Edit tour

Windows Analysis Report
New_Order_Inquiry.exe

Overview

General Information

Sample name:	New_Order_Inquiry.exe
Analysis ID:	1559224
MD5:	0b789b4497c15da5ea8b2d82c4c6e2e0
SHA1:	e8f736e18f9147ee08e71f63bd78a2cf132ce794
SHA256:	69074195ee6ec19a43f304b8c92a0dcdeeabeb0bcbf8d007ae0dcf6781e487c2
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Contains functionality to register a low level keyboard hook

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

New_Order_Inquiry.exe (PID: 7656 cmdline: "C:\Users\user\Desktop\New_Order_Inquiry.exe" MD5: 0B789B4497C15DA5EA8B2D82C4C6E2E0)

RegSvcs.exe (PID: 7736 cmdline: "C:\Users\user\Desktop\New_Order_Inquiry.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.zqamcx.com", "Username": "servertwo@zqamcx.com", "Password": "Anambraeast@"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3895207706.0000000002415000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34847:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x348b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34943:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x349d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34a3f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34ab1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34b47:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34bd7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Process Memory Space: New_Order_Inquiry.exe PID: 7656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: New_Order_Inquiry.exe PID: 7656	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: New_Order_Inquiry.exe PID: 7656	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegSvcs.exe.410000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.410000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.410000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.410000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34847:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x348b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34943:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x349d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34a3f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34ab1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34b47:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34bd7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34847:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x348b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34943:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x349d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34a3f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34ab1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34b47:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34bd7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New_Order_Inquiry.exe.3810000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New_Order_Inquiry.exe.3810000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New_Order_Inquiry.exe.3810000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32a47:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32ab9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32b43:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32bd5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32c3f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32cb1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32d47:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32dd7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 78.110.166.82, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7736, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.zqamcx.com", "Username": "servertwo@zqamcx.com", "Password": "Anambraeast@"}

Multi AV Scanner detection for submitted file

Source: New_Order_Inquiry.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: New_Order_Inquiry.exe

Joe Sandbox ML: detected

Source: New_Order_Inquiry.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: New_Order_Inquiry.exe, 00000000.00000003.1446667189.0000000003C40000.00000004.00001000.00020000.00000000.sdmp, New_Order_Inquiry.exe, 00000000.00000003.1447457044.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New_Order_Inquiry.exe, 00000000.00000003.1446667189.0000000003C40000.00000004.00001000.00020000.00000000.sdmp, New_Order_Inquiry.exe, 00000000.00000003.1447457044.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CA6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CA6CA9
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CA60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00CA60DD
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CA63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00CA63F9
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CAEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CAEB60
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CAF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CAF5FA
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CAF56F FindFirstFileW,FindClose,	0_2_00CAF56F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CB1B2F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CB1C8A
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CB1F94

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.RegSvcs.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 78.110.166.82:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 78.110.166.82 78.110.166.82

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 78.110.166.82:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CB4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00CB4EB5

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.zqamcx.com

Source: RegSvcs.exe, 00000002.00000002.3895207706.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: RegSvcs.exe, 00000002.00000002.3894991150.00000000007A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.zqamcx.com
Source: RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3897490270.0000000005694000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0#
Source: RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3897490270.0000000005694000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: RegSvcs.exe, 00000002.00000002.3895207706.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894991150.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894991150.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zqamcx.com
Source: New_Order_Inquiry.exe, 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, n00.cs

.Net Code: O5ZNXKF

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_04FC9250 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,04FCA130,00000000,00000000

2_2_04FC9250

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CB6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00CB6B0C

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CB6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00CB6D07

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

0_2_00CB6B0C

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CA2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00CA2B37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CCF7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00CCF7FF

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegSvcs.exe.410000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New_Order_Inquiry.exe.3810000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00C63D19
Source: New_Order_Inquiry.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: New_Order_Inquiry.exe, 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_406e1ff3-7
Source: New_Order_Inquiry.exe, 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_98faf98b-0
Source: New_Order_Inquiry.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_20a064fc-1
Source: New_Order_Inquiry.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1a4399d3-2

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: New_Order_Inquiry.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CA6685: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00CA6685

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C9ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00C9ACC5

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CA79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00CA79D3

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C8B043	0_2_00C8B043
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C73200	0_2_00C73200
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C73B70	0_2_00C73B70
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C9410F	0_2_00C9410F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C802A4	0_2_00C802A4
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C9038E	0_2_00C9038E
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C6E3B0	0_2_00C6E3B0
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C806D9	0_2_00C806D9
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C9467F	0_2_00C9467F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CCAACE	0_2_00CCAACE
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C94BEF	0_2_00C94BEF
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C8CCC1	0_2_00C8CCC1
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C6AF50	0_2_00C6AF50
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C66F07	0_2_00C66F07
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CC31BC	0_2_00CC31BC
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C8D1B9	0_2_00C8D1B9
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C7B11F	0_2_00C7B11F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C9724D	0_2_00C9724D
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C8123A	0_2_00C8123A
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CA13CA	0_2_00CA13CA
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C693F0	0_2_00C693F0
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C7F563	0_2_00C7F563
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C696C0	0_2_00C696C0
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CAB6CC	0_2_00CAB6CC
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CCF7FF	0_2_00CCF7FF
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C677B0	0_2_00C677B0
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C979C9	0_2_00C979C9
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C7FA57	0_2_00C7FA57
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C69B60	0_2_00C69B60
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C67D19	0_2_00C67D19
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C89ED0	0_2_00C89ED0
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C7FE6F	0_2_00C7FE6F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C67FA3	0_2_00C67FA3
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_0174F248	0_2_0174F248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006C4320	2_2_006C4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006CB318	2_2_006CB318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006CE5A8	2_2_006CE5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006CAB58	2_2_006CAB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006C4BF0	2_2_006C4BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006CEE30	2_2_006CEE30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006C3FD8	2_2_006C3FD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006C0D24	2_2_006C0D24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_04FC2168	2_2_04FC2168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_04FC2162	2_2_04FC2162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B72430	2_2_05B72430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B766C0	2_2_05B766C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B7B300	2_2_05B7B300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B7C238	2_2_05B7C238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B75278	2_2_05B75278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B77E48	2_2_05B77E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B7E450	2_2_05B7E450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B77768	2_2_05B77768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B70040	2_2_05B70040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B759C8	2_2_05B759C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05B70006	2_2_05B70006

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: String function: 00C86AC0 appears 42 times
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: String function: 00C8F8A0 appears 35 times
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: String function: 00C7EC2F appears 68 times

Source: New_Order_Inquiry.exe, 00000000.00000003.1444738465.0000000003D63000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New_Order_Inquiry.exe
Source: New_Order_Inquiry.exe, 00000000.00000003.1442225793.0000000003F0D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New_Order_Inquiry.exe
Source: New_Order_Inquiry.exe, 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee33f29a3-d982-4bbb-b145-e4c33ad27d5d.exe4 vs New_Order_Inquiry.exe

Source: New_Order_Inquiry.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.RegSvcs.exe.410000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New_Order_Inquiry.exe.3810000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CACE7A GetLastError,FormatMessageW,

0_2_00CACE7A

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C9AB84 AdjustTokenPrivileges,CloseHandle,		0_2_00C9AB84
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C9B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00C9B134

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CAE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00CAE1FD

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CA6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00CA6532

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CBC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_00CBC18C

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C6406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00C6406B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

File created: C:\Users\user\AppData\Local\Temp\aut2F3.tmp

Jump to behavior

Source: New_Order_Inquiry.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New_Order_Inquiry.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\New_Order_Inquiry.exe "C:\Users\user\Desktop\New_Order_Inquiry.exe"
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\New_Order_Inquiry.exe"
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\New_Order_Inquiry.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: New_Order_Inquiry.exe

Static file information: File size 1267200 > 1048576

Source: New_Order_Inquiry.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: New_Order_Inquiry.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: New_Order_Inquiry.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: New_Order_Inquiry.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: New_Order_Inquiry.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: New_Order_Inquiry.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: New_Order_Inquiry.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: New_Order_Inquiry.exe, 00000000.00000003.1446667189.0000000003C40000.00000004.00001000.00020000.00000000.sdmp, New_Order_Inquiry.exe, 00000000.00000003.1447457044.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New_Order_Inquiry.exe, 00000000.00000003.1446667189.0000000003C40000.00000004.00001000.00020000.00000000.sdmp, New_Order_Inquiry.exe, 00000000.00000003.1447457044.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp

Source: New_Order_Inquiry.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: New_Order_Inquiry.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: New_Order_Inquiry.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: New_Order_Inquiry.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: New_Order_Inquiry.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C7E01E LoadLibraryA,GetProcAddress,

