hash: 1C218F31A0EB47C5EB10EF66AD40069F761AB84BD0B9A4936D60D937B4EF7CF4148710

Function 00007FF7A0FF93C4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF9407
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF97F4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF9A90

Strings

p, xrefs: 00007FF7A0FF94B9
p, xrefs: 00007FF7A0FF9531
f, xrefs: 00007FF7A0FF9529

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
Instruction ID: 7f2ba4d71a3e605b990f9ebccbae81249e5ad05052547974ca69faa27e316fb4
Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
Instruction Fuzzy Hash: C6128F23E0E2438BFB64BE259054279B691EB80754FDA4835D68B667E4DB3CF580CB24

Function 00007FF7A0FE6FB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7A0FE7045
MultiByteToWideChar.KERNEL32 ref: 00007FF7A0FE7087

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF7A0FE70AD
Out of memory., xrefs: 00007FF7A0FE70B6
win32_utils_from_utf8, xrefs: 00007FF7A0FE70BD
Failed to get wchar_t buffer size., xrefs: 00007FF7A0FE70C6
MultiByteToWideChar, xrefs: 00007FF7A0FE70CD

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 9e091cbaac830d0070f3842cc1d5ec76c8d2d2f90cb19691d00490de1532936c
Instruction ID: 93cf522844e28c3f99538b463e2291c0075f913f8895167438c805dc14e63813
Opcode Fuzzy Hash: 9e091cbaac830d0070f3842cc1d5ec76c8d2d2f90cb19691d00490de1532936c
Instruction Fuzzy Hash: 30415E32A0EB83C6E620EF25A84016AB6A5FB84790F964535EA4D57BB4DF3CE452C710

Function 00007FF7A0FEC248 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC2CD
GetLastError.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC2DB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC305
FreeLibrary.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC34B
GetProcAddress.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC357

Strings

api-ms-, xrefs: 00007FF7A0FEC2ED

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
Instruction ID: 182f602713a5d4a495b2c887e662605aa1106808852997e7545fe454b59de3af
Opcode Fuzzy Hash: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
Instruction Fuzzy Hash: F331D221A0F603C5FE51EB22A400679B394FF08BA0F8A8935EE1D56364EF3CF0468764

Function 00007FF7A0FE55E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A0FE6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7A0FE592F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7A0FE563F

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7A0FE569A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7A0FE5616
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7A0FE5653

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 2001182103-3498232454
Opcode ID: aa564683267f47d688a8517bb88a9b0a9054f6e1f4b3a9048b672f302df95511
Instruction ID: 45303cd5b6fe38ab36463e0350fe55557fe3b0614eb00d994b8378dbb345b133
Opcode Fuzzy Hash: aa564683267f47d688a8517bb88a9b0a9054f6e1f4b3a9048b672f302df95511
Instruction Fuzzy Hash: EE319551F1E787C0FA20F73599552BAE251AF987C0FC64835DA4E627B6EE6CF1048620

Function 00007FF7A0FE6DB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6E70

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF7A0FE6E7A
Out of memory., xrefs: 00007FF7A0FE6E32
win32_utils_from_utf8, xrefs: 00007FF7A0FE6E39
Failed to get wchar_t buffer size., xrefs: 00007FF7A0FE6DF7
MultiByteToWideChar, xrefs: 00007FF7A0FE6DFE, 00007FF7A0FE6E81

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1717984340-876015163
Opcode ID: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
Instruction ID: 9e23e5d207b52d7c345b156b0d306be23436765d22af0750b3233c9b118a1b45
Opcode Fuzzy Hash: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
Instruction Fuzzy Hash: 65218525B0DA4281EB20EB29F90016AF761FB847C4F994531DB4C93BB9EE6CE5618B10

Function 00007FF7A0FFA780 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA78F
FlsGetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA7A4
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA7C5
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA7F2
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA803
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA814
SetLastError.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA82F

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 69b8ad2768efc01d88fd7f8132853dff404c26667984aa111fd74584065afc1c
Instruction ID: 1fb7bb6ca5008547a7bedc54972005c1b6681a96b200ffce9a3c6eca03b0ed47
Opcode Fuzzy Hash: 69b8ad2768efc01d88fd7f8132853dff404c26667984aa111fd74584065afc1c
Instruction Fuzzy Hash: 4B21CF22E0F2034AFA587334555513AE1524F447E0F864F32E83E27BFAEEACB4018221

Function 00007FF7A10070EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7A100711D
GetLastError.KERNEL32 ref: 00007FF7A1007129
CloseHandle.KERNEL32 ref: 00007FF7A1007141
CreateFileW.KERNEL32 ref: 00007FF7A100716C
WriteConsoleW.KERNEL32 ref: 00007FF7A100718B

Strings

CONOUT$, xrefs: 00007FF7A100714D

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
Instruction ID: 9b49fa47425af62f293bdc3b6b76db92b8217f5e1286a45095ecf0cf76b4e36c
Opcode Fuzzy Hash: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
Instruction Fuzzy Hash: A711D621719A41C6F3509B46E85436AB7A0FB48BE4F860234EA5E437A0DFBCD4248B10

Function 00007FF7A0FFA8F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA907
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA93D
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA96A
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA97B
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA98C
SetLastError.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA9A7

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 9b225a077f4281318a7ef705813386e144cc6119260bee2e0aedcf55e065e7dc
Instruction ID: 094714f0d5656302f15b55ba7ca6b3e46e64998b9a29ae4773c1d0867c864eff
Opcode Fuzzy Hash: 9b225a077f4281318a7ef705813386e144cc6119260bee2e0aedcf55e065e7dc
Instruction Fuzzy Hash: 9E118E62E0F2034AF6647735595113AE2564F457B0F874B36E82E277FAEEACB4404621

Function 00007FF7A0FEBC08 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A0FEBC33
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7A0FEBCC8
RtlUnwindEx.KERNEL32 ref: 00007FF7A0FEBD17

Strings

f, xrefs: 00007FF7A0FEBC46
csm, xrefs: 00007FF7A0FEBCAE

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
Instruction ID: 1f3cd410928f786d26bebffb71ace2f72bc76f173cbc22f800c298f38bed488b
Opcode Fuzzy Hash: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
Instruction Fuzzy Hash: 9C51C731A0E607C6E724EF25E844A6AB795FF44B88F928930EA4E57758DF78F841C710

Function 00007FF7A0FF8A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7A0FF8A65
GetProcAddress.KERNEL32 ref: 00007FF7A0FF8A7B
FreeLibrary.KERNEL32 ref: 00007FF7A0FF8AA2

Strings

CorExitProcess, xrefs: 00007FF7A0FF8A74
mscoree.dll, xrefs: 00007FF7A0FF8A5C

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
Instruction ID: 2c7d178b77e54cd06e99e70d2dd5575f63cd51a1c6cfebc2a750a76fbfedb4c4
Opcode Fuzzy Hash: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
Instruction Fuzzy Hash: 64F0A42160E70781FB14AB24E44433AA360EF45760F994635DA6D452F0DF7CD059C720

Function 00007FF7A1008824 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7A100884C
_set_statfp.LIBCMT ref: 00007FF7A1008867
_set_statfp.LIBCMT ref: 00007FF7A1008883
_set_statfp.LIBCMT ref: 00007FF7A10088BF

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: a61ab7e3ddfef7993947f84cd1a861545593166b489affc3b43af5734c096617
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 63115122D19A2201F7583124F445377B3417F54364FDA063BE66E46EF7CFAC96604B21

Function 00007FF7A0FFA9C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFA9DF
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFA9FE
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFAA26
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFAA37
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFAA48

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7e9f7daeefede5d6cf057412dd821cf39c29068a7a1c9ec5056b211d60d8f6b4
Instruction ID: 0d34eb0bfa98a57a037437e75d6176c8d433dab1f813a0902e9e3eb3b3174e35
Opcode Fuzzy Hash: 7e9f7daeefede5d6cf057412dd821cf39c29068a7a1c9ec5056b211d60d8f6b4
Instruction Fuzzy Hash: 6511D252F0F60349FA587335995113AE1425F407A0F8A5B32D83E277FAEE6CF5018621

Function 00007FF7A0FFA854 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA865
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA884
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA8AC
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA8BD
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA8CE

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: beb9e1a05ea758e4ab17276de5b2837cba649d003c822ebdac11e23849688a82
Instruction ID: 5efd20efc5296850051bb42871049d5ee472620afb2a9e060b331497b723cc90
Opcode Fuzzy Hash: beb9e1a05ea758e4ab17276de5b2837cba649d003c822ebdac11e23849688a82
Instruction Fuzzy Hash: 18112152E0F20349FA587375485117AD1564F453B0EDA4F36D83E2A3F6EDACB4418631

Function 00007FF7A0FFF218 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFF4F7

Part of subcall function 00007FF7A10054F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005511

Strings

UTF-16LEUNICODE, xrefs: 00007FF7A0FFF495
UTF-8, xrefs: 00007FF7A0FFF476
ccs, xrefs: 00007FF7A0FFF432

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
Instruction ID: 293fc3dd89f73f03c9ec8142df3124491b173244bcd4a63a3f3c3c3e82a65f0c
Opcode Fuzzy Hash: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
Instruction Fuzzy Hash: 76817033E0E2038DF764AE35C15027DA6A0AF11B44FD74835DA0AA73B5DB2DB9299721

Function 00007FF7A0FED468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7A0FED4B4
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7A0FED503

Strings

RCC, xrefs: 00007FF7A0FED4D1
MOC, xrefs: 00007FF7A0FED4C8

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
Instruction ID: 21259876b261b5e62deee886bb36e270fc330fb23cf49f49b6149484f0152c21
Opcode Fuzzy Hash: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
Instruction Fuzzy Hash: 7A615933A0AB46CAE720AF65D4403ADB7A0FB44B88F454625EF5D27BA8CB38E155C710

Function 00007FF7A0FED7C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A0FED7EC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7A0FED8D4

Strings

csm, xrefs: 00007FF7A0FED80E
csm, xrefs: 00007FF7A0FED926

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
Instruction ID: 0c1da04b581f2884887fd6ce59cb5216208997f7dddff8a2da3e7d0503674e2d
Opcode Fuzzy Hash: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
Instruction Fuzzy Hash: C7518C3290E283C6EB64AB21984036CB7A0BB45F94F954536DA9C67FA6CF3CF4518710

Function 00007FF7A0FE2CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7A0FE27C9,?,?,?,?,?,?), ref: 00007FF7A0FE2D01

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

Strings

Failed to get executable path., xrefs: 00007FF7A0FE2D0B
GetModuleFileNameW, xrefs: 00007FF7A0FE2D12
Failed to convert executable path to UTF-8., xrefs: 00007FF7A0FE2D3A

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2776309574-1977442011
Opcode ID: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
Instruction ID: f25f036429538a7bf5fb28d3135c03aa4ddd6e000e72864fb92455bdbdaa40af
Opcode Fuzzy Hash: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
Instruction Fuzzy Hash: 64015E21B1E647C1FB61B734E8153BAA251AF583C0FC30836E94D963B6EE5CF2148B20

Function 00007FF7A0FFBBD0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7A0FFBC4F
WriteFile.KERNEL32 ref: 00007FF7A0FFBF17
WriteFile.KERNEL32 ref: 00007FF7A0FFBF5D
GetLastError.KERNEL32 ref: 00007FF7A0FFC013

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
Instruction ID: e76407afcf71fd885b0c2ed64b50d419bf81f8610d2e91e14df376f61eb7da32
Opcode Fuzzy Hash: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
Instruction Fuzzy Hash: D4D10273B1AA828DE710DF75D4402ACB7B1FB44B98B854635CE4DA7BA9DE38E016C710

Function 00007FF7A0FF483C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7A0FF486F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7A0FF48D1
GetLastError.KERNEL32 ref: 00007FF7A0FF4962
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A0FF4774), ref: 00007FF7A0FF49AE

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1291a0862dc251a0f1dda952d285f4a36c3dc69b0fb142e3468d3d288eb0a289
Instruction ID: a51699f3814eb14b54e46d3bebec3ebef36825cedb0fefb40d031626f1b039fc
Opcode Fuzzy Hash: 1291a0862dc251a0f1dda952d285f4a36c3dc69b0fb142e3468d3d288eb0a289
Instruction Fuzzy Hash: 75518F23B096428AFB20EF70D4503BE73A1AB44B58F528935DE4D677A9DF78F4818760

Function 00007FF7A1004DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A1000920: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1000953

_get_daylight.LIBCMT ref: 00007FF7A1004ED4
_get_daylight.LIBCMT ref: 00007FF7A1004EE5

Strings

?, xrefs: 00007FF7A1004E65

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
Instruction ID: 9d5baceb8d70e047dd4847cc82184518fbd47d703997f42a55781bf7ea0229f2
Opcode Fuzzy Hash: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
Instruction Fuzzy Hash: 9E415822A0E28246FB20AB25940137BF750EB80BA4F914235EE5C87BF9DF7CD461CB14

Function 00007FF7A0FF7FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF8002

Part of subcall function 00007FF7A0FF9F78: RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
Part of subcall function 00007FF7A0FF9F78: GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7A0FEA485), ref: 00007FF7A0FF8020

Strings

C:\Users\user\Desktop\PumpBot.exe, xrefs: 00007FF7A0FF800E

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\PumpBot.exe
API String ID: 3580290477-104690940
Opcode ID: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
Instruction ID: e48084457fd9a854f7760e1b44f1e81ede3b0e7fc9adf8a455af0624bab349ca
Opcode Fuzzy Hash: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
Instruction Fuzzy Hash: 01416137A0EA038AE714AF3199400B9A7A4EF447C4BD64435EA4E53BA5DF3DE4528720

Function 00007FF7A0FFC268 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7A0FFC37F
GetLastError.KERNEL32 ref: 00007FF7A0FFC3A1

Strings

U, xrefs: 00007FF7A0FFC32B

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
Instruction ID: e38c3922872d4bb2aee54f9f32913e60f5d2c50cf1af540f86c1d490580096f2
Opcode Fuzzy Hash: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
Instruction Fuzzy Hash: 3041C323A1DA5285EB209F25E4443AAB760FB887D4F824431EE4D97768DF7CE441CB50

Function 00007FF7A0FFE588 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A0FFE5C8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A0FFE61A

Strings

:, xrefs: 00007FF7A0FFE5DE

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 299dd2601fabda0eaedb6d74bbca1af16fe573635883c06f79dbd5a665f7b651
Instruction ID: 54966ce0ddd3feba175b5735393dd2e02bf747d1a2addb429e63982cc81d78da
Opcode Fuzzy Hash: 299dd2601fabda0eaedb6d74bbca1af16fe573635883c06f79dbd5a665f7b651
Instruction Fuzzy Hash: BA21F723B1D24285FB20AB25D05426DB3B2FB94B44FC64435D64D533A4CF7CF5458B61

Function 00007FF7A0FEE310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7A0FEE354
RaiseException.KERNEL32 ref: 00007FF7A0FEE39A

Strings

csm, xrefs: 00007FF7A0FEE387

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
Instruction ID: 63d1362316309a2ae423e63998444ca59cba39d2511bdbb26260581c95df1738
Opcode Fuzzy Hash: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
Instruction Fuzzy Hash: 37114F32609B4182EB109F25F44026ABBA4FB88B94F594631EE8D07768DF7CD5618B00

Function 00007FF7A0FFF08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFF0BC
GetDriveTypeW.KERNEL32 ref: 00007FF7A0FFF0FC

Strings

:, xrefs: 00007FF7A0FFF0E5

Memory Dump Source

Source File: 00000000.00000002.2146716304.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000000.00000002.2146701396.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146742541.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146762742.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2146798872.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
Instruction ID: 2f87856dfd5d7da467de950ec5c49de9a0bee163f1d9e7137ae971a4d63de0d2
Opcode Fuzzy Hash: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
Instruction Fuzzy Hash: 09018F62A1D6038AF720BF70946167EA3A0EF44744FC6083AD54DA27A2DF2CF5598B34

Analysis Process: PumpBot.exePID: 5724, Parent PID: 5248COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	745
Total number of Limit Nodes:	16

Executed Functions

Function 00007FF7A1005DEC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A1005B20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005B61
Part of subcall function 00007FF7A1005B20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005BDF
Part of subcall function 00007FF7A1005B20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005C30

CreateFileW.KERNELBASE ref: 00007FF7A1005EF2
CreateFileW.KERNEL32 ref: 00007FF7A1005F42
GetLastError.KERNEL32 ref: 00007FF7A1005F72
GetFileType.KERNELBASE ref: 00007FF7A1005F87
GetLastError.KERNEL32 ref: 00007FF7A1005F91
CloseHandle.KERNEL32 ref: 00007FF7A1005FC4
CloseHandle.KERNEL32 ref: 00007FF7A1006127
CreateFileW.KERNEL32 ref: 00007FF7A100615C
GetLastError.KERNEL32 ref: 00007FF7A100616B

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
Instruction ID: cabf71382365bf184d8244860535987e9305c2f5e8bd34971652b538fc87f96e
Opcode Fuzzy Hash: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
Instruction Fuzzy Hash: C5C1F333B29A4285FB10EF64C4906AD7771FB48B98B864239DE1E977A5CF78E061C710

Function 00007FF7A0FE17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7A0FE185C
_fread_nolock.LIBCMT ref: 00007FF7A0FE190E

Part of subcall function 00007FF7A0FEE6D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE6E4

Strings

Cannot read Table of Contents., xrefs: 00007FF7A0FE1995
malloc, xrefs: 00007FF7A0FE18EA
Failed to seek to cookie position!, xrefs: 00007FF7A0FE182F
Failed to read cookie!, xrefs: 00007FF7A0FE1867
fread, xrefs: 00007FF7A0FE186E
MEI, xrefs: 00007FF7A0FE17EF
Could not allocate buffer for TOC!, xrefs: 00007FF7A0FE18E3
Error on file., xrefs: 00007FF7A0FE193D
fseek, xrefs: 00007FF7A0FE1836
Could not read full TOC!, xrefs: 00007FF7A0FE1919

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _fread_nolock$_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 3405171723-4158440160
Opcode ID: 5c49a8cddfaeaf085e12370ff3ee4fae9e2fef66abab006e93af1c3fcbc0697f
Instruction ID: f3b2b437746adf8f79a4e9085ceba0e554a670209a17395f392f15e4b237b199
Opcode Fuzzy Hash: 5c49a8cddfaeaf085e12370ff3ee4fae9e2fef66abab006e93af1c3fcbc0697f
Instruction Fuzzy Hash: C3516972A0E606C6EF14EF39D45027DB3A0FB48B84B928935D90D933A9DE6CE550CB60

Function 00007FF7A0FE12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A0FE1312
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A0FE13E2
malloc, xrefs: 00007FF7A0FE1353
fread, xrefs: 00007FF7A0FE13E9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A0FE12E2
fseek, xrefs: 00007FF7A0FE1319
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7A0FE134C

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 0-3659356012
Opcode ID: 60275b0be8da073a50b86a7777b4e2d23c8ae2bab0a68d0179eb72b20f9ea2b8
Instruction ID: 740288d7a6f258cde2a65b09df276193882e5df21fa283da16f27b5c43a81cd6
Opcode Fuzzy Hash: 60275b0be8da073a50b86a7777b4e2d23c8ae2bab0a68d0179eb72b20f9ea2b8
Instruction Fuzzy Hash: 05417331A0E643C5FE10EB26A8402AAE3A1FB447D0FD64832DA4D57B65EE7CF541C710

Function 00007FF7A0FE1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A0FE2CD0: GetModuleFileNameW.KERNEL32(?,00007FF7A0FE27C9,?,?,?,?,?,?), ref: 00007FF7A0FE2D01

SetDllDirectoryW.KERNEL32 ref: 00007FF7A0FE29D5

Part of subcall function 00007FF7A0FE5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7A0FE2817,?,?,?,?,?,?), ref: 00007FF7A0FE5B2A
Part of subcall function 00007FF7A0FE5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE5B47

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7A0FE295C
_MEIPASS2, xrefs: 00007FF7A0FE2803, 00007FF7A0FE286C, 00007FF7A0FE2B1B, 00007FF7A0FE2B2B
_PYI_ONEDIR_MODE, xrefs: 00007FF7A0FE282C, 00007FF7A0FE2857
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7A0FE28BE
Failed to convert DLL search path!, xrefs: 00007FF7A0FE29BD
MEI, xrefs: 00007FF7A0FE2917

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 8a150a9a58d45ff89090a124b7ff524bcda0890e66e432f933d0e899395f739e
Instruction ID: 556024dbc34c0ee8d1bb4e0d7e29e77bd2abc92c444237f0d78aef6c86a688b3
Opcode Fuzzy Hash: 8a150a9a58d45ff89090a124b7ff524bcda0890e66e432f933d0e899395f739e
Instruction Fuzzy Hash: E6C1C721A1E683C5FA60BB3194512FDA350BF44784FC64832EA4D677B6EF6CF6058720

Function 00007FF7A0FE1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7A0FE10B4
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7A0FE10F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7A0FE111F
malloc, xrefs: 00007FF7A0FE10F8, 00007FF7A0FE1126
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7A0FE1249
1.2.13, xrefs: 00007FF7A0FE107E

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 0-1655038675
Opcode ID: 0f593df15c26aa97bfddcbd1cec8bcaf50387b027b5acb5872475685e06497ee
Instruction ID: a97d040d534db438bebab68bced4857eaa38be83f8eebe72435ab77c63a8cc1b
Opcode Fuzzy Hash: 0f593df15c26aa97bfddcbd1cec8bcaf50387b027b5acb5872475685e06497ee
Instruction Fuzzy Hash: 2151C632A0E643C5EA60BB22A8403BAB390BB84794FC64935DE4D977A5EE3CF455C710

Function 00007FF7A0FFDF30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF7A0FFE2CA,?,?,-00000018,00007FF7A0FFA383,?,?,?,00007FF7A0FFA27A,?,?,?,00007FF7A0FF54E2), ref: 00007FF7A0FFE0AC
GetProcAddress.KERNEL32(?,00000000,?,00007FF7A0FFE2CA,?,?,-00000018,00007FF7A0FFA383,?,?,?,00007FF7A0FFA27A,?,?,?,00007FF7A0FF54E2), ref: 00007FF7A0FFE0B8