0_2_00C7E01E

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C86B05 push ecx; ret	0_2_00C86B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006C83D5 pushfd ; iretd	2_2_006C83BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_006C83B5 pushfd ; iretd	2_2_006C83BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_04FCC5B0 push eax; retf 0005h	2_2_04FCC5BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_04FC89B9 push ds; retf 0005h	2_2_04FC89BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_04FC8BB9 push ds; retf 0005h	2_2_04FC8BBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_04FC8BA1 push ds; retf 0005h	2_2_04FC8BA2

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CC8111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00CC8111
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C7EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00C7EB42

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C8123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00C8123A

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: New_Order_Inquiry.exe PID: 7656, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

API/Special instruction interceptor: Address: 174EE6C

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: New_Order_Inquiry.exe, 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999434	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5996890	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2387			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7460			Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Evaded block: after key decision

graph_0-94379

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-96185

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

API coverage: 4.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CA6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CA6CA9
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CA60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00CA60DD
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CA63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00CA63F9
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CAEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CAEB60
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CAF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CAF5FA
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CAF56F FindFirstFileW,FindClose,	0_2_00CAF56F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CB1B2F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CB1C8A
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CB1F94

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C7DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C7DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99873	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99634	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99463	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99271	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97241	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999434	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5999078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5998094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5997000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 5996890	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: RegSvcs.exe, 00000002.00000002.3897490270.0000000005694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	API call chain: ExitProcess graph end node			graph_0-93750
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	API call chain: ExitProcess graph end node			graph_0-94663

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_006C71D8 CheckRemoteDebuggerPresent,

2_2_006C71D8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CB6AAF BlockInput,

0_2_00CB6AAF

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C63D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C63D19

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C93920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00C93920

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C7E01E LoadLibraryA,GetProcAddress,

0_2_00C7E01E

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_0174F138 mov eax, dword ptr fs:[00000030h]	0_2_0174F138
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_0174F0D8 mov eax, dword ptr fs:[00000030h]	0_2_0174F0D8
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_0174DAA8 mov eax, dword ptr fs:[00000030h]	0_2_0174DAA8

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C9A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00C9A66C

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C88189 SetUnhandledExceptionFilter,		0_2_00C88189
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00C881AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00C881AC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 237008

Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C9B106 LogonUserW,

0_2_00C9B106

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C63D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C63D19

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CA411C SendInput,keybd_event,

0_2_00CA411C

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CA74E7 mouse_event,

0_2_00CA74E7

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\New_Order_Inquiry.exe"

Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

0_2_00C9A66C

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CA71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00CA71FA

Source: New_Order_Inquiry.exe	Binary or memory string: Shell_TrayWnd
Source: New_Order_Inquiry.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C865C4 cpuid

0_2_00C865C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CB091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_00CB091D

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00CDB340 GetUserNameW,

0_2_00CDB340

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C91E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00C91E8E

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe

Code function: 0_2_00C7DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C7DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New_Order_Inquiry.exe.3810000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895207706.0000000002415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New_Order_Inquiry.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7736, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: New_Order_Inquiry.exe	Binary or memory string: WIN_81
Source: New_Order_Inquiry.exe	Binary or memory string: WIN_XP
Source: New_Order_Inquiry.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: New_Order_Inquiry.exe	Binary or memory string: WIN_XPe
Source: New_Order_Inquiry.exe	Binary or memory string: WIN_VISTA
Source: New_Order_Inquiry.exe	Binary or memory string: WIN_7
Source: New_Order_Inquiry.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 2.2.RegSvcs.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New_Order_Inquiry.exe.3810000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New_Order_Inquiry.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7736, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New_Order_Inquiry.exe.3810000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New_Order_Inquiry.exe.3810000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895207706.0000000002415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New_Order_Inquiry.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7736, type: MEMORYSTR

Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00CB8C4F
Source: C:\Users\user\Desktop\New_Order_Inquiry.exe	Code function: 0_2_00CB923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00CB923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	321 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	321 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	651 Security Software Discovery	SSH	4 Clipboard Data	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	231 Virtualization/Sandbox Evasion	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New_Order_Inquiry.exe	53%	ReversingLabs	Win32.Trojan.AutoitInject
New_Order_Inquiry.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
zqamcx.com	78.110.166.82	true	false	high
ip-api.com	208.95.112.1	true	false	high
mail.zqamcx.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://mail.zqamcx.com	RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://zqamcx.com	RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	New_Order_Inquiry.exe, 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp	false	high
http://r11.o.lencr.org0#	RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3897490270.0000000005694000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3895207706.0000000002391000.00000004.00000800.00020000.00000000.sdmp	false	high
http://r11.i.lencr.org/0#	RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3897490270.0000000005694000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894991150.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.3897490270.0000000005680000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894991150.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	RegSvcs.exe, 00000002.00000002.3895207706.0000000002391000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
78.110.166.82	zqamcx.com	United Kingdom		42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559224
Start date and time:	2024-11-20 10:22:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New_Order_Inquiry.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 60 Number of non-executed functions: 283
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: New_Order_Inquiry.exe

Simulations

Behavior and APIs

Time	Type	Description
04:23:53	API Interceptor	10691075x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	ip-api.com/line/?fields=hosting
	DHL_Doc.9787653446578978656879764534576879764545766456.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
	FACTER9098767800.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/
	XSLHv0kxy7.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
78.110.166.82	COB756883.vbs	Get hash	malicious	CobaltStrike	Browse	windowsupdatesolutions.com/ServerCOB.txt
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	208.95.112.1
	DHL_Doc.9787653446578978656879764534576879764545766456.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	paket teklif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FACTER9098767800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
zqamcx.com	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	29.10.2024-29.10.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UKSERVERS-ASUKDedicatedServersHostingandCo-Location	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	sora.mips.elf	Get hash	malicious	Mirai	Browse	78.157.201.124
	RKsVnThLLP.exe	Get hash	malicious	Njrat	Browse	94.46.207.10
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	New Order (2).exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
TUT-ASUS	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	208.95.112.1
	DHL_Doc.9787653446578978656879764534576879764545766456.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	http://ok.clicknowvip.com	Get hash	malicious	Unknown	Browse	162.252.214.5
	paket teklif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FACTER9098767800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\New_Order_Inquiry.exe
File Type:	data
Category:	dropped
Size (bytes):	245248
Entropy (8bit):	6.746006404854314
Encrypted:	false
SSDEEP:	6144:Ei6RmJe0s3o8ztk6snVjfCMaASevXED/AGHCAShtDW2tDr55yontYfKJRs3kI3XH:L6RYe0sY8WZKuXEXYs33xE/O
MD5:	0036D89BB2097C8A5600402A1ADCA65A
SHA1:	E0B5A0DB43C1352008B350B5A354C61EF37614C1
SHA-256:	FBA2737A1E8C2884083AD319B3F0F0C7F2ED784F2F134F6D1A25EF20FDEC3456
SHA-512:	19170C2BC629AC1CFAAC0179B5EC08A7B28868EC40B86034528C4626DF6FDD241C47B77D3EE044D3379A341E8800B02D762DF9C4C43966D040E7AAC76E31A74B
Malicious:	false
Reputation:	low
Preview:	.i.ZAX5LTYA4.31.79WAHKJ.3AZBX5LPYA40W31D79WAHKJA3AZBX5LPYA4.W31J(.YA.B.`.@..ya$9aDB8TC%Z.4 &%%5.#?b@"p0/.t.`.)X]2oEF@e3AZBX5L..A4\|V01.y.2AHKJA3AZ.X7M[XJ40.01D?9WAHKJ..BZBx5LP.B40Ws1D.9WAJKJE3AZBX5LTYA40W31D.=WAJKJA3AZ@Xu.PYQ40G31D7)WAXKJA3AZRX5LPYA40W31..:W.HKJA.BZ.]5LPYA40W31D79WAHKJA3EZNX5LPYA40W31D79WAHKJA3AZBX5LPYA40W31D79WAHKJA3AZBX5LPyA48W31D79WAHKJI.AZ.X5LPYA40W31jC\/5HKJ..BZBx5LP.B40U31D79WAHKJA3AZbX5,~+2FSW31.29WA.HJA5AZB.6LPYA40W31D79W.HK.oA$6-;5L\YA40W71D59WA.HJA3AZBX5LPYA4pW3sD79WAHKJA3AZBX5L..B40W31.79WCHNJq.CZn4LSYA41W37D79WAHKJA3AZBX5LPYA40W31D79WAHKJA3AZBX5LPYA40W31Y......t.N.P _.j.>.7.. ..N..N.^.:'...8....."5..7.Xq..H....-.DU @....\|W2&O .=n< ._...d`@p..7.C...5x.]G~.q....b...>0ia..<.."\,t#(E 5w.UV6AX.5.VAHKJ......9!.n.T</p%A....u!9.....YA4TW31679W HKJ.3AZ-X5L>YA4NW31:79W.HKJ.3AZuX5LuYA4]W31`79W?HKJ.NNU...%#..40W31q.g.%...l.m..z!.?oRo..S....N..<).5.y...O..<..SeRQb..M@5E_@_1O\dO....F3=RCOOIM.O....m.......5....2.6A3AZBX.LP.A40.1.79W.H.J..AZB..L.Y.4..1