Strings

ext-ms-, xrefs: 00007FF7A0FFE009
api-ms-, xrefs: 00007FF7A0FFDFF6

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
Instruction ID: 1c7500e100ee5bbf0150a1dd0151a66337301a0330c1dab55b15992dc5929fad
Opcode Fuzzy Hash: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
Instruction Fuzzy Hash: 1D413622B1F60389FB11EB269810676A392BF44BD0F8B4935DD0D673A8EE7CF4458324

Function 00007FF7A0FFB08C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFB4B9

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
Instruction ID: 5463a08a91887a50ee6141645eb6728bde037d314db34532b84ed4c981d69689
Opcode Fuzzy Hash: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
Instruction Fuzzy Hash: EBC1F523A0E68789E721AF3594402BEB751EB81B80FD74535DA4E237B1CE7DF8458720

Function 00007FF7A0FFC590 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7A0FFC57B), ref: 00007FF7A0FFC6AC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7A0FFC57B), ref: 00007FF7A0FFC737

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
Instruction ID: 832ec93f454a20827ddc5828f4ba714b060c8656d84a89a966b9ee70d3a1a9c4
Opcode Fuzzy Hash: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
Instruction Fuzzy Hash: 7691C633E0D66389F750AF7585402BDABA0AB44B88F964539DE0E63BA4DF38F445C760

Function 00007FF7A0FF46E8 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF4715
CreateFileW.KERNELBASE ref: 00007FF7A0FF4754
CloseHandle.KERNEL32 ref: 00007FF7A0FF4789

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 6f171c56c4af514848e95b4e04b562bbb562cc25ad397f2cc98f1fee1aaa5281
Instruction ID: 7b4cf955cf47064b45d86a929a05718054c887a9a782bb0d7f586b49600da0fc
Opcode Fuzzy Hash: 6f171c56c4af514848e95b4e04b562bbb562cc25ad397f2cc98f1fee1aaa5281
Instruction Fuzzy Hash: 4841B023D1D7828BE710AB309510369B360FB957A4F519734EB9C13BE5DF6CB5A08720

Function 00007FF7A0FEA51C Relevance: 4.6, APIs: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7A0FEA530

Part of subcall function 00007FF7A0FEA6FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7A0FEA71E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7A0FEA545
__scrt_release_startup_lock.LIBCMT ref: 00007FF7A0FEA5B3

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3058843127-0
Opcode ID: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
Instruction ID: c58678816773adc8572dea1502ebecdbe9700d085d6e65ea43cb223496a5cdc2
Opcode Fuzzy Hash: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
Instruction Fuzzy Hash: 23312C21A0E203C6FA14BB3195513BAA391AF82784FCA4836E60D673F7DE6CF4458671

Function 00007FF7A0FF89E8 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7A0FF89E4), ref: 00007FF7A0FF89F9
TerminateProcess.KERNEL32(?,?,?,00007FF7A0FF89E4), ref: 00007FF7A0FF8A04
ExitProcess.KERNEL32 ref: 00007FF7A0FF8A13

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
Instruction ID: e58afa806e5413096c3b60ff6178302a5b6c7e66f9f89971266415482ff021cf
Opcode Fuzzy Hash: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
Instruction Fuzzy Hash: 4ED05E11F0E7039AFB043B30588517AA3119F48700F861838C80F123B3CD7CB46E4A20

Function 00007FF7A0FEE6FC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE740
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE837

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
Instruction ID: 068edfd8a15634ee4025c715f4c78251d1ef34f81c57ba5f54519f62b7455db1
Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
Instruction Fuzzy Hash: 5C51E621B0F643C6E768BA35A41067AA191AF44BA4F9A4E34DD7C137EDCE3CF5018620

Function 00007FF7A0FFC048 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF7A0FFC0FB
GetLastError.KERNEL32 ref: 00007FF7A0FFC117

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 48497a76b3055afe52661005fd715ce1d46b06a16acad2e21dfde3d81f02aed8
Instruction ID: 95dae4028410357d2fc99f633c4b23797af28d6e50806a2ccb6528d42a47f53f
Opcode Fuzzy Hash: 48497a76b3055afe52661005fd715ce1d46b06a16acad2e21dfde3d81f02aed8
Instruction Fuzzy Hash: 20310833A1DA828AE710AF24E5402D9B764FB08780F864432DB4D83725DF3CE416CB10

Function 00007FF7A0FFBA48 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7A0FFBAC1
GetFileType.KERNELBASE ref: 00007FF7A0FFBAD7

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
Instruction ID: c8ab889cbf557ce8dee64d8b6bab9c487f281dd83bad44e83d157a8321022d64
Opcode Fuzzy Hash: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
Instruction Fuzzy Hash: 4E318122A1DB4785E7609B248580179AA50FB45BB0FAA1739DB6E173F4CF38F4A1D310

Function 00007FF7A0FFB764 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7A0FFB750,00000000,?,?,?,00007FF7A0FE1023,00007FF7A0FFB859), ref: 00007FF7A0FFB7B0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7A0FFB750,00000000,?,?,?,00007FF7A0FE1023,00007FF7A0FFB859), ref: 00007FF7A0FFB7BA

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
Instruction ID: ce2c76060ca20c109cf52a75ca96723dbe856da5695de0d865951e3ac6113a0d
Opcode Fuzzy Hash: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
Instruction Fuzzy Hash: 6411B26361DA8385DA10AB35A444069F361AB84BF4F954731EE7D17BE9CE7CE0548740

Function 00007FF7A0FF9F78 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
Instruction ID: 3390cfc0aa41ed6c4d80c58cff6af36a246291e23286fcd9c43fb636b25bf55a
Opcode Fuzzy Hash: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
Instruction Fuzzy Hash: 8BE08651F0F60387FF14BBB15844075E2515F84700BC64434D90EA63B1DE6CB8998730

Function 00007FF7A0FFA188 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7A0FFA005,?,?,00000000,00007FF7A0FFA0BA), ref: 00007FF7A0FFA1F6
GetLastError.KERNEL32(?,?,?,00007FF7A0FFA005,?,?,00000000,00007FF7A0FFA0BA), ref: 00007FF7A0FFA200

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
Instruction ID: f7b6f67864904d42c8c7961f79971157b68a2f8aac4c15b4abb84a1d20cfcb6c
Opcode Fuzzy Hash: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
Instruction Fuzzy Hash: 37212663F1E24348FE50B33098C027AE2819F84BA0F874636DA2E133E6DE6CB4444710

Function 00007FF7A0FFB4DC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFB504

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
Instruction ID: 5073d467be95b4380257440a31eedc2bbf81d6638c0b249d5825f81afbf83e9d
Opcode Fuzzy Hash: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
Instruction Fuzzy Hash: 1A41B53390E2438BEA24AB39E550179F3A0EB55780F991935D68E937E4DF6CF402C761

Function 00007FF7A0FE6360 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7A0FE640A

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: a855f48cc0c6225f518e529d3fd53bc2cab9077c657b5af2ba78026b03b21181
Instruction ID: 843732166087193c3b4bd479b930939bf04d785a9dc1d593b277d9c581659430
Opcode Fuzzy Hash: a855f48cc0c6225f518e529d3fd53bc2cab9077c657b5af2ba78026b03b21181
Instruction Fuzzy Hash: CF215121B0E69785EA15FB3269043BAE651BF45BD4FCA4830EE0D277A6CE7DF045C214

Function 00007FF7A0FFAF6C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFAFF2

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
Instruction ID: 0f2d716754e0fe45d6c2ce7c67bf32f5d412338b1a4540310b4de1b779e73c7f
Opcode Fuzzy Hash: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
Instruction Fuzzy Hash: 37318F63A1E60389E7117B75884127DA650AB40B94FD3093AEA2D273F2DE7DF8418770

Function 00007FF7A0FF8919 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7A0FF8947

Part of subcall function 00007FF7A0FF8A40: GetModuleHandleExW.KERNEL32 ref: 00007FF7A0FF8A65
Part of subcall function 00007FF7A0FF8A40: GetProcAddress.KERNEL32 ref: 00007FF7A0FF8A7B
Part of subcall function 00007FF7A0FF8A40: FreeLibrary.KERNEL32 ref: 00007FF7A0FF8AA2

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
Instruction ID: bc1fc2dcc68eb3ed5005af2896d0d64da5a7f992fb900c706428ee22377883fe
Opcode Fuzzy Hash: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
Instruction Fuzzy Hash: 3D219132A0A7038DEB24AF74C4402FC77A0EB04718F891A35D65D16BE5DF78E445C755

Function 00007FF7A0FF5538 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF549D

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
Instruction ID: a8e39c0ad3a5b0698e442d1a8dedbb73d4212c6d20efc95fd47c80e04b83a9b8
Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
Instruction Fuzzy Hash: B711C223E0E64349EA60FF61951027DE260AF81F80F9A4835EB8C677A6CF3DF4404760

Function 00007FF7A10057DC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A10057FF

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
Instruction ID: 1ac43b42f8a601f90f49a0f267b1950a43f1cb6800720d07b62f342ef253a118
Opcode Fuzzy Hash: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
Instruction Fuzzy Hash: 4221C532A19A4287E760AF28D44037AB7B0FB84B54F954234EB5D876E5DF7CD4118F10

Function 00007FF7A0FEE97C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEE9D0

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
Instruction ID: 3efcb3ce69b49dab7a9395bf4b0d01a3fffb160dc92fb1e0024ea8bafc60127d
Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
Instruction Fuzzy Hash: DD01A522A0D75381EA44BB72A90016DE695AF95FE0F894A31DE5C63BEACE3CF4018710

Function 00007FF7A0FE6310 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A0FE6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

LoadLibraryExW.KERNELBASE(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE6333

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: d04350a69a5d0de22f0c3fec6e5848decc6b75c02966e6146df087db15ac8417
Instruction ID: c82722e9a93925a8d3566e1c373ba36036c92475108f8c921c6bc08593716dbd
Opcode Fuzzy Hash: d04350a69a5d0de22f0c3fec6e5848decc6b75c02966e6146df087db15ac8417
Instruction Fuzzy Hash: C4E08622B1954682EA18AB77A90547AE251EF48BC0BC99035EE0D47765DD2CE4914B00

Function 00007FF7A0FFDEB8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7A0FFAA16,?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E), ref: 00007FF7A0FFDF0D

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
Instruction ID: 60d25a15de4bb44a908ee8fadc611ec979f646ae0b6a7ab853fa07482e191d90
Opcode Fuzzy Hash: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
Instruction Fuzzy Hash: C7F06242B0F20348FF547B7158506B5E2965F55B40FCE4835C90EA63F1DE6CF4968230

Function 00007FF7A0FFCC2C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7A0FEF1E4,?,?,?,00007FF7A0FF06F6,?,?,?,?,?,00007FF7A0FF275D), ref: 00007FF7A0FFCC6A

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
Instruction ID: 7b8295c527dde28eafc97f38e9c7d7b79d26541761fcf5aebc551f257abbd478
Opcode Fuzzy Hash: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
Instruction Fuzzy Hash: D0F05E12B0F29748FE1577725A40676B2805F457A0F8A0A34DD2E553F1DE6CB4519670

Non-executed Functions

Function 00007FF7A0FE58E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF7A0FE58AD), ref: 00007FF7A0FE597A
GetCurrentProcessId.KERNEL32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE5980

Part of subcall function 00007FF7A0FE5AF0: GetEnvironmentVariableW.KERNEL32(00007FF7A0FE2817,?,?,?,?,?,?), ref: 00007FF7A0FE5B2A
Part of subcall function 00007FF7A0FE5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE5B47

Part of subcall function 00007FF7A0FF6818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF6831

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7A0FE5A31

Strings

_MEI%d, xrefs: 00007FF7A0FE5988
TMP, xrefs: 00007FF7A0FE5918, 00007FF7A0FE59D9, 00007FF7A0FE5A67
TMP, xrefs: 00007FF7A0FE593E
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7A0FE5958

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 1556224225-1116378104
Opcode ID: a2d3d61fd24428ac6a6f98a6e0a61bc7d205a4dc56e3469f4385a30d12448c9b
Instruction ID: cebb1cccd155b11647ee9f3fe8f8850719d04f2aacddb4991d83dfd92378d86f
Opcode Fuzzy Hash: a2d3d61fd24428ac6a6f98a6e0a61bc7d205a4dc56e3469f4385a30d12448c9b
Instruction Fuzzy Hash: EF513721F0F64784FA55BB32A9552BAD2825F49BC0FC64835EC0E677A6ED6CF5018720

Function 00007FFDA3723980 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA372399C
memset.VCRUNTIME140 ref: 00007FFDA37239C0
RtlCaptureContext.KERNEL32 ref: 00007FFDA37239C9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA37239E3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA3723A24
memset.VCRUNTIME140 ref: 00007FFDA3723A57
IsDebuggerPresent.KERNEL32 ref: 00007FFDA3723A78
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA3723A99
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA3723AA4

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: dc449cd1df23c4315b3124638d65066d361b91b4ca96099ba807f8ccbda4248d
Instruction ID: af558fd469df681e6e9e97038c1adcf1269a783669acd7c0ccdc54968c7c4886
Opcode Fuzzy Hash: dc449cd1df23c4315b3124638d65066d361b91b4ca96099ba807f8ccbda4248d
Instruction Fuzzy Hash: 5831607270AA818AEB608FA0E8607ED3372FB84744F444439DA8E57B96DF39C548C708

Function 00007FFDA433A978 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA433A994
memset.VCRUNTIME140 ref: 00007FFDA433A9B8
RtlCaptureContext.KERNEL32 ref: 00007FFDA433A9C1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA433A9DB
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA433AA1C
memset.VCRUNTIME140 ref: 00007FFDA433AA4F
IsDebuggerPresent.KERNEL32 ref: 00007FFDA433AA70
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA433AA91
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA433AA9C

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 0df5665328d8ecf6c0eee01f5d89b31342fd8fb1c048f48e1992ce638da20fa5
Instruction ID: 5ac8612b7ce21278178ca9f99fc4ce2906489d12007ead21ac1b82486bb63932
Opcode Fuzzy Hash: 0df5665328d8ecf6c0eee01f5d89b31342fd8fb1c048f48e1992ce638da20fa5
Instruction Fuzzy Hash: 01316D7274AE8185EB60AF60E8A03ED3360FB85744F44443ADA4E47BA5DF7CE548C714

Function 00007FF7A0FEAA2C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7A0FEAA48
RtlCaptureContext.KERNEL32 ref: 00007FF7A0FEAA75
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A0FEAA8F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A0FEAAD0
IsDebuggerPresent.KERNEL32 ref: 00007FF7A0FEAB24
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FEAB45
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FEAB50

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
Instruction ID: 65c4408e85e13c48355ea3a47fa881d158b505ddd24887d27d1ebb40e3841358
Opcode Fuzzy Hash: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
Instruction Fuzzy Hash: F2316572609B82C6EB609F60E8403EEB365FB84744F85443ADA4D57794DF7CD658C720

Function 00007FF7A1004EA0 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7A1004EE5

Part of subcall function 00007FF7A1004838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A100484C

Part of subcall function 00007FF7A0FF9F78: RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
Part of subcall function 00007FF7A0FF9F78: GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

Part of subcall function 00007FF7A0FF9F30: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7A0FF9F0F,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FF9F39
Part of subcall function 00007FF7A0FF9F30: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7A0FF9F0F,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FF9F5E

_get_daylight.LIBCMT ref: 00007FF7A1004ED4

Part of subcall function 00007FF7A1004898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A10048AC

_get_daylight.LIBCMT ref: 00007FF7A100514A
_get_daylight.LIBCMT ref: 00007FF7A100515B
_get_daylight.LIBCMT ref: 00007FF7A100516C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A10053AC), ref: 00007FF7A1005193

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
Instruction ID: 0f9a1f0af36f8161cb05eb05e908e1f79921774425f34aa93328cad302c2d29f
Opcode Fuzzy Hash: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
Instruction Fuzzy Hash: AFD1B322A1A24286F714FF21D8401BEB761FF44794FC24436EA4D876A5DFBCE861CB60

Function 00007FF7A0FF9C44 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7A0FF9CBD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A0FF9CD5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A0FF9D10
IsDebuggerPresent.KERNEL32 ref: 00007FF7A0FF9D49
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FF9D53
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A0FF9D5E

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
Instruction ID: 410f41abf22ace8a9b9ee82eae3ff362fcb1bdbe64dd3d3d72de2daa626ece71
Opcode Fuzzy Hash: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
Instruction Fuzzy Hash: 0F315132619B82C6E760DF25E8402EEB3A4FB88794F950536EA8D53B64DF3CD155CB10

Function 00007FF7A1000A34 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1000A80
FindFirstFileExW.KERNEL32 ref: 00007FF7A1000B8A

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
Instruction ID: b25d6f7195e529e0be4cd2f455d680eb5e8fcd52451b616e01b757171ced677c
Opcode Fuzzy Hash: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
Instruction Fuzzy Hash: D6B1C72AB1EA8641FB60BB2194005BEF350EB44BD4F854132E94F57BE9DE7CE451CB20

Function 00007FF7A100511C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7A100514A

Part of subcall function 00007FF7A1004898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A10048AC

_get_daylight.LIBCMT ref: 00007FF7A100515B

Part of subcall function 00007FF7A1004838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A100484C

_get_daylight.LIBCMT ref: 00007FF7A100516C

Part of subcall function 00007FF7A1004868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A100487C

Part of subcall function 00007FF7A0FF9F78: RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
Part of subcall function 00007FF7A0FF9F78: GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A10053AC), ref: 00007FF7A1005193

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
Instruction ID: 47abae04dbd86ed4a8925197b82e92c99b289b65f8c3b1ed7feef163d7268bc1
Opcode Fuzzy Hash: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
Instruction Fuzzy Hash: B6516232A1A64286F710FF21D9815AAF760BF48784FC24535EA4D837B5DFBCE5218B60

Function 00007FFDA43337D0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 354COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA4333928

Strings

%d in block, %d after MTF & 1-2 coding, %d+2 syms in use, xrefs: 00007FFDA433BA7E

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: memset
String ID: %d in block, %d after MTF & 1-2 coding, %d+2 syms in use
API String ID: 2221118986-3447602032
Opcode ID: d3558257d55abd9080c9ad24293b517f6c8fa68d468f9387980803ef37a07321
Instruction ID: b7dfb1d44296898e99e7ce2e69281d6af56212946e46bbec03180bdc71807fbe
Opcode Fuzzy Hash: d3558257d55abd9080c9ad24293b517f6c8fa68d468f9387980803ef37a07321
Instruction Fuzzy Hash: C0E15732B19A818AD721DF29D4A12B97354FB5678EF009335EA4D63BB6DB3EF1018704

Function 00007FF7A0FE2F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2F36
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2F75
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2F9A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2FBF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE2FE7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE300F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE3037
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE305F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE3087

Strings

Py_NoUserSiteDirectory, xrefs: 00007FF7A0FE3005
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF7A0FE3021
Failed to get address for PyMem_RawFree, xrefs: 00007FF7A0FE36E1
PyErr_NormalizeException, xrefs: 00007FF7A0FE332D
Py_IncRef, xrefs: 00007FF7A0FE314D
Failed to get address for PyObject_Str, xrefs: 00007FF7A0FE3529
Failed to get address for Py_SetProgramName, xrefs: 00007FF7A0FE3209
Failed to get address for Py_DecRef, xrefs: 00007FF7A0FE3119
Py_SetPath, xrefs: 00007FF7A0FE319D
Failed to get address for Py_GetPath, xrefs: 00007FF7A0FE31E1
PyUnicode_FromString, xrefs: 00007FF7A0FE3675
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7A0FE3501
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7A0FE3399
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF7A0FE35A1
Py_VerboseFlag, xrefs: 00007FF7A0FE3055
Failed to get address for PySys_GetObject, xrefs: 00007FF7A0FE35C9
PyUnicode_Decode, xrefs: 00007FF7A0FE3715
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7A0FE3731
Failed to get address for PySys_SetPath, xrefs: 00007FF7A0FE3619
PyEval_EvalCode, xrefs: 00007FF7A0FE3625
PyUnicode_AsUTF8, xrefs: 00007FF7A0FE3765
PyErr_Clear, xrefs: 00007FF7A0FE3265
Failed to get address for PyLong_AsLong, xrefs: 00007FF7A0FE3439
Failed to get address for PyUnicode_Join, xrefs: 00007FF7A0FE37A9
PyObject_GetAttrString, xrefs: 00007FF7A0FE34E5
PyErr_Occurred, xrefs: 00007FF7A0FE328D
PyImport_AddModule, xrefs: 00007FF7A0FE3355
Py_UTF8Mode, xrefs: 00007FF7A0FE30AD
Failed to get address for PyErr_Occurred, xrefs: 00007FF7A0FE32A9
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7A0FE34B1
PyMem_RawFree, xrefs: 00007FF7A0FE36C5
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF7A0FE2FD1
PyLong_AsLong, xrefs: 00007FF7A0FE341D
Py_FileSystemDefaultEncoding, xrefs: 00007FF7A0FE2F6B
Py_SetPythonHome, xrefs: 00007FF7A0FE3215
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7A0FE3781
Failed to get address for Py_VerboseFlag, xrefs: 00007FF7A0FE3071
PySys_SetPath, xrefs: 00007FF7A0FE35FD
Py_DontWriteBytecodeFlag, xrefs: 00007FF7A0FE2F2F
PyObject_SetAttrString, xrefs: 00007FF7A0FE34BD
Failed to get address for Py_FrozenFlag, xrefs: 00007FF7A0FE2FAC
Failed to get address for PySys_SetObject, xrefs: 00007FF7A0FE35F1
Failed to get address for Py_Finalize, xrefs: 00007FF7A0FE3141
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7A0FE3709
PySys_SetArgvEx, xrefs: 00007FF7A0FE3585
Py_DecodeLocale, xrefs: 00007FF7A0FE369D
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7A0FE3759
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF7A0FE2FF9
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF7A0FE2F87
PySys_SetObject, xrefs: 00007FF7A0FE35D5
Py_FrozenFlag, xrefs: 00007FF7A0FE2F90
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7A0FE3691
Py_GetPath, xrefs: 00007FF7A0FE31C5
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7A0FE3641
Py_SetProgramName, xrefs: 00007FF7A0FE31ED
Failed to get address for PyImport_AddModule, xrefs: 00007FF7A0FE3371
PyList_Append, xrefs: 00007FF7A0FE33CD
Failed to get address for PyModule_GetDict, xrefs: 00007FF7A0FE3461
GetProcAddress, xrefs: 00007FF7A0FE2F4F
Failed to get address for PyErr_Restore, xrefs: 00007FF7A0FE3321
PyErr_Fetch, xrefs: 00007FF7A0FE32DD
Py_Initialize, xrefs: 00007FF7A0FE3175
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7A0FE3669
Failed to get address for PyList_New, xrefs: 00007FF7A0FE3411
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7A0FE3489
Failed to get address for Py_UTF8Mode, xrefs: 00007FF7A0FE30C9
PyModule_GetDict, xrefs: 00007FF7A0FE3445
Py_DecRef, xrefs: 00007FF7A0FE30FD
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF7A0FE2F48
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7A0FE34D9
PyMarshal_ReadObjectFromString, xrefs: 00007FF7A0FE364D
Py_UnbufferedStdioFlag, xrefs: 00007FF7A0FE307D
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7A0FE3349
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7A0FE36B9
PyObject_CallFunction, xrefs: 00007FF7A0FE346D
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7A0FE37D1
Failed to get address for Py_SetPath, xrefs: 00007FF7A0FE31B9
PyRun_SimpleStringFlags, xrefs: 00007FF7A0FE3535
Failed to get address for Py_IncRef, xrefs: 00007FF7A0FE3169
Failed to get address for PyList_Append, xrefs: 00007FF7A0FE33E9
Py_OptimizeFlag, xrefs: 00007FF7A0FE302D
PyErr_Print, xrefs: 00007FF7A0FE32B5
Failed to get address for Py_BuildValue, xrefs: 00007FF7A0FE30F1
PyDict_GetItemString, xrefs: 00007FF7A0FE323D
PyUnicode_DecodeFSDefault, xrefs: 00007FF7A0FE373D
Py_IgnoreEnvironmentFlag, xrefs: 00007FF7A0FE2FB5
PyUnicode_Replace, xrefs: 00007FF7A0FE37B5
Py_Finalize, xrefs: 00007FF7A0FE3125
Failed to get address for Py_SetPythonHome, xrefs: 00007FF7A0FE3231
Py_NoSiteFlag, xrefs: 00007FF7A0FE2FDD
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7A0FE33C1
PySys_GetObject, xrefs: 00007FF7A0FE35AD
PyObject_CallFunctionObjArgs, xrefs: 00007FF7A0FE3495
Failed to get address for PyErr_Clear, xrefs: 00007FF7A0FE3281
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF7A0FE3049
PyErr_Restore, xrefs: 00007FF7A0FE3305
Failed to get address for PyErr_Fetch, xrefs: 00007FF7A0FE32F9
PyList_New, xrefs: 00007FF7A0FE33F5
PyObject_Str, xrefs: 00007FF7A0FE350D
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF7A0FE3579
PyImport_ImportModule, xrefs: 00007FF7A0FE33A5
Failed to get address for PyDict_GetItemString, xrefs: 00007FF7A0FE3259
PySys_AddWarnOption, xrefs: 00007FF7A0FE355D
PyUnicode_Join, xrefs: 00007FF7A0FE378D
Failed to get address for Py_Initialize, xrefs: 00007FF7A0FE3191
PyImport_ExecCodeModule, xrefs: 00007FF7A0FE337D
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF7A0FE3099
PyUnicode_FromFormat, xrefs: 00007FF7A0FE36ED
Py_BuildValue, xrefs: 00007FF7A0FE30D5
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7A0FE3551
Failed to get address for PyErr_Print, xrefs: 00007FF7A0FE32D1

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
Instruction ID: 894c70b344a960cb9a0167f8d7b024dc209ea6b856359841b0bad061bb578792
Opcode Fuzzy Hash: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
Instruction Fuzzy Hash: 9C42DE68A0FB47D1FB54FB14A948176B3A1AF04781BCA5435D84E06378FFECB5689B20

Function 00007FF7A0FE4730 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A0FE6310: LoadLibraryExW.KERNELBASE(?,?,00000000,00007FF7A0FE22DE,?,?,?,?), ref: 00007FF7A0FE6333

GetProcAddress.KERNEL32 ref: 00007FF7A0FE50C7
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5106
GetProcAddress.KERNEL32 ref: 00007FF7A0FE512B
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5150
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5178
GetProcAddress.KERNEL32 ref: 00007FF7A0FE51A0
GetProcAddress.KERNEL32 ref: 00007FF7A0FE51C8
GetProcAddress.KERNEL32 ref: 00007FF7A0FE51F0
GetProcAddress.KERNEL32 ref: 00007FF7A0FE5218

Strings

Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7A0FE52CA
Tcl_Finalize, xrefs: 00007FF7A0FE516E
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7A0FE52A2
Failed to get address for Tcl_Init, xrefs: 00007FF7A0FE50D9
Tcl_SetVar2, xrefs: 00007FF7A0FE5376
GetProcAddress, xrefs: 00007FF7A0FE50E0
Failed to get address for Tcl_Alloc, xrefs: 00007FF7A0FE5522
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7A0FE5392
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF7A0FE477A
Tcl_ThreadAlert, xrefs: 00007FF7A0FE5326
Tcl_EvalFile, xrefs: 00007FF7A0FE548E
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7A0FE54D2
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7A0FE5202
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7A0FE5118
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7A0FE54AA
Tcl_CreateInterp, xrefs: 00007FF7A0FE50FC
Tcl_NewStringObj, xrefs: 00007FF7A0FE53EE
Failed to get address for Tcl_Free, xrefs: 00007FF7A0FE554A
Tcl_ThreadQueueEvent, xrefs: 00007FF7A0FE52FE
Tcl_ConditionWait, xrefs: 00007FF7A0FE52D6
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7A0FE52F2
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7A0FE559A
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7A0FE54FA
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7A0FE536A
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7A0FE527A
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7A0FE53BA
Tcl_DoOneEvent, xrefs: 00007FF7A0FE5146
Tcl_EvalEx, xrefs: 00007FF7A0FE54B6
Tcl_GetCurrentThread, xrefs: 00007FF7A0FE520E
Tk_Init, xrefs: 00007FF7A0FE5556
Tcl_FindExecutable, xrefs: 00007FF7A0FE5121
Tcl_ConditionNotify, xrefs: 00007FF7A0FE52AE
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7A0FE5432
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7A0FE545A
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7A0FE531A
Tcl_GetString, xrefs: 00007FF7A0FE53C6
Tcl_FinalizeThread, xrefs: 00007FF7A0FE5196
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7A0FE5162
Tcl_MutexUnlock, xrefs: 00007FF7A0FE525E
Tcl_CreateObjCommand, xrefs: 00007FF7A0FE539E
Tcl_DeleteInterp, xrefs: 00007FF7A0FE51BE
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7A0FE522A
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7A0FE540A
Tk_GetNumMainWindows, xrefs: 00007FF7A0FE557E
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7A0FE5252
Tcl_Free, xrefs: 00007FF7A0FE552E
Failed to get address for Tcl_GetString, xrefs: 00007FF7A0FE53E2
Failed to get address for Tk_Init, xrefs: 00007FF7A0FE5572
Tcl_Init, xrefs: 00007FF7A0FE50C0
Tcl_ConditionFinalize, xrefs: 00007FF7A0FE5286
Tcl_EvalObjv, xrefs: 00007FF7A0FE54DE
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7A0FE51DA
Tcl_SetVar2Ex, xrefs: 00007FF7A0FE543E
Tcl_NewByteArrayObj, xrefs: 00007FF7A0FE5416
Tcl_CreateThread, xrefs: 00007FF7A0FE51E6
Tcl_Alloc, xrefs: 00007FF7A0FE5506
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7A0FE51B2
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7A0FE5342
Tcl_GetObjResult, xrefs: 00007FF7A0FE5466
Failed to get address for Tcl_Finalize, xrefs: 00007FF7A0FE518A
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7A0FE5482
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7A0FE513D
Tcl_GetVar2, xrefs: 00007FF7A0FE534E
Tcl_MutexLock, xrefs: 00007FF7A0FE5236

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: e0502fcf1b420640f725b5f986344d9b1d5f93aef03ede1fdd1d364c869fabcf
Instruction ID: 1e1312ffbf3155ff6f875402f7222400617e2bf4cb4dbc8870ed8000b53fe5c1
Opcode Fuzzy Hash: e0502fcf1b420640f725b5f986344d9b1d5f93aef03ede1fdd1d364c869fabcf
Instruction Fuzzy Hash: 96E1D564E0FB03C0FB54FB54A950176B3A2AF04B90BDB9471D90D167B4EFACB5689B20

Function 00007FFDA3722084 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 226COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON310 ref: 00007FFDA3722096
PyTuple_New.PYTHON310 ref: 00007FFDA37220A1
PyModule_AddIntConstant.PYTHON310 ref: 00007FFDA37220C1
PyModule_AddIntConstant.PYTHON310 ref: 00007FFDA37220DF
PyModule_AddIntConstant.PYTHON310 ref: 00007FFDA37220FD
PyModule_AddIntConstant.PYTHON310 ref: 00007FFDA372211B

Part of subcall function 00007FFDA3722460: PyLong_FromLongLong.PYTHON310(?,?,00000000,00007FFDA372213B), ref: 00007FFDA3722478
Part of subcall function 00007FFDA3722460: PyModule_AddObject.PYTHON310(?,?,00000000,00007FFDA372213B), ref: 00007FFDA372248F

PyErr_NewExceptionWithDoc.PYTHON310 ref: 00007FFDA37223D0
PyModule_AddType.PYTHON310 ref: 00007FFDA37223E5
PyType_FromModuleAndSpec.PYTHON310 ref: 00007FFDA37223FC
PyModule_AddType.PYTHON310 ref: 00007FFDA3722410
PyType_FromModuleAndSpec.PYTHON310 ref: 00007FFDA3722427
PyModule_AddType.PYTHON310 ref: 00007FFDA372243C

Strings

FILTER_DELTA, xrefs: 00007FFDA3722213
PRESET_DEFAULT, xrefs: 00007FFDA372238B
FILTER_LZMA1, xrefs: 00007FFDA37221DA
MF_BT3, xrefs: 00007FFDA372231F
Call to liblzma failed., xrefs: 00007FFDA37223BF
FILTER_ARMTHUMB, xrefs: 00007FFDA372227E
CHECK_CRC64, xrefs: 00007FFDA3722165
CHECK_CRC32, xrefs: 00007FFDA3722149
PRESET_EXTREME, xrefs: 00007FFDA37223A5
FORMAT_XZ, xrefs: 00007FFDA37220D5
MF_BT4, xrefs: 00007FFDA372233A
MF_HC4, xrefs: 00007FFDA37222E6
MODE_FAST, xrefs: 00007FFDA3722355
FILTER_X86, xrefs: 00007FFDA372222A
FILTER_ARM, xrefs: 00007FFDA3722263
FILTER_IA64, xrefs: 00007FFDA3722248
MF_HC3, xrefs: 00007FFDA37222CF
CHECK_UNKNOWN, xrefs: 00007FFDA37221BC
FILTER_LZMA2, xrefs: 00007FFDA37221F8
MODE_NORMAL, xrefs: 00007FFDA3722370
FORMAT_AUTO, xrefs: 00007FFDA37220B7
CHECK_NONE, xrefs: 00007FFDA372212C
FORMAT_ALONE, xrefs: 00007FFDA37220F3
CHECK_ID_MAX, xrefs: 00007FFDA37221A1
CHECK_SHA256, xrefs: 00007FFDA3722186
MF_BT2, xrefs: 00007FFDA3722304
FORMAT_RAW, xrefs: 00007FFDA3722111
_lzma.LZMAError, xrefs: 00007FFDA37223C9
FILTER_POWERPC, xrefs: 00007FFDA37222B4
FILTER_SPARC, xrefs: 00007FFDA3722299

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_ObjectStateTuple_With
String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
API String ID: 2322464913-730042774
Opcode ID: c9ade46ea20d25584dcc8921bd4bc6df0ee2ea7a7e6634942537edf886429ed1
Instruction ID: 9818faf80361da1948b5bb46726e3297d12ec5f3e89e233b9284ff11b6361ebd
Opcode Fuzzy Hash: c9ade46ea20d25584dcc8921bd4bc6df0ee2ea7a7e6634942537edf886429ed1
Instruction Fuzzy Hash: 44A18CA0B0A69342F6549B96F9312B53362AF04784F806034CE4DA6753EF2FFD45C72A

Function 00007FFDA5468C24 Relevance: 54.6, APIs: 3, Strings: 28, Instructions: 352COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546913D
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469175
DName::operator+.LIBVCRUNTIME ref: 00007FFDA54691AF

Strings

char8_t, xrefs: 00007FFDA5468F2D
volatile, xrefs: 00007FFDA5469025
char32_t, xrefs: 00007FFDA54690B7
char, xrefs: 00007FFDA5468CF2
auto, xrefs: 00007FFDA5468F3F
wchar_t, xrefs: 00007FFDA54690A8
unsigned , xrefs: 00007FFDA54690FA
__int16, xrefs: 00007FFDA5468E1C
short, xrefs: 00007FFDA5468CE0
__int8, xrefs: 00007FFDA5468E2E
__int64, xrefs: 00007FFDA5468EC9
void, xrefs: 00007FFDA5468D86
bool, xrefs: 00007FFDA5469056
UNKNOWN, xrefs: 00007FFDA546908D
const, xrefs: 00007FFDA5468FDD
long , xrefs: 00007FFDA5468D31
float, xrefs: 00007FFDA5468D74
__int32, xrefs: 00007FFDA5468EDB
long, xrefs: 00007FFDA5468CBC
char16_t, xrefs: 00007FFDA5469065
volatile, xrefs: 00007FFDA5468FF8
signed , xrefs: 00007FFDA546910A
double, xrefs: 00007FFDA5468D48
<unknown>, xrefs: 00007FFDA5468F1B
decltype(auto), xrefs: 00007FFDA54690C6
__int128, xrefs: 00007FFDA5468EB7
int, xrefs: 00007FFDA5468CCE
__w64 , xrefs: 00007FFDA5468E3A

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1388207849
Opcode ID: 34b20832b4d5a9c82cdd9a34609b0a596913eac70dfc3082442192f721d64891
Instruction ID: 0a0421b70ce9573b0921ff7eea20a5e99c527c3ec86f2ec014017635535fb1f7
Opcode Fuzzy Hash: 34b20832b4d5a9c82cdd9a34609b0a596913eac70dfc3082442192f721d64891
Instruction Fuzzy Hash: C7F16AB2F0A61A94FB148B64C9743BC27B1BB06B44F404536DA0D56FAADFFDA644C348

Function 00007FFDA546C3C8 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C459
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C492
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C566
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C577
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C5DA
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C5EA
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C636
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C648
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C7BB
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C83B
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C84A

Strings

`anonymous namespace', xrefs: 00007FFDA546C71B

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: `anonymous namespace'
API String ID: 2943138195-3062148218
Opcode ID: c36001f134547c1fc12f70ffa9b86d35a9d04869d0c52a2f257cd9dd74f3dfc9
Instruction ID: 2595aa4e94b9ff3dd2561ce6c5180a1c7b55b59a82a0462d10fb8ea9c3db7ade
Opcode Fuzzy Hash: c36001f134547c1fc12f70ffa9b86d35a9d04869d0c52a2f257cd9dd74f3dfc9
Instruction Fuzzy Hash: 55E15C72A0AB8A99EB10CF64D8A03ED77A1FB46B48F408036EA4D17B57DFB8D554C704

Function 00007FFDA3717164 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 153threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON310 ref: 00007FFDA3717190
PyThread_allocate_lock.PYTHON310 ref: 00007FFDA37171E9
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFDA371723E
PyThread_free_lock.PYTHON310 ref: 00007FFDA37172F7
PyLong_AsUnsignedLongLong.PYTHON310 ref: 00007FFDA3717320
PyErr_Occurred.PYTHON310 ref: 00007FFDA3717329
PyErr_SetString.PYTHON310 ref: 00007FFDA3717377
_Py_Dealloc.PYTHON310 ref: 00007FFDA371738E
PyThread_free_lock.PYTHON310 ref: 00007FFDA37245E5
_Py_Dealloc.PYTHON310 ref: 00007FFDA37245FF

Strings

Unable to allocate lock, xrefs: 00007FFDA37245D9
Cannot specify filters except with FORMAT_RAW, xrefs: 00007FFDA3717366
Invalid container format: %d, xrefs: 00007FFDA3724612
Cannot specify memory limit with FORMAT_RAW, xrefs: 00007FFDA3717385
Must specify filters for FORMAT_RAW, xrefs: 00007FFDA37245C6

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: DeallocErr_LongStringThread_free_lock$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
API String ID: 3070611864-1518367256
Opcode ID: 06a8b1797633f3e9f1baa306de3463f1a042246164606411b498aa83b03b32bb
Instruction ID: b604513479e23caf9faf620cb74f89f5e1bd662eb145ec25ab5355c70717cf1d
Opcode Fuzzy Hash: 06a8b1797633f3e9f1baa306de3463f1a042246164606411b498aa83b03b32bb
Instruction Fuzzy Hash: AD618122B0AAC2C5EA689BA1956437873A2FF45B50F144235DE2D273E3CF3EE455C309

Function 00007FFDA371FFE4 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PyMapping_GetItemString.PYTHON310 ref: 00007FFDA372000D
PyMem_Calloc.PYTHON310 ref: 00007FFDA372005F
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON310 ref: 00007FFDA3720145
PyErr_ExceptionMatches.PYTHON310 ref: 00007FFDA372016F
PyErr_Clear.PYTHON310 ref: 00007FFDA3720179

Part of subcall function 00007FFDA37211A0: PyLong_AsUnsignedLongLong.PYTHON310(?,?,00000006,00007FFDA3720034), ref: 00007FFDA37211AD
Part of subcall function 00007FFDA37211A0: PyErr_Occurred.PYTHON310(?,?,00000006,00007FFDA3720034), ref: 00007FFDA37211B6

PyErr_SetString.PYTHON310 ref: 00007FFDA3720195
PyMem_Free.PYTHON310 ref: 00007FFDA372019E
_Py_Dealloc.PYTHON310 ref: 00007FFDA3725596
PyErr_NoMemory.PYTHON310 ref: 00007FFDA37255A2
PyMem_Free.PYTHON310 ref: 00007FFDA37255B1
PyErr_Format.PYTHON310 ref: 00007FFDA37255C5

Strings

Invalid compression preset: %u, xrefs: 00007FFDA37255BB
|OOO&O&O&O&O&O&O&O&, xrefs: 00007FFDA37200F2
Invalid filter specifier for LZMA filter, xrefs: 00007FFDA372018B
preset, xrefs: 00007FFDA3720000

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_$Mem_$FreeLongString$Arg_CallocClearDeallocExceptionFormatItemKeywords_Long_Mapping_MatchesMemoryOccurredParseSizeTupleUnsigned
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 1065449411-1461672608
Opcode ID: 335b8958b1e6fecbbc1b2946bb15ca81bc3a65301f35971cbee07f519d58f394
Instruction ID: d16a9b0607b9f8b139dce01a44c4df561460d7f4a031057156afab14fcf434cc
Opcode Fuzzy Hash: 335b8958b1e6fecbbc1b2946bb15ca81bc3a65301f35971cbee07f519d58f394
Instruction Fuzzy Hash: 86515071B0AB8282EB208F91F5602B9B3A6FF88B80F544135DA8D13756DF3DE058C745

Function 00007FFDA3717F84 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA3717FD9
PyObject_GetBuffer.PYTHON310 ref: 00007FFDA371800D
PyBuffer_IsContiguous.PYTHON310 ref: 00007FFDA371801E
PyBuffer_Release.PYTHON310 ref: 00007FFDA3718051
_PyNumber_Index.PYTHON310 ref: 00007FFDA3718083
PyLong_AsSsize_t.PYTHON310 ref: 00007FFDA3718094
_PyArg_UnpackKeywords.PYTHON310 ref: 00007FFDA37180E7
PyErr_Occurred.PYTHON310 ref: 00007FFDA3718107
_PyArg_BadArgument.PYTHON310 ref: 00007FFDA3724768

Strings

argument 'data', xrefs: 00007FFDA372475A
decompress, xrefs: 00007FFDA3724761
contiguous buffer, xrefs: 00007FFDA3724753

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Arg_Buffer_$ArgumentBufferContiguousErr_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 883004049-2667845042
Opcode ID: 4c834b9d06f30c62921faa0a5208c83bfb1527783c96a9a8b77359d4552b8308
Instruction ID: 57741739a8bf45f829478604e9ce71da3bc296885e029ae5bd64ca48c0533278
Opcode Fuzzy Hash: 4c834b9d06f30c62921faa0a5208c83bfb1527783c96a9a8b77359d4552b8308
Instruction Fuzzy Hash: AF41C132B0AB8A92EB108B11D860379B3A2FF49B94F444135DE1D277A6DF3EE545C709

Function 00007FF7A0FE6BF0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7A0FE6C2C

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

Strings

Failed to get ANSI buffer size., xrefs: 00007FF7A0FE6CED
win32_utils_from_utf8, xrefs: 00007FF7A0FE6C69
WideCharToMultiByte, xrefs: 00007FF7A0FE6D4C
Out of memory., xrefs: 00007FF7A0FE6C70, 00007FF7A0FE6D12
Failed to encode filename as ANSI., xrefs: 00007FF7A0FE6D45
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7A0FE6CA6
win32_wcs_to_mbs, xrefs: 00007FF7A0FE6D0B
MultiByteToWideChar, xrefs: 00007FF7A0FE6C40, 00007FF7A0FE6CAD
Failed to get wchar_t buffer size., xrefs: 00007FF7A0FE6C39