C:\Users\user\AppData\Local\Temp\aut2F3.tmp

Download File

Process:	C:\Users\user\Desktop\New_Order_Inquiry.exe
File Type:	data
Category:	dropped
Size (bytes):	154714
Entropy (8bit):	7.832366517166845
Encrypted:	false
SSDEEP:	3072:aBGnrHRhFfEfITFdfOcY8Q/pyMeRGiZRNz3mhxok0P8K4D7oEt2nryWfKT:+GKI/Ols9G4/aC8K4HodyWfKT
MD5:	85A5922ABD668E835BDDABD022AF4BEE
SHA1:	08338B69449E7D67B6E48F4798BEDD2511DF5A7B
SHA-256:	1D580BFA6426A973DB1C0958187F50FC431D1AF0B5F92E9B58F1DDD8B531F752
SHA-512:	F0B35EBC79334ED488C527AFBCC8E010B106821EDCA9A3CC46DA264B853E78A831B2E8FBA162AC6A2F2FCB227985DA2FA48514ECC994DDD2EA2A0E3BBAFCA1B0
Malicious:	false
Reputation:	low
Preview:	EA06.....Zz5..bkL.Vh3N~.g1.M.5z.".J...5....P..&.y...1....v...Q.....,=..@.c.6.$.Ua.P..J.....H$.Y,.'#..T...a/.]#.....].[.j...#0...i\|.L&9..Nd....boM..)SI..a1.O..1...T+......H.9....0R.t.(.Fj.....@. ...X..j....aG..e5z.`.c. ...<...H....PJ....E.S.B? ....A.N..;I..kP....u.\|..`..@63.........5._.s5L...L...E".A..0.......R.V...m-..i....o1.M@... ...U.w0......Pfs.`..C.S.W.}...M).0..cW...<?....sy.~K...Bi......m...._. .}).x.:.^.....&=8....~.^E5.Cf.Z......6....[..Ud.........)5>A.....e....x.....9....?W+.5.s..{.n......O{M..L-6.gBy......QE.Mn..ZmA..f.:..C.....f.9....._p..`>...u..a..Gk.........`....`..Z..O...p..:.. .c.....P....0X.......S..._vK#.o.B+._yg..{^...gm...W....o.[...O?..D....S....0.N...O/.....Q.A.t..._.W.4....k...4.{R.....l:...h\|6.......}.9.S...L..`..r.........w`.....pv`..c.L.Vw.M......&..m.}.......fu5..l.H<N.6.P@r12..h.....!.Ucr$.g}......O.0)..=.i4..f4I.D.@.M..:.z........=..h.X...H..(\|.=..X.......>..#.z..n.PFlu....L.Wmw...g1.....DR...U..;...;.H".y..h..h..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.655468093430536
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	New_Order_Inquiry.exe
File size:	1'267'200 bytes
MD5:	0b789b4497c15da5ea8b2d82c4c6e2e0
SHA1:	e8f736e18f9147ee08e71f63bd78a2cf132ce794
SHA256:	69074195ee6ec19a43f304b8c92a0dcdeeabeb0bcbf8d007ae0dcf6781e487c2
SHA512:	a24e171a1e526100337e826ff886fbbf03f3d6269d2ba5beb4444f8e7b9fef2ab3bc5085ead3a303069f3a74db463d0e4693f7fca0a39120bbc2c100656e3c3d
SSDEEP:	24576:ztb20pkaCqT5TBWgNQ7aaWqN4SDcGF0Yg6A:wVg5tQ7aaAt5
TLSH:	4245BF1333DD83A5D772127379267B556E7B7C2946B0B85B2FD8383DAA30122121EA33
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	98e2a3b29b9ba181

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673BF314 [Tue Nov 19 02:08:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007FC838F28A9Fh
jmp 00007FC838F1BAB4h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FC838F1BC3Ah
cmp edi, eax
jc 00007FC838F1BF9Eh
bt dword ptr [004C0158h], 01h
jnc 00007FC838F1BC39h
rep movsb
jmp 00007FC838F1BF4Ch
cmp ecx, 00000080h
jc 00007FC838F1BE04h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FC838F1BC40h
bt dword ptr [004BA370h], 01h
jc 00007FC838F1C110h
bt dword ptr [004C0158h], 00000000h
jnc 00007FC838F1BDDDh
test edi, 00000003h
jne 00007FC838F1BDEEh
test esi, 00000003h
jne 00007FC838F1BDCDh
bt edi, 02h
jnc 00007FC838F1BC3Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FC838F1BC43h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FC838F1BC95h
bt esi, 03h
jnc 00007FC838F1BCE8h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x6c568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x131000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x6c568	0x6c600	2945b18386f9539f1cc11a5fc274a662	False	0.5727071619088812	data	6.177973139390375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x131000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc4458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc4580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc46a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc47d0	0x33428	Device independent bitmap graphic, 198 x 512 x 32, image size 202752, resolution 7874 x 7874 px/m	English	Great Britain	0.13495903981710802
RT_MENU	0xf7bf8	0x50	data	English	Great Britain	0.9
RT_STRING	0xf7c48	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xf81dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xf8868	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xf8cf8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xf92f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xf9950	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xf9db8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xf9f10	0x36179	data			1.0003430206579678
RT_GROUP_ICON	0x13008c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1300a0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1300b4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1300c8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1300dc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1301b8	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 10:23:53.214987993 CET	49705	80	192.168.2.8	208.95.112.1
Nov 20, 2024 10:23:53.221059084 CET	80	49705	208.95.112.1	192.168.2.8
Nov 20, 2024 10:23:53.221771955 CET	49705	80	192.168.2.8	208.95.112.1
Nov 20, 2024 10:23:53.222564936 CET	49705	80	192.168.2.8	208.95.112.1
Nov 20, 2024 10:23:53.228831053 CET	80	49705	208.95.112.1	192.168.2.8
Nov 20, 2024 10:23:53.696407080 CET	80	49705	208.95.112.1	192.168.2.8
Nov 20, 2024 10:23:53.750150919 CET	49705	80	192.168.2.8	208.95.112.1
Nov 20, 2024 10:23:54.892584085 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:54.897747993 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:54.897814035 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:55.529350042 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:55.529546022 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:55.535335064 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:55.703775883 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:55.703999996 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:55.710027933 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:55.875610113 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:55.884058952 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:55.889416933 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.063427925 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.063534021 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.063544989 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.063591003 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:56.100369930 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:56.106570005 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.268816948 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.283207893 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:56.288074017 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.453432083 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.454504967 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:56.461494923 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.625333071 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.625736952 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:56.633001089 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.802742958 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.802978039 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:56.810410976 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.980397940 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:56.980830908 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:56.988759995 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.150876045 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.151106119 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:57.156264067 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.322242975 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.322882891 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:57.322942972 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:57.322966099 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:57.322985888 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:23:57.331201077 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.331218004 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.331228018 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.606064081 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:23:57.656492949 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:24:44.781650066 CET	49705	80	192.168.2.8	208.95.112.1
Nov 20, 2024 10:24:44.789448977 CET	80	49705	208.95.112.1	192.168.2.8
Nov 20, 2024 10:24:44.789539099 CET	49705	80	192.168.2.8	208.95.112.1
Nov 20, 2024 10:25:34.797461033 CET	49706	587	192.168.2.8	78.110.166.82
Nov 20, 2024 10:25:34.803627968 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:25:34.967053890 CET	587	49706	78.110.166.82	192.168.2.8
Nov 20, 2024 10:25:34.971729994 CET	49706	587	192.168.2.8	78.110.166.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 10:23:53.198319912 CET	65418	53	192.168.2.8	1.1.1.1
Nov 20, 2024 10:23:53.207828999 CET	53	65418	1.1.1.1	192.168.2.8
Nov 20, 2024 10:23:54.781940937 CET	51381	53	192.168.2.8	1.1.1.1
Nov 20, 2024 10:23:54.890671968 CET	53	51381	1.1.1.1	192.168.2.8
Nov 20, 2024 10:24:34.950329065 CET	53	56038	162.159.36.2	192.168.2.8
Nov 20, 2024 10:24:35.450812101 CET	53	62602	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 10:23:53.198319912 CET	192.168.2.8	1.1.1.1	0xbaa0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:23:54.781940937 CET	192.168.2.8	1.1.1.1	0xd5f9	Standard query (0)	mail.zqamcx.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 10:23:53.207828999 CET	1.1.1.1	192.168.2.8	0xbaa0	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:23:54.890671968 CET	1.1.1.1	192.168.2.8	0xd5f9	No error (0)	mail.zqamcx.com	zqamcx.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 10:23:54.890671968 CET	1.1.1.1	192.168.2.8	0xd5f9	No error (0)	zqamcx.com		78.110.166.82	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	208.95.112.1	80	7736	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:23:53.222564936 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 20, 2024 10:23:53.696407080 CET	175	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:23:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 20, 2024 10:23:55.529350042 CET	587	49706	78.110.166.82	192.168.2.8	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Wed, 20 Nov 2024 09:23:55 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 10:23:55.529546022 CET	49706	587	192.168.2.8	78.110.166.82	EHLO 226533
Nov 20, 2024 10:23:55.703775883 CET	587	49706	78.110.166.82	192.168.2.8	250-cphost14.qhoster.net Hello 226533 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 20, 2024 10:23:55.703999996 CET	49706	587	192.168.2.8	78.110.166.82	STARTTLS
Nov 20, 2024 10:23:55.875610113 CET	587	49706	78.110.166.82	192.168.2.8	220 TLS go ahead