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
API String ID: 203985260-1562484376
Opcode ID: 3862dad7a734e1b5327f1da3e4475b8c5beb01cc5423311b44373fd47d1e8b31
Instruction ID: 4dbc4542f05a7c0d9f5d8de521071bb6d408ef0a3d75bc4fbf6a0370f0e743a5
Opcode Fuzzy Hash: 3862dad7a734e1b5327f1da3e4475b8c5beb01cc5423311b44373fd47d1e8b31
Instruction Fuzzy Hash: BD41AC31A0EA4781F720BB26AC4007AB7A1AB94BD0FD64935E94D57BB5EF7CF1118720

Function 00007FFDA4333044 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA433309B
_PyArg_UnpackKeywords.PYTHON310 ref: 00007FFDA43330E4
PyObject_GetBuffer.PYTHON310 ref: 00007FFDA43330FD
PyBuffer_IsContiguous.PYTHON310 ref: 00007FFDA433310E
_PyNumber_Index.PYTHON310 ref: 00007FFDA4333128
PyLong_AsSsize_t.PYTHON310 ref: 00007FFDA433313D
PyBuffer_Release.PYTHON310 ref: 00007FFDA433317B

Strings

argument 'data', xrefs: 00007FFDA433B48E
contiguous buffer, xrefs: 00007FFDA433B487
decompress, xrefs: 00007FFDA433B495

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Buffer_$Arg_BufferContiguousIndexKeywordsLong_Number_Object_ReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 2593461735-2667845042
Opcode ID: 489b83138cb8064df65243e52b52d077de491c5e396123879a079d1e6a1509c8
Instruction ID: 40e48e15421e2cbc62e940648d1b127a44f02f8b6bfc712027a44da8eb1f3cff
Opcode Fuzzy Hash: 489b83138cb8064df65243e52b52d077de491c5e396123879a079d1e6a1509c8
Instruction Fuzzy Hash: 84417121B5AF4282EA50AB12E8B427963A4FF46B94F449131DE6D077B6DF3CF845C708

Function 00007FFDA546A83C Relevance: 22.9, APIs: 15, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A88D
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A969
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A9B2
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A9C3

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 63ad456de8db332c0b347e2e514b887ab112aaee213ccda8367cb7f767930e9c
Instruction ID: 72e18d5d94b8098a67cf969089f73c17f62bc3307c8ff0a714371ec73b34dbca
Opcode Fuzzy Hash: 63ad456de8db332c0b347e2e514b887ab112aaee213ccda8367cb7f767930e9c
Instruction Fuzzy Hash: 1CF17C72B09B8A9AE710DF65D4A03EC37B1EB06B4CB444032DA4D57B96DFB8D509D348

Function 00007FFDA546D20C Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 349COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546D712

Strings

`template-type-parameter-, xrefs: 00007FFDA546D6D0
`generic-class-parameter-, xrefs: 00007FFDA546D6C7
`generic-method-parameter-, xrefs: 00007FFDA546D6B7
NULL, xrefs: 00007FFDA546D2D7
nullptr, xrefs: 00007FFDA546D3FA

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$nullptr
API String ID: 2943138195-2309034085
Opcode ID: 767f6b35ed257beddb1ea2fff1390adae3ecab9bc22a75a6672164d643aa4b64
Instruction ID: 302238d960dbd41f69b653a8869a57225cfcddd68789945a31a6879c79f834ee
Opcode Fuzzy Hash: 767f6b35ed257beddb1ea2fff1390adae3ecab9bc22a75a6672164d643aa4b64
Instruction Fuzzy Hash: 87E16C62F0AA5A94FB149B64C9743BC27A1AF46F44F440136CA0E17F9BDFBCA944C349

Function 00007FF7A0FE1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A0FE14F9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A0FE15E5
malloc, xrefs: 00007FF7A0FE1560
Failed to extract %s: failed to open target file!, xrefs: 00007FF7A0FE148A
fwrite, xrefs: 00007FF7A0FE15DC
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7A0FE1559
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7A0FE15D5
fopen, xrefs: 00007FF7A0FE1491
fread, xrefs: 00007FF7A0FE15EC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A0FE14CA
fseek, xrefs: 00007FF7A0FE1500

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: d8cfd245c2b842eac18b9ec860ab2935fd44da81367d92f488978e2e77dcfbdf
Instruction ID: eb7a6a3adedc0293e9a2355b9cbcf134823dbbb4a0d86bbb805e83dafde25f6d
Opcode Fuzzy Hash: d8cfd245c2b842eac18b9ec860ab2935fd44da81367d92f488978e2e77dcfbdf
Instruction Fuzzy Hash: D7518D71B0E643C1FE20AB22A8106BAA360BB85B94FCA4831DD1D577B5EE7CF1558720

Function 00007FF7A0FE6A60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF7A0FE59BA,?,00007FF7A0FE58AD), ref: 00007FF7A0FE6AA0
OpenProcessToken.ADVAPI32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6AB1
GetTokenInformation.ADVAPI32(?,00007FF7A0FE58AD(TokenIntegrityLevel)), ref: 00007FF7A0FE6AD3
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7A0FE6ADD
GetTokenInformation.ADVAPI32(?,TokenIntegrityLevel), ref: 00007FF7A0FE6B1A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7A0FE6B2C
CloseHandle.KERNEL32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6B44
LocalFree.KERNEL32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6B76
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7A0FE6B9D
CreateDirectoryW.KERNEL32(?,00007FF7A0FE58AD), ref: 00007FF7A0FE6BAE

Strings

S-1-3-4, xrefs: 00007FF7A0FE6B4F
D:(A;;FA;;;%s), xrefs: 00007FF7A0FE6B59

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: c79bcb34d9950482b5642b7e8b58aabf54e811d274faf88abeec3ee0803c085a
Instruction ID: 34c951fb6fe23c871b6cb8ccc3a4473ff7589764b1697779b4b38b7ac6d21359
Opcode Fuzzy Hash: c79bcb34d9950482b5642b7e8b58aabf54e811d274faf88abeec3ee0803c085a
Instruction Fuzzy Hash: AE41713161D687C2E710EF20E8446AAB361FB84794F854631EA5E577A4DF7CE448CB20

Function 00007FFDA5462CE4 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFDA5462D40

Part of subcall function 00007FFDA5465010: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFDA5465045
Part of subcall function 00007FFDA5465010: __GetUnwindTryBlock.LIBCMT ref: 00007FFDA5465053
Part of subcall function 00007FFDA5465010: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFDA5465078

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDA5462E18
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5462E25
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFDA5463060
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA546308E
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFDA54630CC

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5463154
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFDA5463189

Strings

csm, xrefs: 00007FFDA5462E3D
csm, xrefs: 00007FFDA5462D5A
csm, xrefs: 00007FFDA5462DC1

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3436797354-393685449
Opcode ID: d5e0e3ab29c15918133307a59fdea49d8ed4f7431b693d67295d57de9f2acebd
Instruction ID: d991ec83e7da6142b5b6cab6b6df65fdd74f514006530bec1b971128a79619ff
Opcode Fuzzy Hash: d5e0e3ab29c15918133307a59fdea49d8ed4f7431b693d67295d57de9f2acebd
Instruction Fuzzy Hash: 43D19032B0978996EB209F65E4603AD77A0FB46F98F000135EE8D57B5ACF78E494C744

Function 00007FFDA37203E4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 131threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON310 ref: 00007FFDA3720431
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON310 ref: 00007FFDA3720472
PyThread_allocate_lock.PYTHON310 ref: 00007FFDA37204C1
PyErr_Format.PYTHON310 ref: 00007FFDA3720545
PyThread_free_lock.PYTHON310 ref: 00007FFDA3720552
PyErr_SetString.PYTHON310 ref: 00007FFDA37205DB

Strings

|iiOO:LZMACompressor, xrefs: 00007FFDA3720444
Unable to allocate lock, xrefs: 00007FFDA372564F
Cannot specify both preset and filter chain, xrefs: 00007FFDA37205CA
Integrity checks are only supported by FORMAT_XZ, xrefs: 00007FFDA372563C
Invalid container format: %d, xrefs: 00007FFDA372053B

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_$Arg_FormatKeywords_ModuleParseSizeStateStringThread_allocate_lockThread_free_lockTupleType_
String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
API String ID: 3029081906-3984722346
Opcode ID: 273e513f8ca3ad474df13d0bfc6a14d0ce733ae21530f73db41356d7592cbcf5
Instruction ID: a470fe2aefd5a68b0aeb8c3689c1021a3a3ab1bc9e1e658ed13bb1c574650a49
Opcode Fuzzy Hash: 273e513f8ca3ad474df13d0bfc6a14d0ce733ae21530f73db41356d7592cbcf5
Instruction Fuzzy Hash: BC517F72B0AB8289EB608F96E4604B877B6FB44784B500036DE4D23B56EF3EE444C715

Function 00007FFDA371FE98 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FEBD
PyMapping_GetItemString.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FED7
PyLong_AsUnsignedLongLong.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FEEC
PyErr_Occurred.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FEFF
PyErr_ExceptionMatches.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FF78
PyErr_Format.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FFC1
PyErr_SetString.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FFDA
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA372558A

Strings

Invalid filter ID: %llu, xrefs: 00007FFDA371FFB4
Filter specifier must be a dict or dict-like object, xrefs: 00007FFDA372557B
Filter specifier must have an "id" entry, xrefs: 00007FFDA371FFD0

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_$LongMapping_String$CheckDeallocExceptionFormatItemLong_MatchesOccurredUnsigned
String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
API String ID: 1881886752-3390802605
Opcode ID: 77fa6589d453a4eb9c8da71517d291aae4064159501b0829a824121003cb23a9
Instruction ID: d63c90ea8525a5abcea25482e3567aa63dad3276b2538e992725a4dbfd617cbe
Opcode Fuzzy Hash: 77fa6589d453a4eb9c8da71517d291aae4064159501b0829a824121003cb23a9
Instruction Fuzzy Hash: BE411176B0AA43C1EB648F55A96423873E6FF46B80F448132DA4D663A3DE7EE445C309

Function 00007FFDA3722A98 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA3722AC9
PyLong_AsUnsignedLongLong.PYTHON310 ref: 00007FFDA3722ADE
PyErr_Occurred.PYTHON310 ref: 00007FFDA3722AE7
PyObject_GetBuffer.PYTHON310 ref: 00007FFDA3722AFE
PyBuffer_IsContiguous.PYTHON310 ref: 00007FFDA3722B0F
PyBuffer_Release.PYTHON310 ref: 00007FFDA3722B3D
_PyArg_CheckPositional.PYTHON310 ref: 00007FFDA3725B7B
_PyArg_BadArgument.PYTHON310 ref: 00007FFDA3725BA7

Part of subcall function 00007FFDA3722B5C: PyModule_GetState.PYTHON310(?,?,?,?,00000000,00007FFDA3722B2D), ref: 00007FFDA3722B6E
Part of subcall function 00007FFDA3722B5C: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FFDA3722B2D), ref: 00007FFDA3722BAA

Strings

contiguous buffer, xrefs: 00007FFDA3725B92
_decode_filter_properties, xrefs: 00007FFDA3725B71, 00007FFDA3725BA0
argument 2, xrefs: 00007FFDA3725B99

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Arg_Buffer_Long$ArgumentBufferCheckContiguousErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
String ID: _decode_filter_properties$argument 2$contiguous buffer
API String ID: 3656606796-2431706548
Opcode ID: 1f865104b5ec56abf7b835cf86625fbb744c1fda0ac40d1280ec3478d8359bd7
Instruction ID: ade4e32d3c3e3de137a0c43607328ddffcad99063c1c6dbc715d63f81034c3a3
Opcode Fuzzy Hash: 1f865104b5ec56abf7b835cf86625fbb744c1fda0ac40d1280ec3478d8359bd7
Instruction Fuzzy Hash: F131F561B09A8281EB108F61E8642B973B2FF84FC4F484131EA0D23766DF3EE945C745

Function 00007FFDA3718448 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FFDA3718497
PyErr_NoMemory.PYTHON310 ref: 00007FFDA3724834

Strings

Input format not supported by decoder, xrefs: 00007FFDA371848C
Memory usage limit exceeded, xrefs: 00007FFDA37184C5
Corrupt input data, xrefs: 00007FFDA37184DB
Unrecognized error from liblzma: %d, xrefs: 00007FFDA3724853
Internal error, xrefs: 00007FFDA37184BC
Insufficient buffer space, xrefs: 00007FFDA37184E4
Unsupported integrity check, xrefs: 00007FFDA3724840
Invalid or unsupported options, xrefs: 00007FFDA37184D2

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_$MemoryString
String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
API String ID: 60457842-2177155514
Opcode ID: 13fc9c28bf94d51711e54dbc170eec9cd0b93583607eeb6d5ead681ff5ce391a
Instruction ID: 652ea9c7db67a306742257b76b7ae712bfc09785c51c4b35d5d5306c0972f512
Opcode Fuzzy Hash: 13fc9c28bf94d51711e54dbc170eec9cd0b93583607eeb6d5ead681ff5ce391a
Instruction Fuzzy Hash: 1D216D62F2EA53A0E9788F98957563872A3AF4A340F506035CD0E257F7CE1FF944E609

Function 00007FFDA3723050 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA3723078
__scrt_initialize_crt.LIBCMT ref: 00007FFDA37230BD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA37230CA
_RTC_Initialize.LIBCMT ref: 00007FFDA37230F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA372311E
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA3723149

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: d65b745de3d487d9cb33355ea61edba222a1b326d57eea3f9f63b2389da7bb84
Instruction ID: 4e021f51129ad68f0f6d97ee3009310e7ef510654021b0bcdc93c25f53dd6bca
Opcode Fuzzy Hash: d65b745de3d487d9cb33355ea61edba222a1b326d57eea3f9f63b2389da7bb84
Instruction Fuzzy Hash: A881E161F0E64346FA649BE594712797293AF49B80F084039FA4C77397DF3EE805870A

Function 00007FFDA433A1CC Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA433A1F4
__scrt_initialize_crt.LIBCMT ref: 00007FFDA433A239
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA433A246
_RTC_Initialize.LIBCMT ref: 00007FFDA433A274
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA433A29A
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA433A2C5

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: c5fb66690cc19b900b2a78e7650f3023e2b6ea1cddc9dd79312870641b5028eb
Instruction ID: dd2b709c78b0dc7ad261a550838dc7ccb55d709404bfb293ddd8eab9c31c835f
Opcode Fuzzy Hash: c5fb66690cc19b900b2a78e7650f3023e2b6ea1cddc9dd79312870641b5028eb
Instruction Fuzzy Hash: CE819921F8AE4386FA50BB6594F52B97290AF47780F184135DA0D837B7DEBDF8418708

Function 00007FFDA3717D6C Relevance: 16.6, APIs: 11, Instructions: 147COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDA3717EB6

Part of subcall function 00007FFDA3718118: PyType_GetModuleState.PYTHON310(?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA371814D
Part of subcall function 00007FFDA3718118: PyEval_SaveThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3718174
Part of subcall function 00007FFDA3718118: PyEval_RestoreThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA371818D

PyMem_Malloc.PYTHON310 ref: 00007FFDA3717E35
memmove.VCRUNTIME140 ref: 00007FFDA3717E61
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFDA3717EE6
PyMem_Realloc.PYTHON310 ref: 00007FFDA3717F2D
memmove.VCRUNTIME140 ref: 00007FFDA3717F5F
PyMem_Free.PYTHON310 ref: 00007FFDA3724713
_Py_Dealloc.PYTHON310 ref: 00007FFDA3724743

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Mem_memmove$Eval_Thread$Bytes_DeallocFreeFromMallocModuleReallocRestoreSaveSizeStateStringType_
String ID:
API String ID: 2269716368-0
Opcode ID: dc858228a67825307c5b4b35180acf8fdc6bcbae16a7170ae2df431ad5f3c3ef
Instruction ID: 29457e418ba93b90211ffca238f402b9a39b4de83f6b407f943dd37b3d383f07
Opcode Fuzzy Hash: dc858228a67825307c5b4b35180acf8fdc6bcbae16a7170ae2df431ad5f3c3ef
Instruction Fuzzy Hash: A5617F63B0AB8281EB548F61D56437833A6FB45F98F144136CE0D277AADF3EE4458319

Function 00007FFDA546E350 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

Strings

`generic-type-, xrefs: 00007FFDA546E491
template-parameter-, xrefs: 00007FFDA546E417
`template-parameter-, xrefs: 00007FFDA546E44A
generic-type-, xrefs: 00007FFDA546E45E

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID:
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 0-3207858774
Opcode ID: 6f458657f8fae6e2f2557f40169539ea56a3e6fb73d2116d9b83691f1491e61c
Instruction ID: b16a88d415344983229b7c34507d3a15bdd6ea8d7508b720365f8421a4d97ba4
Opcode Fuzzy Hash: 6f458657f8fae6e2f2557f40169539ea56a3e6fb73d2116d9b83691f1491e61c
Instruction Fuzzy Hash: D6917C22B0AA4E95FB108B65D4603B937E1EB56F44F884032EA4D07B97EFBCE515D348

Function 00007FFDA546A13C Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A198

Part of subcall function 00007FFDA546722C: DName::operator+=.LIBVCRUNTIME ref: 00007FFDA5467247

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A2C5

Strings

`unknown ecsu', xrefs: 00007FFDA546A164
class , xrefs: 00007FFDA546A2DA
union , xrefs: 00007FFDA546A2F2
coclass , xrefs: 00007FFDA546A27E
struct , xrefs: 00007FFDA546A2E9
cointerface , xrefs: 00007FFDA546A26C
enum , xrefs: 00007FFDA546A287

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+$Name::operator+=
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 179159573-1464470183
Opcode ID: 2fc61dd6c602e97fa3c1e55ca06bd20aebc659b0b394667bc2b1a0081ee2f141
Instruction ID: 96972200d44227e6a9b4f42a0fba82177ecf893d290700c038e863b287e7c3b5
Opcode Fuzzy Hash: 2fc61dd6c602e97fa3c1e55ca06bd20aebc659b0b394667bc2b1a0081ee2f141
Instruction Fuzzy Hash: 36515831F1AB1AC9FB14CB65E8603AC33B1BB06B84F504135EA0D16F5ADFA9E581D304

Function 00007FF7A0FE6670 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(WideCharToMultiByte,00007FF7A0FE1CE4,?,?,00000000,00007FF7A0FE6904), ref: 00007FF7A0FE6697
FormatMessageW.KERNEL32 ref: 00007FF7A0FE66C6
WideCharToMultiByte.KERNEL32 ref: 00007FF7A0FE671C

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

Strings

PyInstaller: FormatMessageW failed., xrefs: 00007FF7A0FE66E3
WideCharToMultiByte, xrefs: 00007FF7A0FE6670, 00007FF7A0FE672D
FormatMessageW, xrefs: 00007FF7A0FE66D7
No error messages generated., xrefs: 00007FF7A0FE66D0
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7A0FE6739
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7A0FE6726

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorLast$ByteCharFormatMessageMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2383786077-2573406579
Opcode ID: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
Instruction ID: 7f02f95556f4eb5cbe42aea558fc1df5f2e19fd4a4f97b92b7f33852a94631cb
Opcode Fuzzy Hash: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
Instruction Fuzzy Hash: 1121AF31A1EA47C1FB60BB25E8446AAB365FB48384FC60135E54D927B4EF7CE1198B20

Function 00007FFDA54688E4 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA54689AE
DName::operator+.LIBVCRUNTIME ref: 00007FFDA54689BE
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468A0A
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468A1A
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468A2A
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468A9D
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468AAE
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468AC0
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468AEC
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5468AFB

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 28d39e64d2900046752fe00e0d170ae61e4b908a297697eb59c3c366de5be272
Instruction ID: 59596a540975df1fa5495c6283a736237e8f51fa8915a074b979e689340d8295
Opcode Fuzzy Hash: 28d39e64d2900046752fe00e0d170ae61e4b908a297697eb59c3c366de5be272
Instruction Fuzzy Hash: 5B611C62B15B5A98FB10DBA0D8A03EC37B2BB45B88B404436DE4D6BF4ADFB8D545C344

Function 00007FFDA4332D78 Relevance: 15.1, APIs: 10, Instructions: 144COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDA4332DF1
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFDA4332E78
PyMem_Malloc.PYTHON310 ref: 00007FFDA4332EC5
memmove.VCRUNTIME140 ref: 00007FFDA4332EED
PyMem_Realloc.PYTHON310 ref: 00007FFDA4332F0B
_Py_Dealloc.PYTHON310 ref: 00007FFDA433B456

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Mem_memmove$Bytes_DeallocFromMallocReallocSizeString
String ID:
API String ID: 1285943476-0
Opcode ID: 6f5f8409d7685b87bf51d1da4f85cac23dc218c84fa201a3f9492e95715b92f3
Instruction ID: 7b00c3f8e7039ca6482535eec108947cc66130a364c5cac2ef61718851c5ec75
Opcode Fuzzy Hash: 6f5f8409d7685b87bf51d1da4f85cac23dc218c84fa201a3f9492e95715b92f3
Instruction Fuzzy Hash: 7D51F622B8AF4281EB54AF2694B437863A0AB46F94F588435CE5D477BADF3CF4558308

Function 00007FF7A0FEF5C8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEF608
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEF9D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FEFC6F

Strings

p, xrefs: 00007FF7A0FEF6AD
f, xrefs: 00007FF7A0FEF70A
f, xrefs: 00007FF7A0FEF855
p, xrefs: 00007FF7A0FEF712
f, xrefs: 00007FF7A0FEF6A0

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
Instruction ID: 1376f2ed82f21cc8a3053e6375fd8c82302e73d3daa04c5f69775688a4e2ed8a
Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
Instruction Fuzzy Hash: 72129122E0E143C6FB207A34E45477AF651EB80754FD64832D68A667E4DF3CF4A88B21

Function 00007FFDA54631A0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFDA546333E
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA546334B

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54635F9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5463644
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFDA5463679

Strings

csm, xrefs: 00007FFDA5463367
csm, xrefs: 00007FFDA5463285
csm, xrefs: 00007FFDA54632E7