Target ID:	0
Start time:	04:23:49
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\New_Order_Inquiry.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New_Order_Inquiry.exe"
Imagebase:	0xc60000
File size:	1'267'200 bytes
MD5 hash:	0B789B4497C15DA5EA8B2D82C4C6E2E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1448710095.0000000003810000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:23:50
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New_Order_Inquiry.exe"
Imagebase:	0x40000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3895207706.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3895207706.0000000002415000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3894376473.0000000000412000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3895207706.00000000023F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	7%
Total number of Nodes:	2000
Total number of Limit Nodes:	56

Executed Functions

Function 00C8B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97377443fef7c33d7dc3632e3046507d016a07d15645d1b04137c67b4d0561ee
Instruction ID: 47bb90911618a6d4caa79a01a06ec731f19a4851e61ad22a9856710998f99063
Opcode Fuzzy Hash: 97377443fef7c33d7dc3632e3046507d016a07d15645d1b04137c67b4d0561ee
Instruction Fuzzy Hash: C0326C75B022288FCB24AF14DC81AE9B7B5FF46318F1841D9E41AE7A91D7309E81CF56

Function 00C63D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00C63AA3,?), ref: 00C63D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00C63AA3,?), ref: 00C63D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,00D21148,00D21130,?,?,?,?,00C63AA3,?), ref: 00C63DC8

Part of subcall function 00C66430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00C63DEE,00D21148,?,?,?,?,?,00C63AA3,?), ref: 00C66471

SetCurrentDirectoryW.KERNEL32(?,?,?,00C63AA3,?), ref: 00C63E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00D128F4,00000010), ref: 00CD1CCE
SetCurrentDirectoryW.KERNEL32(?,00D21148,?,?,?,?,?,00C63AA3,?), ref: 00CD1D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00CFDAB4,00D21148,?,?,?,?,?,00C63AA3,?), ref: 00CD1D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00C63AA3), ref: 00CD1D90

Part of subcall function 00C63E6E: GetSysColorBrush.USER32(0000000F), ref: 00C63E79
Part of subcall function 00C63E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00C63E88
Part of subcall function 00C63E6E: LoadIconW.USER32(00000063), ref: 00C63E9E
Part of subcall function 00C63E6E: LoadIconW.USER32(000000A4), ref: 00C63EB0
Part of subcall function 00C63E6E: LoadIconW.USER32(000000A2), ref: 00C63EC2
Part of subcall function 00C63E6E: RegisterClassExW.USER32(?), ref: 00C63F30

Part of subcall function 00C636B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C636E6
Part of subcall function 00C636B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C63707
Part of subcall function 00C636B8: ShowWindow.USER32(00000000,?,?,?,?,00C63AA3,?), ref: 00C6371B
Part of subcall function 00C636B8: ShowWindow.USER32(00000000,?,?,?,?,00C63AA3,?), ref: 00C63724

Part of subcall function 00C64FFC: _memset.LIBCMT ref: 00C65022
Part of subcall function 00C64FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C650CB

Strings

This is a third-party compiled AutoIt script., xrefs: 00CD1CC8
runas, xrefs: 00CD1D84

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-3287110873
Opcode ID: d2e6966bad3e672224287b387b7dec71587cc278a22afeeea90b32dffe6c3543
Instruction ID: 97b4115e2fa70723a8387bb096454e53b514c3a84922851e26d2f5ad052d4770
Opcode Fuzzy Hash: d2e6966bad3e672224287b387b7dec71587cc278a22afeeea90b32dffe6c3543
Instruction Fuzzy Hash: 1951F735A04389BECB32ABB4DCC1EFD7B759F25704F008065F612A62A2DA714A56DB31

Function 00C7DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00C7DDEC
GetCurrentProcess.KERNEL32(00000000,00CFDC38,?,?), ref: 00C7DEAC
GetNativeSystemInfo.KERNELBASE(?,00CFDC38,?,?), ref: 00C7DF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 00C7DF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 00C7DF1F
GetSystemInfo.KERNEL32(?,00CFDC38,?,?), ref: 00C7DF29
GetSystemInfo.KERNEL32(?,00CFDC38,?,?), ref: 00C7DF35

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: 45cf1a1982060fa5e55ac49358fe1605a04e61e9b4b165238be4bd1aa969e449
Instruction ID: 0665beb46e8a0ba2aa713d1faf37262baa2d4c6cd5436bdaccbc2db5343d6576
Opcode Fuzzy Hash: 45cf1a1982060fa5e55ac49358fe1605a04e61e9b4b165238be4bd1aa969e449
Instruction Fuzzy Hash: 7E6170B180A284DFCF16CF6898C15ED7FB46F39300F1989D9D85A9F247C624CA49CB66

Function 00C6406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00C6449E,?,?,00000000,00000001), ref: 00C6407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00C6449E,?,?,00000000,00000001), ref: 00C64092
LoadResource.KERNEL32(?,00000000,?,?,00C6449E,?,?,00000000,00000001,?,?,?,?,?,?,00C641FB), ref: 00CD4F1A
SizeofResource.KERNEL32(?,00000000,?,?,00C6449E,?,?,00000000,00000001,?,?,?,?,?,?,00C641FB), ref: 00CD4F2F
LockResource.KERNEL32(00C6449E,?,?,00C6449E,?,?,00000000,00000001,?,?,?,?,?,?,00C641FB,00000000), ref: 00CD4F42

Strings

SCRIPT, xrefs: 00C64088

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 75380bf6508217e9a2ccf2eae742f4239e788902d8fa3172e08bdf888a092342
Instruction ID: f04f4e242c36899b40c6be4e0a5a7f3f66ded547316784aac24784c149ed761e
Opcode Fuzzy Hash: 75380bf6508217e9a2ccf2eae742f4239e788902d8fa3172e08bdf888a092342
Instruction Fuzzy Hash: 4F117C70200711BFE7358B66EC88F6B7BB9EBC5B51F20412DF6128A2A0DB71DC408A20

Function 00CA6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00CD2F49), ref: 00CA6CB9
FindFirstFileW.KERNELBASE(?,?), ref: 00CA6CCA
FindClose.KERNEL32(00000000), ref: 00CA6CDA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: baf9ea3f36e0afe3a422d68b2aa3e20fd9164b4306d04021ea7da888d3ccd603
Instruction ID: 3f9fded96a9dd75d9e61237cf359790b1a19f602d566d95199f279f99500faaa
Opcode Fuzzy Hash: baf9ea3f36e0afe3a422d68b2aa3e20fd9164b4306d04021ea7da888d3ccd603
Instruction Fuzzy Hash: 30E048318145169B82206738EC4D5ED776CDE0633DF244715F976C11D0E774DA4445D6

Function 00C73B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON

Download Yara Rule

Strings

@, xrefs: 00C74176

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @
API String ID: 3728558374-2766056989
Opcode ID: f7a4261d54bac96cf61a342dcf320a62537e6c2a3e55467ef4f685eb7f23e90f
Instruction ID: 7e97bae665f987d069a9abfca1147480e3d6f89ae3831dababda1f326656d2ca
Opcode Fuzzy Hash: f7a4261d54bac96cf61a342dcf320a62537e6c2a3e55467ef4f685eb7f23e90f
Instruction Fuzzy Hash: 4E72AE71E04249DFCB24DFA8C481ABEB7B5EF48340F14C05AE91AAB351D731AE45EB91

Function 00C73200 Relevance: 1.0, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 64d88e9dce6537462405cc100261ffe3c0cf96a2f768201a50c028e3a3a2f36d
Instruction ID: cda61af60f6555e938e6639426a1f29152a22e7552d1707db8e4ee6674ff55a5
Opcode Fuzzy Hash: 64d88e9dce6537462405cc100261ffe3c0cf96a2f768201a50c028e3a3a2f36d
Instruction Fuzzy Hash: 66927A746083419FD724DF19C480B6ABBE1FF88304F14885EE99A8B362D771EE45EB52

Function 00C6E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C6E959
timeGetTime.WINMM ref: 00C6EBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C6ED2E
TranslateMessage.USER32(?), ref: 00C6ED3F
DispatchMessageW.USER32(?), ref: 00C6ED4A
LockWindowUpdate.USER32(00000000), ref: 00C6ED79
DestroyWindow.USER32 ref: 00C6ED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00C6ED9F
Sleep.KERNEL32(0000000A), ref: 00CD5270
TranslateMessage.USER32(?), ref: 00CD59F7
DispatchMessageW.USER32(?), ref: 00CD5A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CD5A19

Strings

@GUI_WINHANDLE, xrefs: 00CD5360
@TRAY_ID, xrefs: 00CD54C9
@GUI_CTRLHANDLE, xrefs: 00CD53AC
@GUI_CTRLID, xrefs: 00CD5314

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 7157908fc80aa404a33064a32ba2c17239ac66453fb5059c1ad748f89cf2b01e
Instruction ID: a112d819fccbca214dcb8620d4fd4d5554e61e884976e8b626051058f77b340d
Opcode Fuzzy Hash: 7157908fc80aa404a33064a32ba2c17239ac66453fb5059c1ad748f89cf2b01e
Instruction Fuzzy Hash: 0762D074508340DFEB30DF24C8C5BAA77E4BF94304F14486EF99A8B292DB719949DB62

Function 00C95C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00C95EC3
___createFile.LIBCMT ref: 00C95F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00C95F2D
__dosmaperr.LIBCMT ref: 00C95F34
GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00C95F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00C95F6A
__dosmaperr.LIBCMT ref: 00C95F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00C95F7C
__set_osfhnd.LIBCMT ref: 00C95FAC
__lseeki64_nolock.LIBCMT ref: 00C96016
__close_nolock.LIBCMT ref: 00C9603C
__chsize_nolock.LIBCMT ref: 00C9606C
__lseeki64_nolock.LIBCMT ref: 00C9607E
__lseeki64_nolock.LIBCMT ref: 00C96176
__lseeki64_nolock.LIBCMT ref: 00C9618B
__close_nolock.LIBCMT ref: 00C961EB

Part of subcall function 00C8EA9C: CloseHandle.KERNELBASE(00000000,00D0EEF4,00000000,?,00C96041,00D0EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00C8EAEC
Part of subcall function 00C8EA9C: GetLastError.KERNEL32(?,00C96041,00D0EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00C8EAF6
Part of subcall function 00C8EA9C: __free_osfhnd.LIBCMT ref: 00C8EB03
Part of subcall function 00C8EA9C: __dosmaperr.LIBCMT ref: 00C8EB25

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

__lseeki64_nolock.LIBCMT ref: 00C9620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00C96342
___createFile.LIBCMT ref: 00C96361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00C9636E
__dosmaperr.LIBCMT ref: 00C96375
__free_osfhnd.LIBCMT ref: 00C96395
__invoke_watson.LIBCMT ref: 00C963C3
__wsopen_helper.LIBCMT ref: 00C963DD

Strings

@, xrefs: 00C95F98

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: 85e0688312411be6e3b69e3371ab69f14a3d82fd59dda9b08bcd22928e1fb8b2
Instruction ID: ff98e7965784730fe74880b1703b52ec8e20516ece457045b734b6d40db0158d
Opcode Fuzzy Hash: 85e0688312411be6e3b69e3371ab69f14a3d82fd59dda9b08bcd22928e1fb8b2
Instruction Fuzzy Hash: 122236729006069FEF2A9F68DC8DBBD7B71EB11324F244229E9319B2E2D3358E50D751

Function 00C8EE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 11826bd11e18be88687ba05231f85a96d63461e44df47b55cdbe9f35cb23cdbc
Instruction ID: db27b7bce4d7dd7c70b063dc5eed2b3da0f07240f95fb71d170e9016b240e60d
Opcode Fuzzy Hash: 11826bd11e18be88687ba05231f85a96d63461e44df47b55cdbe9f35cb23cdbc
Instruction Fuzzy Hash: DE325A71A04245DFDB21EF58C840BBD7BB1AF55318F28416EE8659F292D7309D43CB68

Function 00CAFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00CAFA96
_wcschr.LIBCMT ref: 00CAFAA4
_wcscpy.LIBCMT ref: 00CAFABB
_wcscat.LIBCMT ref: 00CAFACA
_wcscat.LIBCMT ref: 00CAFAE8
_wcscpy.LIBCMT ref: 00CAFB09
__wsplitpath.LIBCMT ref: 00CAFBE6
_wcscpy.LIBCMT ref: 00CAFC0B
_wcscpy.LIBCMT ref: 00CAFC1D
_wcscpy.LIBCMT ref: 00CAFC32
_wcscat.LIBCMT ref: 00CAFC47
_wcscat.LIBCMT ref: 00CAFC59
_wcscat.LIBCMT ref: 00CAFC6E

Part of subcall function 00CABFA4: _wcscmp.LIBCMT ref: 00CAC03E
Part of subcall function 00CABFA4: __wsplitpath.LIBCMT ref: 00CAC083
Part of subcall function 00CABFA4: _wcscpy.LIBCMT ref: 00CAC096
Part of subcall function 00CABFA4: _wcscat.LIBCMT ref: 00CAC0A9
Part of subcall function 00CABFA4: __wsplitpath.LIBCMT ref: 00CAC0CE
Part of subcall function 00CABFA4: _wcscat.LIBCMT ref: 00CAC0E4
Part of subcall function 00CABFA4: _wcscat.LIBCMT ref: 00CAC0F7

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00CAFA61

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: 24517c58fed2b19edd7991e9ecc09bb4dcd4e7d85e96f16dcd6b69ef404f5029
Instruction ID: d6dcba4ebbb89627c65fc37ef157e994463f2c77dae2f91d15dbbe2fb6579ef3
Opcode Fuzzy Hash: 24517c58fed2b19edd7991e9ecc09bb4dcd4e7d85e96f16dcd6b69ef404f5029
Instruction Fuzzy Hash: 2491C072504305AFDB20EF50C891E9AB3E8FF95318F04482DF959972A1DB30EA49DB96

Function 00CABFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CABDB4: __time64.LIBCMT ref: 00CABDBE

Part of subcall function 00C64517: _fseek.LIBCMT ref: 00C6452F

__wsplitpath.LIBCMT ref: 00CAC083

Part of subcall function 00C81DFC: __wsplitpath_helper.LIBCMT ref: 00C81E3C

_wcscpy.LIBCMT ref: 00CAC096
_wcscat.LIBCMT ref: 00CAC0A9
__wsplitpath.LIBCMT ref: 00CAC0CE
_wcscat.LIBCMT ref: 00CAC0E4
_wcscat.LIBCMT ref: 00CAC0F7
_wcscmp.LIBCMT ref: 00CAC03E

Part of subcall function 00CAC56D: _wcscmp.LIBCMT ref: 00CAC65D
Part of subcall function 00CAC56D: _wcscmp.LIBCMT ref: 00CAC670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CAC2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CAC338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CAC34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CAC35F
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CAC371

Strings

p1Wu`KXu, xrefs: 00CAC2A1, 00CAC338, 00CAC35F, 00CAC371

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID: p1Wu`KXu
API String ID: 2378138488-4063981602
Opcode ID: f673e5a2212a2006c81c7126b8ba9036817fe638647e08cbfe938e11664acea0
Instruction ID: da1e89a97a213b5efcfe1de7770f0b8596d14e440aa4b25fa5c71271118e3883
Opcode Fuzzy Hash: f673e5a2212a2006c81c7126b8ba9036817fe638647e08cbfe938e11664acea0
Instruction Fuzzy Hash: FDC14CB1E00219AFDF25DF95CC81EEEB7BDAF49314F0080AAF609E6151DB709A449F61

Function 00C63F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C63F86
RegisterClassExW.USER32(00000030), ref: 00C63FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C63FC1
InitCommonControlsEx.COMCTL32(?), ref: 00C63FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C63FEE
LoadIconW.USER32(000000A9), ref: 00C64004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C64013

Strings

TaskbarCreated, xrefs: 00C63FB6
AutoIt v3 GUI, xrefs: 00C63FA2
+, xrefs: 00C63F6F
0, xrefs: 00C63F68

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: f1be79d7164ca93a1d606ae681263ff2490a8f0a3912e030241e9195f8db9156
Instruction ID: 68e54b7088613394ddd84ed1af7b871761e1cc5367c31ae7d3382c3b93b64cb3
Opcode Fuzzy Hash: f1be79d7164ca93a1d606ae681263ff2490a8f0a3912e030241e9195f8db9156
Instruction Fuzzy Hash: 8521F9B5900348AFDB10DFA4E889BCDBBB4FB28701F00821AF615EA3A0D7B105458FA1

Function 00C63742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00C637B3
KillTimer.USER32(?,00000001), ref: 00C637DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C63800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C6380B
CreatePopupMenu.USER32 ref: 00C6381F
PostQuitMessage.USER32(00000000), ref: 00C6382E