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 1f2c6e9c8ad6c1917ecaa8d6efe9c468c91fc9baef10e6d9588306a72b9f3ebc
Instruction ID: d1ee8fd5f79f8779e35f6691ea709c52a2244ddaaffceae4029aeb277fe0f2f5
Opcode Fuzzy Hash: 1f2c6e9c8ad6c1917ecaa8d6efe9c468c91fc9baef10e6d9588306a72b9f3ebc
Instruction Fuzzy Hash: 69E19272B097C58AE7209F24E4A03AD7BA0FB46F48F144136DA8D47B56DF78E485CB44

Function 00007FFDA4331C74 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119threadCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA433B00A
PyEval_SaveThread.PYTHON310 ref: 00007FFDA433B030
PyThread_acquire_lock.PYTHON310 ref: 00007FFDA433B042
PyEval_RestoreThread.PYTHON310 ref: 00007FFDA433B04B

Strings

%d work, %d block, ratio %5.2f, xrefs: 00007FFDA433AFF0
VUUU, xrefs: 00007FFDA4331D37
too repetitive; using fallback sorting algorithm, xrefs: 00007FFDA433B013

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveThread_acquire_lock__acrt_iob_func
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 1485238034-2988393112
Opcode ID: b6afabacf775a9cc451f3460281906f66054786c8d903f877a2cf8c040c4fbb5
Instruction ID: de6f251f4929ea7397fa12f6d9193a97753c430bc3881e7c532f330d299ec00f
Opcode Fuzzy Hash: b6afabacf775a9cc451f3460281906f66054786c8d903f877a2cf8c040c4fbb5
Instruction Fuzzy Hash: 7741D132B49A0287E614AF25D4A51B973A1FF8AB94F101236DA0E537B6DF3DF4828604

Function 00007FFDA546BE24 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546BFD8

Part of subcall function 00007FFDA5468C24: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546913D
Part of subcall function 00007FFDA5468C24: DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469175

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546BF8A

Strings

cli::pin_ptr<, xrefs: 00007FFDA546BFA1
std::nullptr_t, xrefs: 00007FFDA546BF03
std::nullptr_t , xrefs: 00007FFDA546BF16
void , xrefs: 00007FFDA546BE96
void, xrefs: 00007FFDA546BE6E
cli::array<, xrefs: 00007FFDA546BF57

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: e2dcc5ac231621b7bb9adceaede0f9dd180f9bba2b8fff5e7c5622460418e45f
Instruction ID: 6cc5b24539cabd735fd5db45b41afd5dfb56190feb6008fe0a22b35078a5564d
Opcode Fuzzy Hash: e2dcc5ac231621b7bb9adceaede0f9dd180f9bba2b8fff5e7c5622460418e45f
Instruction Fuzzy Hash: F9514B62F1AB5A98FB15CB60D8613BC77B0BB0AB44F444136DA4D52B9ADFBC9044CB18

Function 00007FF7A0FE6130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A0FE6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7A0FE2B60,?,?,?,?,?,?), ref: 00007FF7A0FE617F
GetStartupInfoW.KERNEL32 ref: 00007FF7A0FE619E

Part of subcall function 00007FF7A0FF92E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF92F8

Part of subcall function 00007FF7A0FF705C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF70C3

GetCommandLineW.KERNEL32 ref: 00007FF7A0FE623E
CreateProcessW.KERNEL32 ref: 00007FF7A0FE6280
WaitForSingleObject.KERNEL32 ref: 00007FF7A0FE6294
GetExitCodeProcess.KERNEL32 ref: 00007FF7A0FE62A4

Strings

Error creating child process!, xrefs: 00007FF7A0FE62B0
CreateProcessW, xrefs: 00007FF7A0FE62B7

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
Instruction ID: 8425f22972fb6c4705125320dc8d2d1ed0a894da8e2768be2501cc697fa55419
Opcode Fuzzy Hash: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
Instruction Fuzzy Hash: CE411232A0D78685EB20AB74E4452AAF360FF94360F914735E6AD47BE5DF7CE0548B10

Function 00007FFDA43332CC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON310(?,?,?,00007FFDA43332B7), ref: 00007FFDA43332D9
PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFDA433331F
PyThread_free_lock.PYTHON310(?,?,?,00007FFDA43332B7), ref: 00007FFDA4333360
PyErr_SetString.PYTHON310(?,?,?,00007FFDA43332B7), ref: 00007FFDA433B507

Strings

Unable to allocate lock, xrefs: 00007FFDA433B4FD

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: String$Bytes_Err_FromSizeThread_allocate_lockThread_free_lock
String ID: Unable to allocate lock
API String ID: 1127547223-3516605728
Opcode ID: 656a757a0f44f6d20da88ea11dbc9c575cb2382933565d6592e5d338dbd8dccc
Instruction ID: 49cc30f71bc5da44f994c41f44323be23ba7c3f6f7318adb1e7787b33323e9f5
Opcode Fuzzy Hash: 656a757a0f44f6d20da88ea11dbc9c575cb2382933565d6592e5d338dbd8dccc
Instruction Fuzzy Hash: E7310522B8AE4281FB54AB25D5B537C22A4BF46B59F148134CA4E467B6CF2CF854C308

Function 00007FFDA3718264 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA371828E
PyObject_GetBuffer.PYTHON310 ref: 00007FFDA371829E
PyBuffer_IsContiguous.PYTHON310 ref: 00007FFDA37182AF
PyBuffer_Release.PYTHON310 ref: 00007FFDA37182DA
_PyArg_BadArgument.PYTHON310 ref: 00007FFDA37247B4

Part of subcall function 00007FFDA3718DA0: PyThread_acquire_lock.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA3718DC6
Part of subcall function 00007FFDA3718DA0: PyThread_release_lock.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA3718DF8

Strings

argument, xrefs: 00007FFDA37247A6
compress, xrefs: 00007FFDA37247AD
contiguous buffer, xrefs: 00007FFDA372479F

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: 303c03b729e6573333164b2c625588096349921c33744cf354f1b9e9d382ae5e
Instruction ID: 2f10e2a1894d1762904b304ad3e7a831e1ba8ab729c1939947dda4f2293fcdcc
Opcode Fuzzy Hash: 303c03b729e6573333164b2c625588096349921c33744cf354f1b9e9d382ae5e
Instruction Fuzzy Hash: 9C110862B19A82D1EB10CB61E8602B9B362FF88FC0F944131D94C63766DF3DD645C704

Function 00007FFDA43325BC Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA43325E6
PyObject_GetBuffer.PYTHON310 ref: 00007FFDA43325F6
PyBuffer_IsContiguous.PYTHON310 ref: 00007FFDA4332607
PyBuffer_Release.PYTHON310 ref: 00007FFDA4332632
_PyArg_BadArgument.PYTHON310 ref: 00007FFDA433B1EC

Part of subcall function 00007FFDA4332650: PyThread_acquire_lock.PYTHON310(?,?,?,00007FFDA4332622), ref: 00007FFDA4332673
Part of subcall function 00007FFDA4332650: PyThread_release_lock.PYTHON310(?,?,?,00007FFDA4332622), ref: 00007FFDA433269F

Strings

argument, xrefs: 00007FFDA433B1DE
compress, xrefs: 00007FFDA433B1E5
contiguous buffer, xrefs: 00007FFDA433B1D7

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: ce6c72934237c014d5c148d159e5f103d980a828e69fd7f3fc88f21be58226ff
Instruction ID: f8cb2534bee9b70e5c20102da7ab7b9d45de9f7e4ed4fef107d1e28f442a4379
Opcode Fuzzy Hash: ce6c72934237c014d5c148d159e5f103d980a828e69fd7f3fc88f21be58226ff
Instruction Fuzzy Hash: B2117C22B49E4281FA20EB25E4B42A96360FF8AB84F948131DA5C43776DF7CE945C704

Function 00007FF7A0FECF90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7A0FECFED

Part of subcall function 00007FF7A0FEDF00: __GetUnwindTryBlock.LIBCMT ref: 00007FF7A0FEDF43
Part of subcall function 00007FF7A0FEDF00: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7A0FEDF68

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7A0FED0C5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7A0FED31A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7A0FED426

Strings

csm, xrefs: 00007FF7A0FED0E8
csm, xrefs: 00007FF7A0FED06E
csm, xrefs: 00007FF7A0FED007

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
Instruction ID: 35646820e0ffd6beca7f766515bdad3345d96875fc14ce1adb297487633da4fa
Opcode Fuzzy Hash: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
Instruction Fuzzy Hash: 28E18132A0E742CAEB20AB7594402ADB7A0FB44B98F410935EF4D67BA5CF38F581C751

Function 00007FFDA5465F0A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA54663F0: RtlPcToFileHeader.KERNEL32 ref: 00007FFDA5466434
Part of subcall function 00007FFDA54663F0: RaiseException.KERNEL32 ref: 00007FFDA546647A

RtlPcToFileHeader.KERNEL32 ref: 00007FFDA5465FA7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFDA5466003

Strings

Access violation - no RTTI data!, xrefs: 00007FFDA5465F0A, 00007FFDA546612B
Bad dynamic_cast!, xrefs: 00007FFDA5466072
Bad read pointer - no RTTI data!, xrefs: 00007FFDA5466108
Attempted a typeid of nullptr pointer!, xrefs: 00007FFDA54660E5

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 7f6c35cefbfcfc98e88ebc0aa35afe6c2c6ede9eabcdb344d1914a97fbaad475
Instruction ID: 711cb7a7f1e9802a5cd72991a34318983f8af901a4279e16228a962bc2e5dc03
Opcode Fuzzy Hash: 7f6c35cefbfcfc98e88ebc0aa35afe6c2c6ede9eabcdb344d1914a97fbaad475
Instruction Fuzzy Hash: 7F51A162B0AA4B92EE24CB14E4A07B96360FF56F94F404431DA8D07B66EFBCE505C304

Function 00007FFDA546E148 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546E1BC
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546E1CB
DName::operator+=.LIBVCRUNTIME ref: 00007FFDA546E2E8

Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C459
Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C492
Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C7BB

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546E26B
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546E27B
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546E325

Strings

{for , xrefs: 00007FFDA546E1F4

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+$Name::operator+=
String ID: {for
API String ID: 179159573-864106941
Opcode ID: edc966f78679f2c80b6a90da374f91d2d358e76260b44eb27b7c84d8a506cb89
Instruction ID: bc05612f37afb7ad4066fdb41cd29b2a0fff75faf9204f005b192d6ec4470bde
Opcode Fuzzy Hash: edc966f78679f2c80b6a90da374f91d2d358e76260b44eb27b7c84d8a506cb89
Instruction Fuzzy Hash: F7513E72B09A8A99F7159F24D4513ED73A2EB46B48F448032EA4C47F96DFBCD554C304

Function 00007FF7A0FE67C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE685F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE68AF

Strings

WideCharToMultiByte, xrefs: 00007FF7A0FE68F8
Out of memory., xrefs: 00007FF7A0FE68E1
win32_utils_to_utf8, xrefs: 00007FF7A0FE68E8
Failed to get UTF-8 buffer size., xrefs: 00007FF7A0FE68F1
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7A0FE68D8

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 02e5b0b248b44fa656670cb4dcae359b0766aafddf42063cad3b4e8aee1a8378
Instruction ID: 5c4f35b75a9974c4a8a0ead7dab40317ae771b5907a4ae1a0061a937b4fc281f
Opcode Fuzzy Hash: 02e5b0b248b44fa656670cb4dcae359b0766aafddf42063cad3b4e8aee1a8378
Instruction Fuzzy Hash: 72418F32A0EB86C5E720EF21B84016AF7A4FB84790F9A4535DA8D53BA5DF3CE456C710

Function 00007FFDA3721D38 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3721D83
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3721DCB
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3721DE2
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3721E24

Strings

Unable to allocate output buffer., xrefs: 00007FFDA3725A82

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemmove
String ID: Unable to allocate output buffer.
API String ID: 3327154725-2565006440
Opcode ID: 1ca65adf5f06bf4806857590d55b9c13c2a485ced682453d4a38273babd4d354
Instruction ID: 60d56e923f4d2296daa114f4e0c9af7f8863e11eb3fecfd44685d5aaa0ed9565
Opcode Fuzzy Hash: 1ca65adf5f06bf4806857590d55b9c13c2a485ced682453d4a38273babd4d354
Instruction Fuzzy Hash: 58416DB2B0AA46C1EB198F92D96026D77A2FB48FD4F188432DE0D27756CF39D151C30A

Function 00007FFDA54668AC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFDA5466A6B,?,?,00000000,00007FFDA546689C,?,?,?,?,00007FFDA54665E5), ref: 00007FFDA5466931
GetLastError.KERNEL32(?,?,?,00007FFDA5466A6B,?,?,00000000,00007FFDA546689C,?,?,?,?,00007FFDA54665E5), ref: 00007FFDA546693F
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDA5466A6B,?,?,00000000,00007FFDA546689C,?,?,?,?,00007FFDA54665E5), ref: 00007FFDA5466958
LoadLibraryExW.KERNEL32(?,?,?,00007FFDA5466A6B,?,?,00000000,00007FFDA546689C,?,?,?,?,00007FFDA54665E5), ref: 00007FFDA546696A
FreeLibrary.KERNEL32(?,?,?,00007FFDA5466A6B,?,?,00000000,00007FFDA546689C,?,?,?,?,00007FFDA54665E5), ref: 00007FFDA54669B0
GetProcAddress.KERNEL32(?,?,?,00007FFDA5466A6B,?,?,00000000,00007FFDA546689C,?,?,?,?,00007FFDA54665E5), ref: 00007FFDA54669BC

Strings

api-ms-, xrefs: 00007FFDA5466951

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 45bb9c456b18d615664943834e4003b355ea3ec7f5874fc1f64106649d67ca5c
Instruction ID: de1562d6ce10a6321a9bd58ebb8b5aeea56b6a62017d3692c41cf12bb96f6bf6
Opcode Fuzzy Hash: 45bb9c456b18d615664943834e4003b355ea3ec7f5874fc1f64106649d67ca5c
Instruction Fuzzy Hash: E331C621B1BA8A91FE11DB02A8203B56394BF06FA0F194535DD1D0BB96EFBCE148C748

Function 00007FFDA3725CBC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310(?,?,?,00007FFDA3724795,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3725CF4
PyBytes_FromStringAndSize.PYTHON310(?,?,?,00007FFDA3724795,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3725D57
PyList_Append.PYTHON310(?,?,?,00007FFDA3724795,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3725D6B
_Py_Dealloc.PYTHON310(?,?,?,00007FFDA3724795,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3725D8A
_Py_Dealloc.PYTHON310(?,?,?,00007FFDA3724795,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3725D9D

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFDA3725CEA
Unable to allocate output buffer., xrefs: 00007FFDA3725D49

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: a5c83a929c8a3d3e3e6269da13eee794442fc036ed40398e420d6479497a2429
Instruction ID: dfdfbcb1e67b80a1b4bb73d7ede982931bab28ea88e914e2d59428e005eff4a4
Opcode Fuzzy Hash: a5c83a929c8a3d3e3e6269da13eee794442fc036ed40398e420d6479497a2429
Instruction Fuzzy Hash: 9731866170AB4682EF14CF95E4A4139B362FF48BA4B144631DE6D677A3DF3EE4418305

Function 00007FFDA433C458 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310(?,?,00000000,00007FFDA433B3B0), ref: 00007FFDA433C490
PyBytes_FromStringAndSize.PYTHON310(?,?,00000000,00007FFDA433B3B0), ref: 00007FFDA433C4F3
PyList_Append.PYTHON310(?,?,00000000,00007FFDA433B3B0), ref: 00007FFDA433C507
_Py_Dealloc.PYTHON310(?,?,00000000,00007FFDA433B3B0), ref: 00007FFDA433C526
_Py_Dealloc.PYTHON310(?,?,00000000,00007FFDA433B3B0), ref: 00007FFDA433C539

Strings

Unable to allocate output buffer., xrefs: 00007FFDA433C4E5
avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFDA433C486

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 02faaa186e3c285db46cc283cf4754e2baa43bb0487fc95db9530d15d3fd3711
Instruction ID: 114cbbc6c9bdbae9c4155ecf0a127773fb3d92fe0769a1c64bdefb342e12a79e
Opcode Fuzzy Hash: 02faaa186e3c285db46cc283cf4754e2baa43bb0487fc95db9530d15d3fd3711
Instruction Fuzzy Hash: B6316F22B4AF46C2EE54EB16E4B01786360FB46BA4F144631DA6D837B6DF2CF4518304

Function 00007FF7A0FE6EC0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00007FF7A0FE2D35,?,?,?,?,?,?), ref: 00007FF7A0FE6F01

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

WideCharToMultiByte.KERNEL32(00000000,00007FF7A0FE2D35,?,?,?,?,?,?), ref: 00007FF7A0FE6F75

Strings

WideCharToMultiByte, xrefs: 00007FF7A0FE6F15, 00007FF7A0FE6F86
Out of memory., xrefs: 00007FF7A0FE6F3B
win32_utils_to_utf8, xrefs: 00007FF7A0FE6F42
Failed to get UTF-8 buffer size., xrefs: 00007FF7A0FE6F0E
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7A0FE6F7F

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1717984340-27947307
Opcode ID: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
Instruction ID: 868a5c692a679927c1a713e24e5e62ccca2b5dcaf26b81d3eb04cf931a0dba97
Opcode Fuzzy Hash: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
Instruction Fuzzy Hash: 1C218F31A0EB47C5EB10EF66AD40069F761AB84BD0B9A4936D60D937B4EF7CF4148710

Function 00007FFDA3719374 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON310 ref: 00007FFDA37193A1
PyThread_release_lock.PYTHON310 ref: 00007FFDA37193D4
PyErr_SetString.PYTHON310 ref: 00007FFDA3719409
PyEval_SaveThread.PYTHON310 ref: 00007FFDA3724AE0
PyThread_acquire_lock.PYTHON310 ref: 00007FFDA3724AF5
PyEval_RestoreThread.PYTHON310 ref: 00007FFDA3724AFE

Strings

Already at end of stream, xrefs: 00007FFDA37193FF

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
String ID: Already at end of stream
API String ID: 2195683152-1334556646
Opcode ID: ed2a6f803f659454fd16fd1d50c8850b04e012d99a183f4d5e22ae895119c5db
Instruction ID: 75b0e15eb049a8eaea48bfceb1b69bb2b9a983ffa2d375d1c3eb0f3d26da40f3
Opcode Fuzzy Hash: ed2a6f803f659454fd16fd1d50c8850b04e012d99a183f4d5e22ae895119c5db
Instruction Fuzzy Hash: 00116062B09B8181EB14DB92E9642697362FB89FC0F045032DE0E63763CF3EE455C309

Function 00007FFDA43331CC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON310 ref: 00007FFDA43331F9
PyThread_release_lock.PYTHON310 ref: 00007FFDA4333229
PyErr_SetString.PYTHON310 ref: 00007FFDA433325E

Part of subcall function 00007FFDA4332D78: memmove.VCRUNTIME140 ref: 00007FFDA4332DF1

PyEval_SaveThread.PYTHON310 ref: 00007FFDA433B4CC
PyThread_acquire_lock.PYTHON310 ref: 00007FFDA433B4E1
PyEval_RestoreThread.PYTHON310 ref: 00007FFDA433B4EA

Strings

End of stream already reached, xrefs: 00007FFDA4333254

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lockmemmove
String ID: End of stream already reached
API String ID: 4192957916-3466344095
Opcode ID: 3c50c53e7e3f202b4bc3bda35173afe72dfaf544829dd58b274516aa7783b60d
Instruction ID: ace55bd920cb9cdc6d749111fa376e2944c534e794e369ec728203f630da8fda
Opcode Fuzzy Hash: 3c50c53e7e3f202b4bc3bda35173afe72dfaf544829dd58b274516aa7783b60d
Instruction Fuzzy Hash: CE113021B49E4185E644EB22E9B41696764FB8AFC0F049031DE1E83776CF3CF465C308

Function 00007FFDA3718DA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA3718DC6
PyThread_release_lock.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA3718DF8
PyErr_SetString.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA3718E28

Part of subcall function 00007FFDA37182F8: PyType_GetModuleState.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA3718333
Part of subcall function 00007FFDA37182F8: PyBytes_FromStringAndSize.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA3718347
Part of subcall function 00007FFDA37182F8: PyList_New.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA371835D
Part of subcall function 00007FFDA37182F8: PyEval_SaveThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA37183AB
Part of subcall function 00007FFDA37182F8: PyEval_RestoreThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA37183C5

PyEval_SaveThread.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA3724960
PyThread_acquire_lock.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA3724975
PyEval_RestoreThread.PYTHON310(?,?,?,00007FFDA37182CA), ref: 00007FFDA372497E

Strings

Compressor has been flushed, xrefs: 00007FFDA3718E1E

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: 908f4d78f1c210165b65e6298114a3072e7d9a4b13bcca953b5102c2715e1cfd
Instruction ID: 9a2b007843ef0ba598e2dbbcf3a7b07cb00ea84339163fac737394527bb11e14
Opcode Fuzzy Hash: 908f4d78f1c210165b65e6298114a3072e7d9a4b13bcca953b5102c2715e1cfd
Instruction Fuzzy Hash: 24113D62B09A8281EB54CB62E9642697366FB88FC0F045031DE4D63B66CF3DE455C306

Function 00007FFDA4332650 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON310(?,?,?,00007FFDA4332622), ref: 00007FFDA4332673
PyThread_release_lock.PYTHON310(?,?,?,00007FFDA4332622), ref: 00007FFDA433269F
PyEval_SaveThread.PYTHON310(?,?,?,00007FFDA4332622), ref: 00007FFDA43326BE
PyThread_acquire_lock.PYTHON310(?,?,?,00007FFDA4332622), ref: 00007FFDA43326D0
PyEval_RestoreThread.PYTHON310(?,?,?,00007FFDA4332622), ref: 00007FFDA43326D9