Strings

TaskbarCreated, xrefs: 00C63806

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 699faebacda03f8e01d424a7863c722b17dd53d3451f4a84f65b497bc3cfb7cb
Instruction ID: c89ee3c24bc6d360bf4ba963e8e81ea2b4de5694ff983d70c490b7abe95d3b31
Opcode Fuzzy Hash: 699faebacda03f8e01d424a7863c722b17dd53d3451f4a84f65b497bc3cfb7cb
Instruction Fuzzy Hash: B64129F52042DAABDB345F68EECAF793699FB64300F044129FA12D62D1CB609F509772

Function 00C63E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C63E79
LoadCursorW.USER32(00000000,00007F00), ref: 00C63E88
LoadIconW.USER32(00000063), ref: 00C63E9E
LoadIconW.USER32(000000A4), ref: 00C63EB0
LoadIconW.USER32(000000A2), ref: 00C63EC2

Part of subcall function 00C64024: LoadImageW.USER32(00C60000,00000063,00000001,00000010,00000010,00000000), ref: 00C64048

RegisterClassExW.USER32(?), ref: 00C63F30

Part of subcall function 00C63F53: GetSysColorBrush.USER32(0000000F), ref: 00C63F86
Part of subcall function 00C63F53: RegisterClassExW.USER32(00000030), ref: 00C63FB0
Part of subcall function 00C63F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C63FC1
Part of subcall function 00C63F53: InitCommonControlsEx.COMCTL32(?), ref: 00C63FDE
Part of subcall function 00C63F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C63FEE
Part of subcall function 00C63F53: LoadIconW.USER32(000000A9), ref: 00C64004
Part of subcall function 00C63F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C64013

Strings

0, xrefs: 00C63F02
AutoIt v3, xrefs: 00C63F1F
#, xrefs: 00C63F09

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 20ac501942a81bffc960404968559f3539318d6512d9657e45f672efb1466cd7
Instruction ID: 454709e282ac62c7a93e8f7b5541754b0d889923a7e62ad6b62099487ae7abff
Opcode Fuzzy Hash: 20ac501942a81bffc960404968559f3539318d6512d9657e45f672efb1466cd7
Instruction Fuzzy Hash: 02215CB4D00344ABCB21DFA9ED86B9DBBF5EB68310F00812AE215E63A0D37146518FA5

Function 00C8ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00C8ACC1

Part of subcall function 00C87CF4: __mtinitlocknum.LIBCMT ref: 00C87D06
Part of subcall function 00C87CF4: EnterCriticalSection.KERNEL32(00000000,?,00C87ADD,0000000D), ref: 00C87D1F

__calloc_crt.LIBCMT ref: 00C8ACD2

Part of subcall function 00C86986: __calloc_impl.LIBCMT ref: 00C86995
Part of subcall function 00C86986: Sleep.KERNEL32(00000000,000003BC,00C7F507,?,0000000E), ref: 00C869AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 00C8ACED
GetStartupInfoW.KERNEL32(?,00D16E28,00000064,00C85E91,00D16C70,00000014), ref: 00C8AD46
__calloc_crt.LIBCMT ref: 00C8AD91
GetFileType.KERNEL32(00000001), ref: 00C8ADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00C8AE11

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: c3cccec0c8e71d7977ae7821981c3d8724b99a52fdae9d16bab177707d8d50cc
Instruction ID: edd5481c25f9c74ea312ea2e2cad217cdc78c1b30a0c833c20ba168862da1b31
Opcode Fuzzy Hash: c3cccec0c8e71d7977ae7821981c3d8724b99a52fdae9d16bab177707d8d50cc
Instruction Fuzzy Hash: 7481E5709053558FEB24DF68C8806ADBBF0AF05328B24465EE4B6EB3D1D7349943CB5A

Function 0174E228 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0174E2F9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0174E51F

Memory Dump Source

Source File: 00000000.00000002.1448622572.000000000174B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0174B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_174b000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: f918ae73715d444e9eba1970805cddf99ae399bcb570f20c6b6630f1463b2258
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: 0CA11B70E00209EBDB14CFA8C894BEEFBB5BF48314F108599E615BB281DB799A41CF55

Function 00C649FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00C64A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00CD41DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00CD421A
RegCloseKey.ADVAPI32(?), ref: 00CD4249

Strings

Include, xrefs: 00CD41D3, 00CD4212
Software\AutoIt v3\AutoIt, xrefs: 00C64A13

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 9e6efd8eaf4208aba4074412fa8c59a0d98d323dfed32ffa797700c07ccf247a
Instruction ID: 2497ab5652ed1f2ba3f798782e5cac81b55c646a03f2f4a38d38c22a0496b0c9
Opcode Fuzzy Hash: 9e6efd8eaf4208aba4074412fa8c59a0d98d323dfed32ffa797700c07ccf247a
Instruction Fuzzy Hash: E4112E71600109BFDB14ABA4CDC6EBF7BBCEF04344F044069B606D6191EA705E41E650

Function 00C636B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C636E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C63707
ShowWindow.USER32(00000000,?,?,?,?,00C63AA3,?), ref: 00C6371B
ShowWindow.USER32(00000000,?,?,?,?,00C63AA3,?), ref: 00C63724

Strings

AutoIt v3, xrefs: 00C636DE, 00C636E3, 00C636E4
edit, xrefs: 00C63701

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 77e87f71a739f5fc781d048c03fab19eaa81934875ea06309f2a499233da81a7
Instruction ID: 5be6958c61a0100c7d85e6fb3b7134b99dc65d920f303ae7a27aad0ca62f1b11
Opcode Fuzzy Hash: 77e87f71a739f5fc781d048c03fab19eaa81934875ea06309f2a499233da81a7
Instruction Fuzzy Hash: 77F03A785403D47AE7305757AD48F7B3E7EE7E6F60B00802ABA05E62A0C1610882DAB5

Function 0174DFE8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0174DED8: Sleep.KERNELBASE(000001F4), ref: 0174DEE9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0174E117

Strings

A3AZBX5LPYA40W31D79WAHKJ, xrefs: 0174E17A, 0174E17D

Memory Dump Source

Source File: 00000000.00000002.1448622572.000000000174B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0174B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_174b000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateFileSleep
String ID: A3AZBX5LPYA40W31D79WAHKJ
API String ID: 2694422964-1083511814
Opcode ID: f9826bd0732d524f9dfa665fe6488b6d881ec4840b304714970c68df931f75c6
Instruction ID: 942db87ce8f4fd71765ef083a84fea9051262475960c806d0cb743064bbdb0af
Opcode Fuzzy Hash: f9826bd0732d524f9dfa665fe6488b6d881ec4840b304714970c68df931f75c6
Instruction Fuzzy Hash: F3518270D44289DBEF11D7A4C858BEEFBB4AF15304F044199E6087B2C1D7B91B49CB65

Function 00C651AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C6522F
_wcscpy.LIBCMT ref: 00C65283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00C65293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00CD3CB0

Strings

Line: , xrefs: 00CD3CD9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: ae27ae4877c83865375a2320364a5f08ff73c65e657435a8a0619f49508786ed
Instruction ID: d7b925102efbaa72376e13859f2e4357e9a1b059a0f9798204fd86ee51457721
Opcode Fuzzy Hash: ae27ae4877c83865375a2320364a5f08ff73c65e657435a8a0619f49508786ed
Instruction Fuzzy Hash: C431E275508340AFC331EB60EC82FDF77D8AFA4300F10851EF59992191EB70A649DBA6

Function 00C64139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 00C641A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00C639FE,?,00000001), ref: 00C641DB

_free.LIBCMT ref: 00CD36B7
_free.LIBCMT ref: 00CD36FE

Part of subcall function 00C6C833: __wsplitpath.LIBCMT ref: 00C6C93E
Part of subcall function 00C6C833: _wcscpy.LIBCMT ref: 00C6C953
Part of subcall function 00C6C833: _wcscat.LIBCMT ref: 00C6C968
Part of subcall function 00C6C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00C6C978

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00CD3491
Bad directive syntax error, xrefs: 00CD36E4

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: 1c107864b5488bfd3b513b930c5ca0b7a8453a879b4eb629f2cfa3db7978355f
Instruction ID: 47704b4aa22f2c34246bb0a62185abfd51ca5002de39966023f7927d343ca1b2
Opcode Fuzzy Hash: 1c107864b5488bfd3b513b930c5ca0b7a8453a879b4eb629f2cfa3db7978355f
Instruction Fuzzy Hash: 3E919F71910259EFCF14EFA4CC919EEB7B4BF09310F10402AF926AB291EB30EA45DB51

Function 00C64A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C65374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00D21148,?,00C661FF,?,00000000,00000001,00000000), ref: 00C65392

Part of subcall function 00C649FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00C64A1D