Strings

Compressor has been flushed, xrefs: 00007FFDA433B1FF

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lock
String ID: Compressor has been flushed
API String ID: 1906554297-3904734015
Opcode ID: 46fac63bd8713d1d6eb80c2962834a581c8536a49f179b480be59176f658586a
Instruction ID: 2d71db224043f941cdd437ced7c922f7fd664ff14548239afc1408cb4a89bab3
Opcode Fuzzy Hash: 46fac63bd8713d1d6eb80c2962834a581c8536a49f179b480be59176f658586a
Instruction Fuzzy Hash: F211F521B49E5282EA50EB12E9B41696364FB8AFC0F049432DE2E47B76CF7CF461C344

Function 00007FFDA37227D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON310 ref: 00007FFDA37227FD
PyThread_release_lock.PYTHON310 ref: 00007FFDA372283A
PyErr_SetString.PYTHON310 ref: 00007FFDA3722864

Part of subcall function 00007FFDA37182F8: PyType_GetModuleState.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA3718333
Part of subcall function 00007FFDA37182F8: PyBytes_FromStringAndSize.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA3718347
Part of subcall function 00007FFDA37182F8: PyList_New.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA371835D
Part of subcall function 00007FFDA37182F8: PyEval_SaveThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA37183AB
Part of subcall function 00007FFDA37182F8: PyEval_RestoreThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA37183C5

PyEval_SaveThread.PYTHON310 ref: 00007FFDA3725B44
PyThread_acquire_lock.PYTHON310 ref: 00007FFDA3725B59
PyEval_RestoreThread.PYTHON310 ref: 00007FFDA3725B62

Strings

Repeated call to flush(), xrefs: 00007FFDA372285A

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Repeated call to flush()
API String ID: 3871537485-194442007
Opcode ID: 3f5d1a7487796d4589feb1ea039caf1d561c95a765cc4565cb986a041285c514
Instruction ID: d22fec218d8a31abef9aba4ba32cb4ae8aa8a058060e67b4710007b325d9373f
Opcode Fuzzy Hash: 3f5d1a7487796d4589feb1ea039caf1d561c95a765cc4565cb986a041285c514
Instruction Fuzzy Hash: AA114F61B09A8282E7548BA6E9643797262FF88B80F048030DA0E27766CF3EE455C306

Function 00007FFDA4332010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON310 ref: 00007FFDA433202A
PyThread_release_lock.PYTHON310 ref: 00007FFDA4332062
PyEval_SaveThread.PYTHON310 ref: 00007FFDA433B030
PyThread_acquire_lock.PYTHON310 ref: 00007FFDA433B042
PyEval_RestoreThread.PYTHON310 ref: 00007FFDA433B04B
PyErr_SetString.PYTHON310 ref: 00007FFDA433B068

Part of subcall function 00007FFDA4332BC8: PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFDA4332C06
Part of subcall function 00007FFDA4332BC8: PyList_New.PYTHON310 ref: 00007FFDA4332C1D
Part of subcall function 00007FFDA4332BC8: PyEval_SaveThread.PYTHON310 ref: 00007FFDA4332C89
Part of subcall function 00007FFDA4332BC8: PyEval_RestoreThread.PYTHON310 ref: 00007FFDA4332CA3

Strings

Repeated call to flush(), xrefs: 00007FFDA433B05E

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_SizeThread_release_lock
String ID: Repeated call to flush()
API String ID: 3236580226-194442007
Opcode ID: 3c8657066936499e4be75db283af80baae4d843b4404a709fbe5a4b3cc9b1105
Instruction ID: 818d9a22f87094f01ddd76d9c678d15d63dd1524c813dc16fbcadd8325811ecf
Opcode Fuzzy Hash: 3c8657066936499e4be75db283af80baae4d843b4404a709fbe5a4b3cc9b1105
Instruction Fuzzy Hash: AD111C31B49E5282FA50EB22E9B42792364FB8AB81F048031DA5E47B76CF3DF465C344

Function 00007FFDA54627CC Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5462886
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54628A5
__AdjustPointer.LIBCMT ref: 00007FFDA54628E6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54628F3
__AdjustPointer.LIBCMT ref: 00007FFDA546292F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5462944
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5462989
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5462990

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: ad7bbbe6b4c289a22ae1e43e79ef4439cf3ee9b14764b2eff01f06dd25f3f236
Instruction ID: 4830355658c9420a6f1d0d088897b833a777bdba034d734aae398bbba1503170
Opcode Fuzzy Hash: ad7bbbe6b4c289a22ae1e43e79ef4439cf3ee9b14764b2eff01f06dd25f3f236
Instruction Fuzzy Hash: 8B51B421F0FA4BA1FA659B119864338F794EF46FC0F498535EA4D06B87DFACE4458308

Function 00007FFDA54625E8 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54626A0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54626BE
__AdjustPointer.LIBCMT ref: 00007FFDA54626FF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA546270C
__AdjustPointer.LIBCMT ref: 00007FFDA5462748
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA546275D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54627A2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54627A9

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: d386002f74db6febb42ef9b4bac4e43e25a554ab645870d9c47f674d5a84533b
Instruction ID: d00f69e96dcd4ff88c2347275d2d7353ecfa4e30e7bff77a0aff6bd06e151ccf
Opcode Fuzzy Hash: d386002f74db6febb42ef9b4bac4e43e25a554ab645870d9c47f674d5a84533b
Instruction Fuzzy Hash: CF51B121B0FA4BA1EA659F119164B38A390FF56F81F054435EA4E07F97EFACE841C309

Function 00007FF7A0FF93C4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF9407
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF97F4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF9A90

Strings

p, xrefs: 00007FF7A0FF94B9
p, xrefs: 00007FF7A0FF9531
f, xrefs: 00007FF7A0FF9529

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
Instruction ID: 7f2ba4d71a3e605b990f9ebccbae81249e5ad05052547974ca69faa27e316fb4
Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
Instruction Fuzzy Hash: C6128F23E0E2438BFB64BE259054279B691EB80754FDA4835D68B667E4DB3CF580CB24

Function 00007FFDA5465520 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFDA54655E9
_local_unwind.LIBVCRUNTIME ref: 00007FFDA546568C

Strings

csm, xrefs: 00007FFDA54656D0
MOC, xrefs: 00007FFDA5465562
RCC, xrefs: 00007FFDA546556E
csm, xrefs: 00007FFDA5465584

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: FileHeader_local_unwind
String ID: MOC$RCC$csm$csm
API String ID: 2627209546-1441736206
Opcode ID: 385ada566cdd30ad99b7ac5e1d5c8025a7264eea7c22efa234297d7bd0e399d8
Instruction ID: 77d0fef991983955c4d082895f1eab87c1f19a0873cca3300b124f3e6471c824
Opcode Fuzzy Hash: 385ada566cdd30ad99b7ac5e1d5c8025a7264eea7c22efa234297d7bd0e399d8
Instruction Fuzzy Hash: 03519072B0A61A86EB609F2590203BD66A0FF96F94F941531DA4C43B8BDFBCE441CB45

Function 00007FFDA37182F8 Relevance: 10.6, APIs: 7, Instructions: 121threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA3718333
PyBytes_FromStringAndSize.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA3718347
PyList_New.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA371835D
PyEval_SaveThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA37183AB
PyEval_RestoreThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA37183C5
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA37247D7
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,00007FFDA3718DEE,?,?,?,00007FFDA37182CA), ref: 00007FFDA3724821

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: 77ec36d3afde461cf6a5189d8a5a3cb1abec550234130b40077411850f97c0dc
Instruction ID: eda47b08bb67e6c674a47f67f774af277196d13e3838bd45dbc8df3de72cf90a
Opcode Fuzzy Hash: 77ec36d3afde461cf6a5189d8a5a3cb1abec550234130b40077411850f97c0dc
Instruction Fuzzy Hash: BA419122F0AB9296EA249F55E56013973A5FF48B60F580235DE5D237E2EF3EE450C309

Function 00007FF7A0FE6FB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7A0FE7045
MultiByteToWideChar.KERNEL32 ref: 00007FF7A0FE7087

Strings

win32_utils_from_utf8, xrefs: 00007FF7A0FE70BD
Out of memory., xrefs: 00007FF7A0FE70B6
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7A0FE70AD
MultiByteToWideChar, xrefs: 00007FF7A0FE70CD
Failed to get wchar_t buffer size., xrefs: 00007FF7A0FE70C6

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 9c6e19a5a84aeb67727d60a37d4bc604be489eb4fd0075111d56c9fa607bfdf6
Instruction ID: 93cf522844e28c3f99538b463e2291c0075f913f8895167438c805dc14e63813
Opcode Fuzzy Hash: 9c6e19a5a84aeb67727d60a37d4bc604be489eb4fd0075111d56c9fa607bfdf6
Instruction Fuzzy Hash: 30415E32A0EB83C6E620EF25A84016AB6A5FB84790F964535EA4D57BB4DF3CE452C710

Function 00007FFDA4339B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310(00000000,?,?,00007FFDA4332CCC), ref: 00007FFDA4339BB4
PyBytes_FromStringAndSize.PYTHON310(00000000,?,?,00007FFDA4332CCC), ref: 00007FFDA4339BED
memmove.VCRUNTIME140(?,?,00007FFDA4332CCC), ref: 00007FFDA4339C2D
_Py_Dealloc.PYTHON310(?,?,00007FFDA4332CCC), ref: 00007FFDA4339C44

Strings

Unable to allocate output buffer., xrefs: 00007FFDA433C3AE

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemmove
String ID: Unable to allocate output buffer.
API String ID: 3327154725-2565006440
Opcode ID: cf69bc1c2dffb572901609e84d9544dd0b091b7afe16062cab03c015a5b89929
Instruction ID: bb50e6df7cfc4afc28b9043a86ddb6f9130e451af32e93882cd3b937609e930f
Opcode Fuzzy Hash: cf69bc1c2dffb572901609e84d9544dd0b091b7afe16062cab03c015a5b89929
Instruction Fuzzy Hash: 9D4115A2B4AE46C1EA55AF16D9B426D63A0FF4AF94F184432DE0E07776CF3CE4558308

Function 00007FFDA546D740 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDA546CE14), ref: 00007FFDA546D803
DName::DName.LIBVCRUNTIME ref: 00007FFDA546D822

Strings

`template-parameter, xrefs: 00007FFDA546D830
void, xrefs: 00007FFDA546D786

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 2821a58495c29764098872c6b010649cccddcb6c42941e500fb92a9452cac6b1
Instruction ID: f716fc6f0102d561fccd55210ae44d0391a27e65b163af6ce89cf0e0160f15ac
Opcode Fuzzy Hash: 2821a58495c29764098872c6b010649cccddcb6c42941e500fb92a9452cac6b1
Instruction Fuzzy Hash: 7B411B22F0AB5A88FB109BA5D8653BC2371BB0AB84F545136DE0D17B5ADFBCA505C344

Function 00007FF7A0FEC248 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC2CD
GetLastError.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC2DB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC305
FreeLibrary.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC34B
GetProcAddress.KERNEL32(?,?,?,00007FF7A0FEC4FA,?,?,?,00007FF7A0FEC1EC,?,?,00000001,00007FF7A0FEBE09), ref: 00007FF7A0FEC357

Strings

api-ms-, xrefs: 00007FF7A0FEC2ED

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
Instruction ID: 182f602713a5d4a495b2c887e662605aa1106808852997e7545fe454b59de3af
Opcode Fuzzy Hash: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
Instruction Fuzzy Hash: F331D221A0F603C5FE51EB22A400679B394FF08BA0F8A8935EE1D56364EF3CF0468764

Function 00007FF7A0FE55E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A0FE6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7A0FE592F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7A0FE563F

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7A0FE5653
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7A0FE5616
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7A0FE569A

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 2001182103-3498232454
Opcode ID: 9bebef7b456891e8881b47775a8e19f061b21e2c6f05d606d7cbdaea43ced74d
Instruction ID: 45303cd5b6fe38ab36463e0350fe55557fe3b0614eb00d994b8378dbb345b133
Opcode Fuzzy Hash: 9bebef7b456891e8881b47775a8e19f061b21e2c6f05d606d7cbdaea43ced74d
Instruction Fuzzy Hash: EE319551F1E787C0FA20F73599552BAE251AF987C0FC64835DA4E627B6EE6CF1048620

Function 00007FFDA5468624 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA54686DB

Strings

..., xrefs: 00007FFDA5468724
void, xrefs: 00007FFDA5468759
<ellipsis>, xrefs: 00007FFDA5468734
,<ellipsis>, xrefs: 00007FFDA54686B8
,..., xrefs: 00007FFDA54686A8

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 2943138195-2211150622
Opcode ID: 16d5b7056506ac1aa3be62c87a897449e0af35361c1a5b370ad614f7e7c3f2e7
Instruction ID: 4d68616a1f7b320d1911ca5c7517fec61e325731c0904321ba0f4373a0704732
Opcode Fuzzy Hash: 16d5b7056506ac1aa3be62c87a897449e0af35361c1a5b370ad614f7e7c3f2e7
Instruction Fuzzy Hash: 51414972F0AB4A98FB118B24D8603AC37E5BB0AB08F444131DA4D27B56DFBCA544C748

Function 00007FFDA546A31C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A40F

Strings

unsigned , xrefs: 00007FFDA546A3E3
int , xrefs: 00007FFDA546A38D
long , xrefs: 00007FFDA546A37E
short , xrefs: 00007FFDA546A39C
char , xrefs: 00007FFDA546A3A5

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 1a667bf595c3f0eddcec5e75b1b20bf055c895b242c78c01af1086ecda962d52
Instruction ID: 7d8c138f5fe01109428cc35fb1c39e1d9b603e7d3767adac1e76a1246a3a8d28
Opcode Fuzzy Hash: 1a667bf595c3f0eddcec5e75b1b20bf055c895b242c78c01af1086ecda962d52
Instruction Fuzzy Hash: 4D416F31F1AB5AC9F7118F65D8643BC37A1BB06B44F448036DA0C56F5ADFA89584D708

Function 00007FF7A0FE6DB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6DEA

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF7A0FE6E70

Strings

win32_utils_from_utf8, xrefs: 00007FF7A0FE6E39
Out of memory., xrefs: 00007FF7A0FE6E32
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7A0FE6E7A
MultiByteToWideChar, xrefs: 00007FF7A0FE6DFE, 00007FF7A0FE6E81
Failed to get wchar_t buffer size., xrefs: 00007FF7A0FE6DF7

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1717984340-876015163
Opcode ID: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
Instruction ID: 9e23e5d207b52d7c345b156b0d306be23436765d22af0750b3233c9b118a1b45
Opcode Fuzzy Hash: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
Instruction Fuzzy Hash: 65218525B0DA4281EB20EB29F90016AF761FB847C4F994531DB4C93BB9EE6CE5618B10

Function 00007FF7A0FFA780 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA78F
FlsGetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA7A4
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA7C5
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA7F2
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA803
FlsSetValue.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA814
SetLastError.KERNEL32(?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F,?,?,?,00007FF7A0FF9473), ref: 00007FF7A0FFA82F

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c556bcea9941d530c195de90c7ce9b2392d0a01d085d118c12b8cb389224617b
Instruction ID: 1fb7bb6ca5008547a7bedc54972005c1b6681a96b200ffce9a3c6eca03b0ed47
Opcode Fuzzy Hash: c556bcea9941d530c195de90c7ce9b2392d0a01d085d118c12b8cb389224617b
Instruction Fuzzy Hash: 4B21CF22E0F2034AFA587334555513AE1524F447E0F864F32E83E27BFAEEACB4018221

Function 00007FF7A10070EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7A100711D
GetLastError.KERNEL32 ref: 00007FF7A1007129
CloseHandle.KERNEL32 ref: 00007FF7A1007141
CreateFileW.KERNEL32 ref: 00007FF7A100716C
WriteConsoleW.KERNEL32 ref: 00007FF7A100718B

Strings

CONOUT$, xrefs: 00007FF7A100714D

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
Instruction ID: 9b49fa47425af62f293bdc3b6b76db92b8217f5e1286a45095ecf0cf76b4e36c
Opcode Fuzzy Hash: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
Instruction Fuzzy Hash: A711D621719A41C6F3509B46E85436AB7A0FB48BE4F860234EA5E437A0DFBCD4248B10

Function 00007FFDA3721270 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON310 ref: 00007FFDA37212AC
PyMem_Calloc.PYTHON310 ref: 00007FFDA37212BE
PyErr_SetString.PYTHON310 ref: 00007FFDA37212EF
PyErr_NoMemory.PYTHON310 ref: 00007FFDA37212F9

Strings

|OO&, xrefs: 00007FFDA372129D
Invalid filter specifier for delta filter, xrefs: 00007FFDA37212E5

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for delta filter$|OO&
API String ID: 3027669873-2010576982
Opcode ID: 3b6532d8c8eca6c5558573913ce52dd522c3df3348e85705e64ed9383f616bda
Instruction ID: 8a9df18cb2c95c75ec7b3598e2ba0961e19ebd688604b794f41798f8540fb19b
Opcode Fuzzy Hash: 3b6532d8c8eca6c5558573913ce52dd522c3df3348e85705e64ed9383f616bda
Instruction Fuzzy Hash: 7F1109B2B0AB8696EB008F91D46456833A5FF48B44F504035EA0D63362DF7EE54AC755

Function 00007FFDA37211E4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON310 ref: 00007FFDA372121D
PyMem_Calloc.PYTHON310 ref: 00007FFDA372122F
PyErr_SetString.PYTHON310 ref: 00007FFDA372125C
PyErr_NoMemory.PYTHON310 ref: 00007FFDA3721266

Strings

|OO&, xrefs: 00007FFDA3721203
Invalid filter specifier for BCJ filter, xrefs: 00007FFDA3721252

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for BCJ filter$|OO&
API String ID: 3027669873-3728029529
Opcode ID: 8ee6499aee703b95cac1899c2c019a8016f4ba75a238a443bd35c12d8ac2c3ad
Instruction ID: cad623d92edd4ca0b563e415e06e69d5db65742228fcdf6771a5c3c1e7cb5b45
Opcode Fuzzy Hash: 8ee6499aee703b95cac1899c2c019a8016f4ba75a238a443bd35c12d8ac2c3ad
Instruction Fuzzy Hash: D3012D71B0AB8285EB00CB91D4A556833E5FF48B50F500035D50D53362EF3EE549C35A

Function 00007FFDA433C5A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA433C5B5

Part of subcall function 00007FFDA433C564: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FFDA433AF32), ref: 00007FFDA433C59A

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA433C5E1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA433C5FB

Strings

1.0.8, 13-Jul-2019, xrefs: 00007FFDA433C5BB
*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FFDA433C5EA
bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FFDA433C5C8

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfexit
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 77255540-989448446
Opcode ID: 6a2537f25ee9636368bde20c122c36733cd78ca2c6a2d4bb0c725c45ad603cf3
Instruction ID: 5d775ed75fb660020fbbb5aec354b75687228a62abf0d341ca65fecc37744f36
Opcode Fuzzy Hash: 6a2537f25ee9636368bde20c122c36733cd78ca2c6a2d4bb0c725c45ad603cf3
Instruction Fuzzy Hash: CDE03920B8AE0792FA18B765E8F62781315AF06B00F001139D50E063B3DD6CB9058649

Function 00007FFDA4332BC8 Relevance: 9.1, APIs: 6, Instructions: 119threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON310 ref: 00007FFDA4332C06
PyList_New.PYTHON310 ref: 00007FFDA4332C1D
PyEval_SaveThread.PYTHON310 ref: 00007FFDA4332C89
PyEval_RestoreThread.PYTHON310 ref: 00007FFDA4332CA3
_Py_Dealloc.PYTHON310 ref: 00007FFDA433B38F
_Py_Dealloc.PYTHON310 ref: 00007FFDA433B3CF

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: a386d8508675393f46c085708349f52ead3a018678164d5ea025a12175505883
Instruction ID: 4d909d061f06ac0b71db29c7a3b65f98106da210dc674180b0888d27582478ed
Opcode Fuzzy Hash: a386d8508675393f46c085708349f52ead3a018678164d5ea025a12175505883
Instruction Fuzzy Hash: C7416522B4AF1296EA64AB1195B427D32A0FB56B60F144235DE6D437F2EF3CF851C344

Function 00007FFDA54662D0 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFDA5466326
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5466369
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5466393
InterlockedPushEntrySList.KERNEL32 ref: 00007FFDA54663B0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA54663BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA54663C5

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 6447550c70440ae48e9dc09acfbe7fa3055870e3a5d625089a78ddc05dba8847
Instruction ID: 4ae11e084cb8f134e307bdd11bdbe3a0669a9132458d205b029954f45a8d61d3
Opcode Fuzzy Hash: 6447550c70440ae48e9dc09acfbe7fa3055870e3a5d625089a78ddc05dba8847
Instruction Fuzzy Hash: 1531E421B1A79A80FB118B26A8243692394FF0AFD4F545535DE2D03B82EF7DD482C344

Function 00007FF7A0FFA8F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA907
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA93D
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA96A
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA97B
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA98C
SetLastError.KERNEL32(?,?,?,00007FF7A0FF6091,?,?,?,?,00007FF7A0FFDF1F,?,?,00000000,00007FF7A0FFAA16,?,?,?), ref: 00007FF7A0FFA9A7

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 145da5da8bf5c56ab714606efba7c2bb83000df48059acb1bf9ac444d479a10e
Instruction ID: 094714f0d5656302f15b55ba7ca6b3e46e64998b9a29ae4773c1d0867c864eff
Opcode Fuzzy Hash: 145da5da8bf5c56ab714606efba7c2bb83000df48059acb1bf9ac444d479a10e
Instruction Fuzzy Hash: 9E118E62E0F2034AF6647735595113AE2564F457B0F874B36E82E277FAEEACB4404621

Function 00007FFDA54638A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

EncodePointer.KERNEL32 ref: 00007FFDA5463918
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDA5463963
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5463B91

Strings

RCC, xrefs: 00007FFDA5463934
MOC, xrefs: 00007FFDA546392C

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 63425386b35f735f5eb303e83bfbe55818570f32e5447e3767ff35a3eaf3afb3
Instruction ID: 4c309e500cff45af195e0af2a0521dd6f2020f417c03476ab13f8d0504b07516
Opcode Fuzzy Hash: 63425386b35f735f5eb303e83bfbe55818570f32e5447e3767ff35a3eaf3afb3
Instruction Fuzzy Hash: A4919D73B097898AE710CB64E4A03AD7BB0F746B88F14412AEA8D17B56DF78D195CB04

Function 00007FFDA546BB70 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546BC50

Part of subcall function 00007FFDA5468C24: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546913D
Part of subcall function 00007FFDA5468C24: DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469175

Strings

std::nullptr_t, xrefs: 00007FFDA546BDF1
std::nullptr_t , xrefs: 00007FFDA546BDC5
volatile, xrefs: 00007FFDA546BBE2, 00007FFDA546BD30
volatile , xrefs: 00007FFDA546BBD3, 00007FFDA546BD21

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 8ec89114dc1e92fb087ff84a90b975bd849231731579a14e6ae3ff20f009c8f1
Instruction ID: 8fad0093604de50e7149f7ba8d6b92d1d4a32e70e299312b1f4639455fe31b67
Opcode Fuzzy Hash: 8ec89114dc1e92fb087ff84a90b975bd849231731579a14e6ae3ff20f009c8f1
Instruction Fuzzy Hash: DD715D72B0AB4A84FB148B14D9703BC66A5FB06F84F448539DA4D06F5ADFBCE660C308

Function 00007FFDA5463690 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

EncodePointer.KERNEL32 ref: 00007FFDA54636DC
_CallSETranslator.LIBVCRUNTIME ref: 00007FFDA546372B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA546389F

Strings

MOC, xrefs: 00007FFDA54636F0
RCC, xrefs: 00007FFDA54636F9

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: bda6881e4fb6ddd96fb50e60b72b5d1eaa618bcc944dda4a5bc0b193bb5b3b27
Instruction ID: 9dfc28f5fe0bdafe5fd1dce7ba06102051c2b1f39a47178dbc74cb8c01a6dccd
Opcode Fuzzy Hash: bda6881e4fb6ddd96fb50e60b72b5d1eaa618bcc944dda4a5bc0b193bb5b3b27
Instruction Fuzzy Hash: E9615632A0ABC98AE724CF65E4903AD77A0FB45B88F044125EE4D13B5ADFB8E055C704

Function 00007FF7A0FEBC08 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A0FEBC33
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7A0FEBCC8
RtlUnwindEx.KERNEL32 ref: 00007FF7A0FEBD17

Strings

csm, xrefs: 00007FF7A0FEBCAE
f, xrefs: 00007FF7A0FEBC46

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
Instruction ID: 1f3cd410928f786d26bebffb71ace2f72bc76f173cbc22f800c298f38bed488b
Opcode Fuzzy Hash: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
Instruction Fuzzy Hash: 9C51C731A0E607C6E724EF25E844A6AB795FF44B88F928930EA4E57758DF78F841C710

Function 00007FFDA43334A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FFDA433B657
{0x%08x, 0x%08x}, xrefs: 00007FFDA433B60B

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: f9bcd42f88dafb48bf0e7ec589db99e1495061aad5c106f95f65d43a960e05ec
Instruction ID: e662946aa9a6b5412fff3a757fb89095a3afcdcb82da71fb7a9784f4ab890942
Opcode Fuzzy Hash: f9bcd42f88dafb48bf0e7ec589db99e1495061aad5c106f95f65d43a960e05ec
Instruction Fuzzy Hash: 13412271F8F94286FB64AB2490F06B82250EB46B59F14A575D90D8A3B7CE2CF841CB18

Function 00007FFDA371FDB4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON310(00000000,00007FFD9461A7F8,00000000,00007FFDA371FD64), ref: 00007FFDA371FDDC
PySequence_GetItem.PYTHON310 ref: 00007FFDA371FE0F

Part of subcall function 00007FFDA371FE98: PyMapping_Check.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FEBD
Part of subcall function 00007FFDA371FE98: PyMapping_GetItemString.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FED7
Part of subcall function 00007FFDA371FE98: PyLong_AsUnsignedLongLong.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FEEC
Part of subcall function 00007FFDA371FE98: PyErr_Occurred.PYTHON310(?,?,?,?,?,?,?,00007FFDA371FE2B), ref: 00007FFDA371FEFF

PyErr_Format.PYTHON310 ref: 00007FFDA3725559

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FFDA3725549

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 1062705235-2617632755
Opcode ID: 180aafa64eef190ae398429d03fcde4e8d851a5f17c8bf0ba6375e5ed32e26b8
Instruction ID: ab7003be3294992658691d107420b3e3989539403a6c82a652607158ebf8f93a
Opcode Fuzzy Hash: 180aafa64eef190ae398429d03fcde4e8d851a5f17c8bf0ba6375e5ed32e26b8
Instruction Fuzzy Hash: C921D862B0A68244EA348B66A9206357293BF45BF4F140736ED7D167F7DE3EE0458308

Function 00007FFDA371F8C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 00007FFDA371F91E
PyErr_Format.PYTHON310 ref: 00007FFDA3725454

Strings

Invalid compression preset: %u, xrefs: 00007FFDA372544A
Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter, xrefs: 00007FFDA37254A7

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
API String ID: 4038069558-4068623215
Opcode ID: 800a2692c08bbe74a53c7637ee648bc951287ec46409512593c3603fdce5b0c0
Instruction ID: ea13d8f7c6967a60cf0a2899bafb4639f9f718126e2d555613d31e325e46771a
Opcode Fuzzy Hash: 800a2692c08bbe74a53c7637ee648bc951287ec46409512593c3603fdce5b0c0
Instruction Fuzzy Hash: D221B462B0E64351FA20AB61E4713797362BF897A4F400332D9AD677E7DE3EE4448706

Function 00007FFDA433208C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_PyLong_AsInt.PYTHON310 ref: 00007FFDA43320CE
_PyArg_NoKeywords.PYTHON310 ref: 00007FFDA433B08C
_PyArg_CheckPositional.PYTHON310 ref: 00007FFDA433B0AF
PyErr_Occurred.PYTHON310 ref: 00007FFDA433B0C2

Strings

BZ2Compressor, xrefs: 00007FFDA433B085, 00007FFDA433B0A5

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Arg_$CheckErr_KeywordsLong_OccurredPositional
String ID: BZ2Compressor
API String ID: 1699739194-1096114097
Opcode ID: 67fd4b8e8732b1811009f4b2cc01d2aec78b2a6e88a0da5a693f693a6c9302c3
Instruction ID: 4bf820eb6d052aed0e46dd285b312115011b916437b41d2d1451f63248c34089
Opcode Fuzzy Hash: 67fd4b8e8732b1811009f4b2cc01d2aec78b2a6e88a0da5a693f693a6c9302c3
Instruction Fuzzy Hash: 7E118931B4AE4186F660AB21E8F01796260EF5AB80F548131DA6D977B7CF6CF485C748

Function 00007FFDA43322B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON310(?,?,?,00007FFDA43320E8), ref: 00007FFDA43322D3

Part of subcall function 00007FFDA4332104: memset.VCRUNTIME140 ref: 00007FFDA4332259

PyThread_free_lock.PYTHON310 ref: 00007FFDA433B152
PyErr_SetString.PYTHON310(?,?,?,00007FFDA43320E8), ref: 00007FFDA433B170

Strings

compresslevel must be between 1 and 9, xrefs: 00007FFDA433B166
Unable to allocate lock, xrefs: 00007FFDA433B145

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Err_StringThread_allocate_lockThread_free_lockmemset
String ID: Unable to allocate lock$compresslevel must be between 1 and 9
API String ID: 681419693-2500606449
Opcode ID: a693a40a49b642f4ff368e6609d757780e97a1413e74ececf6d81a2503aacd95
Instruction ID: cc978203ca578d48f1460ae9d723599a359084f576a5f152c731622aa2a1693c
Opcode Fuzzy Hash: a693a40a49b642f4ff368e6609d757780e97a1413e74ececf6d81a2503aacd95
Instruction Fuzzy Hash: 7A111921B5AE0682EB50EB25E8F127823A4EF46B55F104131C92D463B6EE3CF854C348

Function 00007FF7A0FF8A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7A0FF8A65
GetProcAddress.KERNEL32 ref: 00007FF7A0FF8A7B
FreeLibrary.KERNEL32 ref: 00007FF7A0FF8AA2

Strings

CorExitProcess, xrefs: 00007FF7A0FF8A74
mscoree.dll, xrefs: 00007FF7A0FF8A5C

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
Instruction ID: 2c7d178b77e54cd06e99e70d2dd5575f63cd51a1c6cfebc2a750a76fbfedb4c4
Opcode Fuzzy Hash: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
Instruction Fuzzy Hash: 64F0A42160E70781FB14AB24E44433AA360EF45760F994635DA6D452F0DF7CD059C720

Function 00007FFDA5469FA4 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDA546A01D
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A03F
DName::DName.LIBVCRUNTIME ref: 00007FFDA546A052
DName::DName.LIBVCRUNTIME ref: 00007FFDA546A089
DName::DName.LIBVCRUNTIME ref: 00007FFDA546A094

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: 7682a6ebcb32bf14f43659220100a1b4a5a4a6e3db385e7ce84af32120df353b
Instruction ID: 3c1ff8fd3a3e85c373ae7ef59dfb04ce6fe8d90514e5e204c426c3cf4b455f2c
Opcode Fuzzy Hash: 7682a6ebcb32bf14f43659220100a1b4a5a4a6e3db385e7ce84af32120df353b
Instruction Fuzzy Hash: 2C416D22B0AB5AD4EB10CF21D8A03BC33A5FB16F84B544032DA4D13B96DFB8E855D304

Function 00007FF7A1008824 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7A100884C
_set_statfp.LIBCMT ref: 00007FF7A1008867
_set_statfp.LIBCMT ref: 00007FF7A1008883
_set_statfp.LIBCMT ref: 00007FF7A10088BF

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: a61ab7e3ddfef7993947f84cd1a861545593166b489affc3b43af5734c096617
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 63115122D19A2201F7583124F445377B3417F54364FDA063BE66E46EF7CFAC96604B21

Function 00007FF7A0FFA9C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFA9DF
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFA9FE
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFAA26
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFAA37
FlsSetValue.KERNEL32(?,?,?,00007FF7A0FF9BD3,?,?,00000000,00007FF7A0FF9E6E,?,?,?,?,?,00007FF7A0FF1A40), ref: 00007FF7A0FFAA48

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: fe685267061b1d7826c58759cf3d75ed099b9be309ea2abb6383fb5ceaf5ba53
Instruction ID: 0d34eb0bfa98a57a037437e75d6176c8d433dab1f813a0902e9e3eb3b3174e35
Opcode Fuzzy Hash: fe685267061b1d7826c58759cf3d75ed099b9be309ea2abb6383fb5ceaf5ba53
Instruction Fuzzy Hash: 6511D252F0F60349FA587335995113AE1425F407A0F8A5B32D83E277FAEE6CF5018621

Function 00007FF7A0FFA854 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA865
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA884
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA8AC
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA8BD
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7A10024B3,?,?,?,00007FF7A0FFCCEC,?,?,00000000,00007FF7A0FF386F), ref: 00007FF7A0FFA8CE

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 46640cf929105097b223292b0b206d62ba136b58cd2f6612e783bcd6201db716
Instruction ID: 5efd20efc5296850051bb42871049d5ee472620afb2a9e060b331497b723cc90
Opcode Fuzzy Hash: 46640cf929105097b223292b0b206d62ba136b58cd2f6612e783bcd6201db716
Instruction Fuzzy Hash: 18112152E0F20349FA587375485117AD1564F453B0EDA4F36D83E2A3F6EDACB4418631

Function 00007FFDA3722A08 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON310 ref: 00007FFDA3722A16
_Py_Dealloc.PYTHON310 ref: 00007FFDA3722A75
_Py_Dealloc.PYTHON310 ref: 00007FFDA3722A7D
_Py_Dealloc.PYTHON310 ref: 00007FFDA3722A85
_Py_Dealloc.PYTHON310 ref: 00007FFDA3722A8D

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Dealloc$Module_State
String ID:
API String ID: 3434497292-0
Opcode ID: f3bfcea3e453a5ea2a4bedb996dfd2241de23e7ca5c8241c69bc10db946cfef8
Instruction ID: e71a0c332aa3678f0bc8d42a73acef3e9d028d702f7700c1215b61e589fd1d79
Opcode Fuzzy Hash: f3bfcea3e453a5ea2a4bedb996dfd2241de23e7ca5c8241c69bc10db946cfef8
Instruction Fuzzy Hash: 7C11EF62F0B90281FBA94FE0A8B533832B2AF54B54F194534CD0925B928F3EDD50835A

Function 00007FFDA4339E4C Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON310 ref: 00007FFDA4339E59
PyType_FromModuleAndSpec.PYTHON310 ref: 00007FFDA4339E6F
PyModule_AddType.PYTHON310 ref: 00007FFDA4339E83
PyType_FromModuleAndSpec.PYTHON310 ref: 00007FFDA4339E9A
PyModule_AddType.PYTHON310 ref: 00007FFDA4339EAF

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: 0617aa927543b83cbdbc6fee1a2ef70630efa3accd1fa306cc6db689a60f29f1
Instruction ID: 8e064bc4c72866c7a39c1ad68b8747fecb6c2306bd27db4e9f651a87ec19ac32
Opcode Fuzzy Hash: 0617aa927543b83cbdbc6fee1a2ef70630efa3accd1fa306cc6db689a60f29f1
Instruction Fuzzy Hash: 75011221B9BF03C2EA547B26B8B42366390AF0ABD0F445434C95E467B6EE3CF4548704

Function 00007FF7A0FFF218 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFF4F7

Part of subcall function 00007FF7A10054F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1005511

Strings

UTF-16LEUNICODE, xrefs: 00007FF7A0FFF495
ccs, xrefs: 00007FF7A0FFF432
UTF-8, xrefs: 00007FF7A0FFF476

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
Instruction ID: 293fc3dd89f73f03c9ec8142df3124491b173244bcd4a63a3f3c3c3e82a65f0c
Opcode Fuzzy Hash: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
Instruction Fuzzy Hash: 76817033E0E2038DF764AE35C15027DA6A0AF11B44FD74835DA0AA73B5DB2DB9299721

Function 00007FFDA4332328 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA433B183

Part of subcall function 00007FFDA4331C74: PyEval_SaveThread.PYTHON310 ref: 00007FFDA433B030
Part of subcall function 00007FFDA4331C74: PyThread_acquire_lock.PYTHON310 ref: 00007FFDA433B042
Part of subcall function 00007FFDA4331C74: PyEval_RestoreThread.PYTHON310 ref: 00007FFDA433B04B

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA433B1B1

Strings

block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FFDA433B18D
final combined CRC = 0x%08x , xrefs: 00007FFDA433B1BE

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Eval_Thread__acrt_iob_func$RestoreSaveThread_acquire_lock
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 2684710491-3357347091
Opcode ID: 382503e6d07fa29af9c2001fa126e6585d8c0395ce74b08492959c5d070d1b08
Instruction ID: fafd88031a294fb49fd7f801eeed6dab77d5d5e6720abacfce8cf8b3215958cc
Opcode Fuzzy Hash: 382503e6d07fa29af9c2001fa126e6585d8c0395ce74b08492959c5d070d1b08
Instruction Fuzzy Hash: 9E619636B9AA1246E650BF1A94B52B92354EB87F84F189035DD0A0B7B7CF7DF4028B44

Function 00007FFDA5464044 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA54641C3

Strings

, xrefs: 00007FFDA5464114
csm, xrefs: 00007FFDA5464093
csm, xrefs: 00007FFDA54641FD

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: a1e41bd14f4dc8a012b9b6851bae8dba3a2639313cd67671a1d4b299b7556132
Instruction ID: 6adaeda8dae94794378be19690a9132af29e4418ae622acc7f0fdce51fe10912
Opcode Fuzzy Hash: a1e41bd14f4dc8a012b9b6851bae8dba3a2639313cd67671a1d4b299b7556132
Instruction Fuzzy Hash: 0371B172A0A69986DB648F2194A47B97BA0FB06FC8F148135DF8C07F8ADB6CD491C744

Function 00007FF7A0FED468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7A0FED4B4
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7A0FED503

Strings

RCC, xrefs: 00007FF7A0FED4D1
MOC, xrefs: 00007FF7A0FED4C8

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
Instruction ID: 21259876b261b5e62deee886bb36e270fc330fb23cf49f49b6149484f0152c21
Opcode Fuzzy Hash: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
Instruction Fuzzy Hash: 7A615933A0AB46CAE720AF65D4403ADB7A0FB44B88F454625EF5D27BA8CB38E155C710

Function 00007FF7A0FED7C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A0FED7EC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7A0FED8D4

Strings

csm, xrefs: 00007FF7A0FED926
csm, xrefs: 00007FF7A0FED80E

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
Instruction ID: 0c1da04b581f2884887fd6ce59cb5216208997f7dddff8a2da3e7d0503674e2d
Opcode Fuzzy Hash: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
Instruction Fuzzy Hash: C7518C3290E283C6EB64AB21984036CB7A0BB45F94F954536DA9C67FA6CF3CF4518710

Function 00007FFDA5463E1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5463F13
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFDA5463F23

Strings

csm, xrefs: 00007FFDA5463F75
csm, xrefs: 00007FFDA5463E66

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 723d316c6bb1492db26d318ced58129fbbb71e04f86aecbd325fb3d3c805e488
Instruction ID: 305bccc6911828c4665e0cd56485b070420f8f68347ae164a7ddd7ab7035b7e7
Opcode Fuzzy Hash: 723d316c6bb1492db26d318ced58129fbbb71e04f86aecbd325fb3d3c805e488
Instruction Fuzzy Hash: 3D518E32A096CA86EB648F11A46436976A0FB52F94F144136DB8D47FD6CFBCE850C708

Function 00007FFDA3722BC4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON310(?,?,?,00007FFDA3722BA2,?,?,?,?,00000000,00007FFDA3722B2D), ref: 00007FFDA3722BD1

Part of subcall function 00007FFDA3722CE8: PyLong_FromUnsignedLongLong.PYTHON310(?,?,?,00007FFDA3722BF5,?,?,?,00007FFDA3722BA2,?,?,?,?,00000000,00007FFDA3722B2D), ref: 00007FFDA3722D00
Part of subcall function 00007FFDA3722CE8: _PyDict_SetItemId.PYTHON310(?,?,?,00007FFDA3722BF5,?,?,?,00007FFDA3722BA2,?,?,?,?,00000000,00007FFDA3722B2D), ref: 00007FFDA3722D17

PyErr_Format.PYTHON310(?,?,?,00007FFDA3722BA2,?,?,?,?,00000000,00007FFDA3722B2D), ref: 00007FFDA3725BC8
_Py_Dealloc.PYTHON310(?,?,?,00007FFDA3722BA2,?,?,?,?,00000000,00007FFDA3722B2D), ref: 00007FFDA3725BDB

Strings

Invalid filter ID: %llu, xrefs: 00007FFDA3725BBB

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Dict_Long$DeallocErr_FormatFromItemLong_Unsigned
String ID: Invalid filter ID: %llu
API String ID: 4092983888-255534617
Opcode ID: 8f5b9eac6430042713238dc8d6d55762490297ac884d9980a6975d972c2af954
Instruction ID: 492cbc6be4dc33c98041d198b12c18f175b06a1d6b38f8d449f58592f5f402a4
Opcode Fuzzy Hash: 8f5b9eac6430042713238dc8d6d55762490297ac884d9980a6975d972c2af954
Instruction Fuzzy Hash: 8C418331B0AB4390EB684B55E96007833A2FB05794F145132E61D173A2DF7EE8A4C70A

Function 00007FFDA546A714 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDA546A778

Strings

%lf, xrefs: 00007FFDA546A7BE

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: f37b8968dc856f8c22d72c120ca4476383f363961e161f929d9d255907aecf6d
Instruction ID: d54e88be661be834cefa9f004cebc992f801032c308d9ec8a363ddf8097271c3
Opcode Fuzzy Hash: f37b8968dc856f8c22d72c120ca4476383f363961e161f929d9d255907aecf6d
Instruction Fuzzy Hash: B4318122B0DB8A85EA60CB25A86037A7761FB86F84F448131E99E47B47CF7CD502D744

Function 00007FF7A0FE2CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7A0FE27C9,?,?,?,?,?,?), ref: 00007FF7A0FE2D01

Part of subcall function 00007FF7A0FE1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF7A0FE6904,?,?,?,?,?,?,?,?,?,?,?,00007FF7A0FE1023), ref: 00007FF7A0FE1CD7

Strings

Failed to get executable path., xrefs: 00007FF7A0FE2D0B
Failed to convert executable path to UTF-8., xrefs: 00007FF7A0FE2D3A
GetModuleFileNameW, xrefs: 00007FF7A0FE2D12

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2776309574-1977442011
Opcode ID: fa74f7d49a5bba7cfca93e60cd70646f34d32484488c9266ff3ae070a385e0ea
Instruction ID: f25f036429538a7bf5fb28d3135c03aa4ddd6e000e72864fb92455bdbdaa40af
Opcode Fuzzy Hash: fa74f7d49a5bba7cfca93e60cd70646f34d32484488c9266ff3ae070a385e0ea
Instruction Fuzzy Hash: 64015E21B1E647C1FB61B734E8153BAA251AF583C0FC30836E94D963B6EE5CF2148B20

Function 00007FFDA5462400 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA546243E

Strings

RCC, xrefs: 00007FFDA5462410
MOC, xrefs: 00007FFDA5462418
csm, xrefs: 00007FFDA5462420

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: b838753ef247b2fc749e3877e0128dea9035de62b0ba29f15289213c97603889
Instruction ID: 5e75284bebd910e0307b3787716a94ffa1fbe9f1e2611a38833b406b4f71fea2
Opcode Fuzzy Hash: b838753ef247b2fc749e3877e0128dea9035de62b0ba29f15289213c97603889
Instruction Fuzzy Hash: 9BF0AF36A1964B81EB505F20E191368B260FB49F45F085031E74807B53CFBCD8A0CB86

Function 00007FFDA37211A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON310(?,?,00000006,00007FFDA3720034), ref: 00007FFDA37211AD
PyErr_Occurred.PYTHON310(?,?,00000006,00007FFDA3720034), ref: 00007FFDA37211B6
PyErr_SetString.PYTHON310(?,?,00000006,00007FFDA3720034), ref: 00007FFDA37258B1