_wcscat.LIBCMT ref: 00CD2D80
_wcscat.LIBCMT ref: 00CD2DB5

Strings

\Include\, xrefs: 00C64B0A
\, xrefs: 00CD2DA2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: \$\Include\
API String ID: 3592542968-2640467822
Opcode ID: ada45832573dd619dacc9f7ba12ee9e421ffb9aa0be94f50abce7217f2290f03
Instruction ID: b8b5083a07d4fe9fd296595d6edc1bcc62ed36b9bd1f6188655cd636fde951f9
Opcode Fuzzy Hash: ada45832573dd619dacc9f7ba12ee9e421ffb9aa0be94f50abce7217f2290f03
Instruction Fuzzy Hash: DC514072404340ABC725EF55E9C2CBAB7F4BFA9300B40452EF689D3361DB709619DB66

Function 00C834AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 00C834FE

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00C83539
__wopenfile.LIBCMT ref: 00C83549

Strings

<G, xrefs: 00C834CD, 00C834F0, 00C834FC

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 10ac42de5769374f18ef02b76d1fa3bbd0d9a49655c2163706e96f277908c0e9
Instruction ID: 54034715e0e1bbe3b1185b28d580b702568aab0211738ee6cc59d551a691dcff
Opcode Fuzzy Hash: 10ac42de5769374f18ef02b76d1fa3bbd0d9a49655c2163706e96f277908c0e9
Instruction Fuzzy Hash: 96115C71A002069FDB22BF749C4266F3AA0AF85B5CB158525F414C7181FB70CB01B7B9

Function 00C7D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00C7D28B,SwapMouseButtons,00000004,?), ref: 00C7D2BC
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00C7D28B,SwapMouseButtons,00000004,?,?,?,?,00C7C865), ref: 00C7D2DD
RegCloseKey.KERNELBASE(00000000,?,?,00C7D28B,SwapMouseButtons,00000004,?,?,?,?,00C7C865), ref: 00C7D2FF

Strings

Control Panel\Mouse, xrefs: 00C7D2BA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: ddd7d6fe889aaae76396525aa80d6bb55161939cabd1f54e8e64fed2f2cb9685
Instruction ID: a1c03f46c0db0b7c39a88631e76931f53b5203138bf4ba20ab97042c0003d616
Opcode Fuzzy Hash: ddd7d6fe889aaae76396525aa80d6bb55161939cabd1f54e8e64fed2f2cb9685
Instruction Fuzzy Hash: 41113C75611608BFDB108FA8CC84EAF7BB8EF44754F108469E80AD7120D6319E419B61

Function 0174CED8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0174D705
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0174D729
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0174D74B

Memory Dump Source

Source File: 00000000.00000002.1448622572.000000000174B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0174B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_174b000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction ID: e83ed97750fd40c097bddb75c6d98b4ee55b1b4eadce74be9be6573ad355b430
Opcode Fuzzy Hash: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction Fuzzy Hash: 38620B30A14258DBEB24CFA4C844BDEB776EF68300F1091A9D14DEB394E7799E81CB59

Function 00C8365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C836B7
_memcpy_s.LIBCMT ref: 00C83729
__filbuf.LIBCMT ref: 00C837AA
_memset.LIBCMT ref: 00C837EE

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: d7547ae4b5f1c56b327a652b7bf29779f9694ae72bfb15d03fe290986c773e12
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: 5951A7B0A00385ABDB24BF69C98456E77B1BF40B28F249729F835972D0E774DF509B48

Function 00CAC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00C64517: _fseek.LIBCMT ref: 00C6452F

Part of subcall function 00CAC56D: _wcscmp.LIBCMT ref: 00CAC65D
Part of subcall function 00CAC56D: _wcscmp.LIBCMT ref: 00CAC670

_free.LIBCMT ref: 00CAC4DD
_free.LIBCMT ref: 00CAC4E4
_free.LIBCMT ref: 00CAC54F

Part of subcall function 00C81C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00C87A85), ref: 00C81CB1
Part of subcall function 00C81C9D: GetLastError.KERNEL32(00000000,?,00C87A85), ref: 00C81CC3

_free.LIBCMT ref: 00CAC557

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction ID: b125b31731ddfe972e9784b60a5841f5ebc8568ae919f7e84320ffea765777dd
Opcode Fuzzy Hash: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction Fuzzy Hash: E1515DB1904219AFDF249F64DC81BAEBBB9EF48304F1040AEF619A7241DB715E809F58

Function 00C7EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C7EBB2

Part of subcall function 00C651AF: _memset.LIBCMT ref: 00C6522F
Part of subcall function 00C651AF: _wcscpy.LIBCMT ref: 00C65283
Part of subcall function 00C651AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00C65293

KillTimer.USER32(?,00000001,?,?), ref: 00C7EC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C7EC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00CD3C88

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 749c1b0644cbd2dfa90b4ce98237ddbf2f445799751e9c8f7247914094e06402
Instruction ID: 17444e33e5d5eb02495eefc06c1dc8c733f98e6b28d8c6b64be58196f41a7e78
Opcode Fuzzy Hash: 749c1b0644cbd2dfa90b4ce98237ddbf2f445799751e9c8f7247914094e06402
Instruction Fuzzy Hash: DD21D7755047C49FE7339B288C59BEBBBEC9B55308F04449EE79E66281C3742B848B52

Function 00C640E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD3725
GetOpenFileNameW.COMDLG32 ref: 00CD376F

Part of subcall function 00C6660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C653B1,?,?,00C661FF,?,00000000,00000001,00000000), ref: 00C6662F

Part of subcall function 00C640A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00C640C6

Strings

X, xrefs: 00CD373E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 9c2c676f1853e2228dedfaf93ce9880788cd0fba5c846795bbc4b83f209f3098
Instruction ID: 9fa9f4b065430ee29c4e856fedb6663976a6b19f2f9e5c935e535bdf79a787b4
Opcode Fuzzy Hash: 9c2c676f1853e2228dedfaf93ce9880788cd0fba5c846795bbc4b83f209f3098
Instruction Fuzzy Hash: F521D571A00298ABCB15EFD4D8457DEBBF99F49304F00401AE505E7241DFB49A899F65

Function 00CAC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00CAC72F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00CAC746

Strings

aut, xrefs: 00CAC740

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 0469b53588f92b77c42873a509cee09bbba961d9537575c4407cd0b9501192fb
Instruction ID: 8fad3855b09160e2c61fcdc141ec15e14d85ab2274dadba8a6f07ff887d61799
Opcode Fuzzy Hash: 0469b53588f92b77c42873a509cee09bbba961d9537575c4407cd0b9501192fb
Instruction Fuzzy Hash: E2D05E7150030EBFDB10AB90EC4EFCE776C9704704F0001A07751A90B1DAB0EA998B64

Function 00CBF8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334539060fe5c9d2d5ae47f4cd9afc8532c14572aaf5ac223d5c1d30e49fcf14
Instruction ID: 4ea7e9819f472e0f860d28cb8c78c927ffd04350eb79f386a806281a5d041edc
Opcode Fuzzy Hash: 334539060fe5c9d2d5ae47f4cd9afc8532c14572aaf5ac223d5c1d30e49fcf14
Instruction Fuzzy Hash: F1F148716043019FDB10DF24C885B9ABBE5FF88314F14896DF9A99B392D770E946CB82

Function 00C64FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C65022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C650CB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: be63a7f1abe3db7da56f6d0bb28d8f063e6172002542c79a99e379232321c4c0
Instruction ID: 8c8fb0fb8ca528d9c468331f6610f858657d70c5ceaff9e0c7c610e058fd29d4
Opcode Fuzzy Hash: be63a7f1abe3db7da56f6d0bb28d8f063e6172002542c79a99e379232321c4c0
Instruction Fuzzy Hash: 17318EB5504701CFC731DF24D88569BBBE4FF59308F10092EE6AAC6341E771AA44CBA2

Function 00C8395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00C83973

Part of subcall function 00C881C2: __NMSG_WRITE.LIBCMT ref: 00C881E9
Part of subcall function 00C881C2: __NMSG_WRITE.LIBCMT ref: 00C881F3

__NMSG_WRITE.LIBCMT ref: 00C8397A

Part of subcall function 00C8821F: GetModuleFileNameW.KERNEL32(00000000,00D20312,00000104,00000000,00000001,00000000), ref: 00C882B1
Part of subcall function 00C8821F: ___crtMessageBoxW.LIBCMT ref: 00C8835F

Part of subcall function 00C81145: ___crtCorExitProcess.LIBCMT ref: 00C8114B
Part of subcall function 00C81145: ExitProcess.KERNEL32 ref: 00C81154

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

RtlAllocateHeap.NTDLL(01510000,00000000,00000001,00000001,00000000,?,?,00C7F507,?,0000000E), ref: 00C8399F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 2f863499626df0c26de147ddc52a8f19540a10a8efe23de8ffa2deb77bdba63a
Instruction ID: 15249ae300ab8b9e398f753ad504908bb1d5728aaedd2a2e685e9c5067513096
Opcode Fuzzy Hash: 2f863499626df0c26de147ddc52a8f19540a10a8efe23de8ffa2deb77bdba63a
Instruction Fuzzy Hash: 3F01F5313453819AE6223B25DC46B2E338C9F81B2CF251125F916DB292EFF0DE4197AC

Function 00CAC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00CAC385,?,?,?,?,?,00000004), ref: 00CAC6F2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00CAC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00CAC708
CloseHandle.KERNEL32(00000000,?,00CAC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CAC70F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: f6f6cfefabd54a675d3ecd0c2e343e79b4c0c06cc026be579acfcc67bfbff9f3
Instruction ID: 4d1f54ae05497a304fc94ac5a48c9ac89df48c4842aab20e937cebc042002d46
Opcode Fuzzy Hash: f6f6cfefabd54a675d3ecd0c2e343e79b4c0c06cc026be579acfcc67bfbff9f3
Instruction Fuzzy Hash: 33E08632140214BBDB211B54AC49FCE7B28AB05770F104110FB257D0F097B226118798

Function 00CABB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CABB72

Part of subcall function 00C81C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00C87A85), ref: 00C81CB1
Part of subcall function 00C81C9D: GetLastError.KERNEL32(00000000,?,00C87A85), ref: 00C81CC3

_free.LIBCMT ref: 00CABB83
_free.LIBCMT ref: 00CABB95

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction ID: 1e9e46017321cecee9af1dd2987fd6e90ae0790e0660204aaa945d80a22ab60b
Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction Fuzzy Hash: 1BE012A164174287DA2475797E48EB313CC4F05359718081DB86AE7147CF24FD4196B8

Function 00C62322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00C622A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00C624F1), ref: 00C62303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00C625A1
CoInitialize.OLE32(00000000), ref: 00C62618
CloseHandle.KERNEL32(00000000), ref: 00CD503A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: 0560cbd261e1717cc6b22241c6cf9d17ca55201b24c13e8a8280b590db851149
Instruction ID: 010856825fd099fb0fb61b8a2d444c5152261a7cefac59ad041ea6fa8a1fa5d3
Opcode Fuzzy Hash: 0560cbd261e1717cc6b22241c6cf9d17ca55201b24c13e8a8280b590db851149
Instruction Fuzzy Hash: B171C0BC901385DA8334EF5AB892559BBA5FBB9344790C26EE11AC7371CB304416CF39

Function 00C6B470 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

J, xrefs: 00C6B597

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 7268112bdd80f94471ffec5aa69dae9adf3c01f68ee3cb0ded10659e11f094f6
Instruction ID: 48d8f756d36bc25bb1067edc1480c6b50ad87bf04e57ce2125390f298ddbd3ad
Opcode Fuzzy Hash: 7268112bdd80f94471ffec5aa69dae9adf3c01f68ee3cb0ded10659e11f094f6
Instruction Fuzzy Hash: E8C14A719001099BCF34EF99C8D1AFEB7B9AF44310F144126EA66E7291DB309EC2DB95

Function 00CABBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00CABC18

Strings

EA06, xrefs: 00CABC46

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 503f31680ec5d49844fa2347bd4231937c0a5622b360669697997990c3c97702
Instruction ID: 82f311a65678edf89fcb77f461158f51955cb406766f87fe21d328586dc62727
Opcode Fuzzy Hash: 503f31680ec5d49844fa2347bd4231937c0a5622b360669697997990c3c97702
Instruction Fuzzy Hash: B801F5729042587EDB28D7A8C816FEEBBF89B05309F00459BF192D6181E9B4A7089B60

Function 00C63A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00C63A73

Part of subcall function 00C81405: __lock.LIBCMT ref: 00C8140B

Part of subcall function 00C63ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00C63AF3
Part of subcall function 00C63ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00C63B08

Part of subcall function 00C63D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00C63AA3,?), ref: 00C63D45
Part of subcall function 00C63D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00C63AA3,?), ref: 00C63D57
Part of subcall function 00C63D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00D21148,00D21130,?,?,?,?,00C63AA3,?), ref: 00C63DC8
Part of subcall function 00C63D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00C63AA3,?), ref: 00C63E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00C63AB3

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: cdd26f699ec2f6d8921fdbf45abc3f741c5611c140c876b010b2626f4e7300e0
Instruction ID: ce50cf673b4cd7b30f1f7e536bb1d797fcc15add33e8f6c37bfb5c2daf67c2da
Opcode Fuzzy Hash: cdd26f699ec2f6d8921fdbf45abc3f741c5611c140c876b010b2626f4e7300e0
Instruction Fuzzy Hash: 1011AE715083409BD311EF65E94591ABBE8EBA4310F00891EF485C72A1DB708652DBA2

Function 00C8E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00C8EA29
__close_nolock.LIBCMT ref: 00C8EA42

Part of subcall function 00C87BDA: __getptd_noexit.LIBCMT ref: 00C87BDA

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: 8345e0bef193f6b7a470855307ee13566a522858cdea77f8f5225039651a805f
Instruction ID: c5522a5c765e0b4879292efa82113aead7fd72541afb960725eac94f44691da3
Opcode Fuzzy Hash: 8345e0bef193f6b7a470855307ee13566a522858cdea77f8f5225039651a805f
Instruction Fuzzy Hash: A511C2728056109FD316BF68D8413A83E616F8273DF2A4340E4705F2E3DBB49941BBAD

Function 00C7F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00C8395C: __FF_MSGBANNER.LIBCMT ref: 00C83973
Part of subcall function 00C8395C: __NMSG_WRITE.LIBCMT ref: 00C8397A
Part of subcall function 00C8395C: RtlAllocateHeap.NTDLL(01510000,00000000,00000001,00000001,00000000,?,?,00C7F507,?,0000000E), ref: 00C8399F

std::exception::exception.LIBCMT ref: 00C7F51E
__CxxThrowException@8.LIBCMT ref: 00C7F533

Part of subcall function 00C86805: RaiseException.KERNEL32(?,?,0000000E,00D16A30,?,?,?,00C7F538,0000000E,00D16A30,?,00000001), ref: 00C86856

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 5ed2163d8243306c3b2a223114805ef478ab173be268ffc6fe43f5a473468467
Instruction ID: a0732d8ef42932415a31549261aaefed1057aec67c8e41c02d6c41171f4b2ae7
Opcode Fuzzy Hash: 5ed2163d8243306c3b2a223114805ef478ab173be268ffc6fe43f5a473468467
Instruction Fuzzy Hash: 02F0FF7100024EA7DB01BFA9DC419DE77ECAF00318F608039F91992081DFB0D781A3AA

Function 00C83839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C83868
__lock_file.LIBCMT ref: 00C83889

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 65884da0c0117232f356fdb0736f5028454a07fe451d47ee70fb9d1e193413ce
Instruction ID: fa995237ce1d0ed30b7b93edd79d73e7fa4ad5e3b6c26681bd7d26e9beae75f7
Opcode Fuzzy Hash: 65884da0c0117232f356fdb0736f5028454a07fe451d47ee70fb9d1e193413ce
Instruction Fuzzy Hash: 47018471800249FBCF22BFA5CC0549E7B61BF80B28F15422AF824571A1D7318B61FB99

Function 00C835E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

__lock_file.LIBCMT ref: 00C83629

Part of subcall function 00C84E1C: __lock.LIBCMT ref: 00C84E3F

__fclose_nolock.LIBCMT ref: 00C83634

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 6767ae84e84444d0b869132f2e72c6aad0e8b667bd93a13c3adb872280c152a7
Instruction ID: a7aae1bb8258a802ddb76d261c0d70843c67ab75be6eddb1013d7efb0ee8460c
Opcode Fuzzy Hash: 6767ae84e84444d0b869132f2e72c6aad0e8b667bd93a13c3adb872280c152a7
Instruction Fuzzy Hash: 3BF0BB31801645AAD7117F69C80676E76A07F41B3CF258108F420AB2D1DB7C8701BB5D

Function 0174CED5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0174D705
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0174D729
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0174D74B

Memory Dump Source

Source File: 00000000.00000002.1448622572.000000000174B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0174B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_174b000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: 7c69d22b9442e8e8516a519401d91a480d4d01d2a86d1583da5a1cf52dfe401b
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: E012BD24A18658C7EB24DF64D8507DEB232EF68300F1094E9910DEB7A5E77A4F81CB5A

Function 00C82957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00C82A0B

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: 50c65eadd9446e42caa93e188e0e68f5a4cd28c726efe91d54b322b75c3a5e59
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: 9641B7717007069FDF2CAEA9C8885AE77A6EF44368F24853DE865C7244E770DE41AB48

Function 00C7ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00C7EDC7

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 335b8a8f5b4824