Strings

Value too large for uint32_t type, xrefs: 00007FFDA37258A7

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: 28cdf5b0aaa2f50018d7e2c7f48cd2403fc73865e104ec8bb289c5ea8e4b5ac1
Instruction ID: 20e65c980ebb0702e8ea40e9646c610801d32bca331854db00cd84dea7fbb5e0
Opcode Fuzzy Hash: 28cdf5b0aaa2f50018d7e2c7f48cd2403fc73865e104ec8bb289c5ea8e4b5ac1
Instruction Fuzzy Hash: 6FF08260F1E64785EB104F95F5A013533A2BF48B84F144035D90D56317DE3EE4448709

Function 00007FFDA3725E20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON310 ref: 00007FFDA3725E2D
PyErr_Occurred.PYTHON310 ref: 00007FFDA3725E36
PyErr_SetString.PYTHON310 ref: 00007FFDA3725E5E

Strings

Value too large for lzma_mode type, xrefs: 00007FFDA3725E54

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_mode type
API String ID: 944333170-1290617251
Opcode ID: feb8025e7a8c01c5d375fe5440bff4cb814459c5d461fd31a455ea58b87a6bfc
Instruction ID: 26f2c8202bf352ee2582d89e0bd362e77c2f62ba88cc87740e85b13e8580fef6
Opcode Fuzzy Hash: feb8025e7a8c01c5d375fe5440bff4cb814459c5d461fd31a455ea58b87a6bfc
Instruction Fuzzy Hash: A9F05E71F0A64382EF544F91E6A013873A2AF48F90F184039DA0D1A353DE3EE4908709

Function 00007FFDA3725DC8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON310 ref: 00007FFDA3725DD5
PyErr_Occurred.PYTHON310 ref: 00007FFDA3725DDE
PyErr_SetString.PYTHON310 ref: 00007FFDA3725E06

Strings

Value too large for lzma_match_finder type, xrefs: 00007FFDA3725DFC

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_match_finder type
API String ID: 944333170-1161044407
Opcode ID: fe812e4def519a6038c4b6caee64a48f17095f0321ec37f190ecc09b32502636
Instruction ID: 96a9343a9fdf2b0088b5d9f88fd585482ab4f2d66cff9e48ca6396367f415297
Opcode Fuzzy Hash: fe812e4def519a6038c4b6caee64a48f17095f0321ec37f190ecc09b32502636
Instruction Fuzzy Hash: 02F05E61F1A68281EB144F95F5A413473A2AF48B94F088035D90D26357CE3EE4508709

Function 00007FFDA546E9E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FFDA546E9F0

Part of subcall function 00007FFDA546EC30: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFDA546ECF0
Part of subcall function 00007FFDA546EC30: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFDA546E9F5), ref: 00007FFDA546ED3F

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA546EA1A

Strings

f, xrefs: 00007FFDA546E9F5
csm, xrefs: 00007FFDA546E9FB

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwindabortterminate
String ID: csm$f
API String ID: 2451123448-629598281
Opcode ID: c9fb23446a5b638453e0304dd207887769bfaeb8010eb75ee95ffcfd07f137de
Instruction ID: 117ef5ca794dee9e8ae937d97dcdb85a32c1effc19bba5149cae345f6f726c49
Opcode Fuzzy Hash: c9fb23446a5b638453e0304dd207887769bfaeb8010eb75ee95ffcfd07f137de
Instruction Fuzzy Hash: 67E06535F1924A81E7206B61B19133E66E4FF16F54F188035EA4807B47CEBDE4B48749

Function 00007FF7A0FFBBD0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7A0FFBC4F
WriteFile.KERNEL32 ref: 00007FF7A0FFBF17
WriteFile.KERNEL32 ref: 00007FF7A0FFBF5D
GetLastError.KERNEL32 ref: 00007FF7A0FFC013

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
Instruction ID: e76407afcf71fd885b0c2ed64b50d419bf81f8610d2e91e14df376f61eb7da32
Opcode Fuzzy Hash: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
Instruction Fuzzy Hash: D4D10273B1AA828DE710DF75D4402ACB7B1FB44B98B854635CE4DA7BA9DE38E016C710

Function 00007FFDA5469CC0 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C459
Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C492
Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C7BB

DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469E19
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469E78
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469EAA
DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469EBA

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: f50f9f5b0f4c072e52125a456639a7d4e2bd829a5a5137cb56b4f6bb80237050
Instruction ID: 072cd8e9d085066157e61c80e461acd0a32fa436199e6fa60d115a97fd20ce96
Opcode Fuzzy Hash: f50f9f5b0f4c072e52125a456639a7d4e2bd829a5a5137cb56b4f6bb80237050
Instruction Fuzzy Hash: EC912FA2F0A65A89FB118B60D8603BC37B5FB06B44F554036DA4D1BB9ADFFCA845C344

Function 00007FF7A0FFE95C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7A0FFEA4C
_get_daylight.LIBCMT ref: 00007FF7A0FFEA5D
_get_daylight.LIBCMT ref: 00007FF7A0FFEA6E
_isindst.LIBCMT ref: 00007FF7A0FFEB39

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
Instruction ID: b4e5ad5adfec3c391d48c4afc958090ac7912b07d988daa0485b3257c4703373
Opcode Fuzzy Hash: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
Instruction Fuzzy Hash: 7B510473F0A2124AFB14EF3898A56BCB761AB40358F960535DE1E66BF9DA38B4058710

Function 00007FFDA546A44C Relevance: 6.1, APIs: 4, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFDA546A4F1
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A501
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A51E
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546A553

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: fdc850366a52cc8509fdc883a27d076c67a20e363f2b2ed3a2a440fa302089d7
Instruction ID: 16a0f7dd6b652834f95ac98271c82121ce6ef3506a9125d312e62a1cc39669ea
Opcode Fuzzy Hash: fdc850366a52cc8509fdc883a27d076c67a20e363f2b2ed3a2a440fa302089d7
Instruction Fuzzy Hash: FA513772F1AB5A88E710CF61E8603B837A1FB46B48F548031DA4E47B96DFB9A441D744

Function 00007FF7A0FF483C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7A0FF486F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7A0FF48D1
GetLastError.KERNEL32 ref: 00007FF7A0FF4962
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A0FF4774), ref: 00007FF7A0FF49AE

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1291a0862dc251a0f1dda952d285f4a36c3dc69b0fb142e3468d3d288eb0a289
Instruction ID: a51699f3814eb14b54e46d3bebec3ebef36825cedb0fefb40d031626f1b039fc
Opcode Fuzzy Hash: 1291a0862dc251a0f1dda952d285f4a36c3dc69b0fb142e3468d3d288eb0a289
Instruction Fuzzy Hash: 75518F23B096428AFB20EF70D4503BE73A1AB44B58F528935DE4D677A9DF78F4818760

Function 00007FFDA43399D4 Relevance: 6.1, APIs: 4, Instructions: 116threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON310 ref: 00007FFDA4339B05
PyMem_Free.PYTHON310 ref: 00007FFDA4339B39
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,?,?,?,?,88560000), ref: 00007FFDA4339B44

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: d0ae780a5fd76d7bd8a5be981cbe0bcc47fc0b694ed8d05c2b818ee1d031d7c3
Instruction ID: 421c6d59514c409ec91c0f50dda583e98ce1d94cb30337321f9441e0646751ee
Opcode Fuzzy Hash: d0ae780a5fd76d7bd8a5be981cbe0bcc47fc0b694ed8d05c2b818ee1d031d7c3
Instruction Fuzzy Hash: 04517163B4EA8186EB169F3488B436C2B61AF52F58F098176C64E473B7EF1CA815C305

Function 00007FFDA3718118 Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON310(?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA371814D

Part of subcall function 00007FFDA3721EAC: PyBytes_FromStringAndSize.PYTHON310(?,?,?,00007FFDA3718167,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3721EE3
Part of subcall function 00007FFDA3721EAC: PyList_New.PYTHON310(?,?,?,00007FFDA3718167,?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3721EF6

PyEval_SaveThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA3718174
PyEval_RestoreThread.PYTHON310(?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA371818D
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,00007FFDA3717DB8), ref: 00007FFDA371824F

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: Eval_Thread$Bytes_DeallocFromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2935988267-0
Opcode ID: 79948a0cc6fea95aaadf2e020b82b0c993f20b4e0d16a12a2def13f0c98a5ddc
Instruction ID: 93bcb9af074fede7c5c8ffe83afb667df5261f078d54972bdd06436a0748f0a6
Opcode Fuzzy Hash: 79948a0cc6fea95aaadf2e020b82b0c993f20b4e0d16a12a2def13f0c98a5ddc
Instruction Fuzzy Hash: A341CA27B0AA4295EB658F15D4602BDB3A2FF88B88F544135DE0D677A6DF3ED444C304

Function 00007FFDA546C87C Relevance: 6.1, APIs: 4, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C459
Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C492
Part of subcall function 00007FFDA546C3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C7BB

DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C8F7
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C906
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C982
DName::operator+.LIBVCRUNTIME ref: 00007FFDA546C991

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 010c9cc7b649f2daabbc83b7255f351f4a32df461fe661a6f710ba75eaae01a6
Instruction ID: 96fed45d79ddd7c79471357a053683ed06b192a60d9e10414c3bba3c5b10d541
Opcode Fuzzy Hash: 010c9cc7b649f2daabbc83b7255f351f4a32df461fe661a6f710ba75eaae01a6
Instruction Fuzzy Hash: 37417772B09B898AFB01CF64D8513AC37B0FB46B48F548026DA4D57B5ADFBC9445C714

Function 00007FFDA37176A0 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON310 ref: 00007FFDA37176E8
PyMem_Free.PYTHON310 ref: 00007FFDA3717710
_Py_Dealloc.PYTHON310 ref: 00007FFDA3717718

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: bc61830c4ce5c9a50c445d9030e5a08ac398372477316497297bc1ef58bf3956
Instruction ID: 26201154b5fb339b7204305a62996ee370379f813b0ea6421f29dd501dd5a94a
Opcode Fuzzy Hash: bc61830c4ce5c9a50c445d9030e5a08ac398372477316497297bc1ef58bf3956
Instruction Fuzzy Hash: 44014C63B1A68285EB598F65E9A43783362EF48B54F184030CA0E263A6CF3ED454C319

Function 00007FF7A1004DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A1000920: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A1000953

_get_daylight.LIBCMT ref: 00007FF7A1004ED4
_get_daylight.LIBCMT ref: 00007FF7A1004EE5

Strings

?, xrefs: 00007FF7A1004E65

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
Instruction ID: 9d5baceb8d70e047dd4847cc82184518fbd47d703997f42a55781bf7ea0229f2
Opcode Fuzzy Hash: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
Instruction Fuzzy Hash: 9E415822A0E28246FB20AB25940137BF750EB80BA4F914235EE5C87BF9DF7CD461CB14

Function 00007FFDA5464710 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5466710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFDA546239E), ref: 00007FFDA546671E

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFDA54647E6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5464844

Strings

csm, xrefs: 00007FFDA54648EA

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: f6943bea1c78c8542bb5a279c29cdd6a6ec40214996e776607272464948ef889
Instruction ID: eda01ffb225b693b81a3516440e2c87e210f019e012ed7df2f7aabe43e4caf03
Opcode Fuzzy Hash: f6943bea1c78c8542bb5a279c29cdd6a6ec40214996e776607272464948ef889
Instruction Fuzzy Hash: CA517C3671A78586EA20AB25E05036EB7A4FB8AF90F140535EB8D07F56DF7CE060CB45

Function 00007FF7A0FF7FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FF8002

Part of subcall function 00007FF7A0FF9F78: RtlFreeHeap.NTDLL(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F8E
Part of subcall function 00007FF7A0FF9F78: GetLastError.KERNEL32(?,?,?,00007FF7A1001EC2,?,?,?,00007FF7A1001EFF,?,?,00000000,00007FF7A10023C5,?,?,00000000,00007FF7A10022F7), ref: 00007FF7A0FF9F98

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7A0FEA485), ref: 00007FF7A0FF8020

Strings

C:\Users\user\Desktop\PumpBot.exe, xrefs: 00007FF7A0FF800E

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\PumpBot.exe
API String ID: 3580290477-104690940
Opcode ID: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
Instruction ID: e48084457fd9a854f7760e1b44f1e81ede3b0e7fc9adf8a455af0624bab349ca
Opcode Fuzzy Hash: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
Instruction Fuzzy Hash: 01416137A0EA038AE714AF3199400B9A7A4EF447C4BD64435EA4E53BA5DF3DE4528720

Function 00007FF7A0FFC268 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7A0FFC37F
GetLastError.KERNEL32 ref: 00007FF7A0FFC3A1

Strings

U, xrefs: 00007FF7A0FFC32B

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
Instruction ID: e38c3922872d4bb2aee54f9f32913e60f5d2c50cf1af540f86c1d490580096f2
Opcode Fuzzy Hash: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
Instruction Fuzzy Hash: 3041C323A1DA5285EB209F25E4443AAB760FB887D4F824431EE4D97768DF7CE441CB50

Function 00007FFDA5469BAC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFDA5469CAA

Strings

void , xrefs: 00007FFDA5469C34
void, xrefs: 00007FFDA5469C0C

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: ff67bb32e799e4a453516f5f2b265aba841f0c9d9f12838b8a28f15594d75a10
Instruction ID: 66785a4da3e771c7b9411f5edce79346e5bb0498efd62df10401f1c6f2cfc35b
Opcode Fuzzy Hash: ff67bb32e799e4a453516f5f2b265aba841f0c9d9f12838b8a28f15594d75a10
Instruction Fuzzy Hash: B9314A62F1AB5A88FB00CB64D8612FC37B4BB49B48B440136EE4E17B5ADFBC9144C758

Function 00007FF7A0FFE588 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A0FFE5C8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A0FFE61A

Strings

:, xrefs: 00007FF7A0FFE5DE

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 18b7638caf06c09ebc69002de91f62cb772c0954a617d485b77ce50a76d6b06e
Instruction ID: 54966ce0ddd3feba175b5735393dd2e02bf747d1a2addb429e63982cc81d78da
Opcode Fuzzy Hash: 18b7638caf06c09ebc69002de91f62cb772c0954a617d485b77ce50a76d6b06e
Instruction Fuzzy Hash: BA21F723B1D24285FB20AB25D05426DB3B2FB94B44FC64435D64D533A4CF7CF5458B61

Function 00007FFDA546604F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA54663F0: RtlPcToFileHeader.KERNEL32 ref: 00007FFDA5466434
Part of subcall function 00007FFDA54663F0: RaiseException.KERNEL32 ref: 00007FFDA546647A

RtlPcToFileHeader.KERNEL32 ref: 00007FFDA54660BF

Strings

Access violation - no RTTI data!, xrefs: 00007FFDA546604F
Bad dynamic_cast!, xrefs: 00007FFDA5466072

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: d06b4d24d7aa4607bffac334420f89fbd77c373aef9fdd9199db5b082a62258c
Instruction ID: 52a5945c26e12d7cf76d322aa9de732590523b928c5ce72ad8fc47389e16066b
Opcode Fuzzy Hash: d06b4d24d7aa4607bffac334420f89fbd77c373aef9fdd9199db5b082a62258c
Instruction Fuzzy Hash: CA010C65B2BA4F91EE40DB14E4613B86360FF91F94F806431D64E06BA7EFACD545C704

Function 00007FF7A0FEE310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7A0FEE354
RaiseException.KERNEL32 ref: 00007FF7A0FEE39A

Strings

csm, xrefs: 00007FF7A0FEE387

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
Instruction ID: 63d1362316309a2ae423e63998444ca59cba39d2511bdbb26260581c95df1738
Opcode Fuzzy Hash: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
Instruction Fuzzy Hash: 37114F32609B4182EB109F25F44026ABBA4FB88B94F594631EE8D07768DF7CD5618B00

Function 00007FFDA54663F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFDA5466434
RaiseException.KERNEL32 ref: 00007FFDA546647A

Strings

csm, xrefs: 00007FFDA5466467

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 04e89f2c23f7d49b97199698fdfbf86ccf7878464e1c577e170b006b6ea557c8
Instruction ID: e8ecefed806277cf1a01d4c4f204c5efedacb1bfef8cd1330ee7b8977e3f3814
Opcode Fuzzy Hash: 04e89f2c23f7d49b97199698fdfbf86ccf7878464e1c577e170b006b6ea557c8
Instruction Fuzzy Hash: DA116D32609B8582EB218F25F4503697BA5FB89F84F184231DE8D07B59EF7CC851C704

Function 00007FF7A0FFF08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A0FFF0BC
GetDriveTypeW.KERNEL32 ref: 00007FF7A0FFF0FC

Strings

:, xrefs: 00007FF7A0FFF0E5

Memory Dump Source

Source File: 00000003.00000002.2145298642.00007FF7A0FE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A0FE0000, based on PE: true

Associated: 00000003.00000002.2145281819.00007FF7A0FE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145322816.00007FF7A100A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A101D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A1020000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145344091.00007FF7A102C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2145396856.00007FF7A102E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7a0fe0000_PumpBot.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
Instruction ID: 2f87856dfd5d7da467de950ec5c49de9a0bee163f1d9e7137ae971a4d63de0d2
Opcode Fuzzy Hash: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
Instruction Fuzzy Hash: 09018F62A1D6038AF720BF70946167EA3A0EF44744FC6083AD54DA27A2DF2CF5598B34

Function 00007FFDA4333268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_PyArg_NoPositional.PYTHON310 ref: 00007FFDA433328C
_PyArg_NoKeywords.PYTHON310 ref: 00007FFDA43332A5

Strings

BZ2Decompressor, xrefs: 00007FFDA4333285, 00007FFDA433329E

Memory Dump Source

Source File: 00000003.00000002.2146071615.00007FFDA4331000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFDA4330000, based on PE: true

Associated: 00000003.00000002.2146054039.00007FFDA4330000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146090661.00007FFDA433D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146106371.00007FFDA4341000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2146130857.00007FFDA4342000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda4330000_PumpBot.jbxd

Similarity

API ID: Arg_$KeywordsPositional
String ID: BZ2Decompressor
API String ID: 1300771297-1337346095
Opcode ID: f49c69fd8772b620f6cc56d6e746a0a1cbdd223cd73ad79cfa7510003c0af56d
Instruction ID: 3f70e339efc590cca59c50e2f6f607acf470bff64159f29d884ab293e7d5933e
Opcode Fuzzy Hash: f49c69fd8772b620f6cc56d6e746a0a1cbdd223cd73ad79cfa7510003c0af56d
Instruction Fuzzy Hash: FDF09620B49E4381FA50EB66E9F413552A1BF46BD0F149270E91DC77B6DF2CF4558308

Function 00007FFDA3719B00 Relevance: 5.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDA3719B62
memmove.VCRUNTIME140 ref: 00007FFDA3724CEF
memmove.VCRUNTIME140 ref: 00007FFDA3724D06

Memory Dump Source

Source File: 00000003.00000002.2145959128.00007FFDA3711000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFDA3710000, based on PE: true

Associated: 00000003.00000002.2145940840.00007FFDA3710000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA3727000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2145981819.00007FFDA372B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146017907.00007FFDA3733000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2146036278.00007FFDA3734000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda3710000_PumpBot.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 5af3248b750c40209648ddff9ae4d27cc2dc64d329dc7b4d63f4854710e1d4f4
Instruction ID: 87a49586f2bf7dedaffa9428fe48268e68b11977cc5ac7e415720528b73797f2
Opcode Fuzzy Hash: 5af3248b750c40209648ddff9ae4d27cc2dc64d329dc7b4d63f4854710e1d4f4
Instruction Fuzzy Hash: E6214533B0964483D6109F6AA41412DB762FB45BD0F280139EF4E27BA2DE7EE442CB48

Function 00007FFDA546672C Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDA54665B9,?,?,?,?,00007FFDA546FB22,?,?,?,?,?), ref: 00007FFDA546674B
SetLastError.KERNEL32(?,?,?,00007FFDA54665B9,?,?,?,?,00007FFDA546FB22,?,?,?,?,?), ref: 00007FFDA54667D4

Memory Dump Source

Source File: 00000003.00000002.2146161555.00007FFDA5461000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDA5460000, based on PE: true

Associated: 00000003.00000002.2146146385.00007FFDA5460000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146180642.00007FFDA5471000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146196740.00007FFDA5476000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.2146212191.00007FFDA5477000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffda5460000_PumpBot.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c7aaac8a80d8b30c274ca3e3b7c59e83a4e0092024cc1b5b0b7c72c8c7be0031
Instruction ID: 8fb68dc3781cc8f52ae7aba177be76475d790b2ba295a185dd215e1b877036ec
Opcode Fuzzy Hash: c7aaac8a80d8b30c274ca3e3b7c59e83a4e0092024cc1b5b0b7c72c8c7be0031
Instruction Fuzzy Hash: 44114224F0F65B82FA549B21A8243342691BF4AFE1F144A35D96E07BD7DFACF8418709

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PumpBot.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI52482\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI52482\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI52482\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI52482\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI52482\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI52482\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI52482\libcrypto-1_1.dll

C:\Users\user\AppData\Local\Temp\_MEI52482\libssl-1_1.dll

C:\Users\user\AppData\Local\Temp\_MEI52482\python310.dll

C:\Users\user\AppData\Local\Temp\_MEI52482\select.pyd

C:\Users\user\AppData\Local\Temp\_MEI52482\unicodedata.pyd

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
PumpBot.exe

Function 00007FF7A1004EA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Function 00007FF7A0FE58E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139
COMMON

Function 00007FF7A1005DEC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF7A100511C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Function 00007FF7A0FE17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Function 00007FF7A0FE1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Function 00007FF7A0FE6A60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Function 00007FF7A0FE6130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Function 00007FF7A0FE1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Function 00007FF7A0FE1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Function 00007FF7A0FFDF30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Function 00007FF7A0FFB08C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF7A0FFC590 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Function 00007FF7A0FFE95C Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Function 00007FF7A0FF46E8 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON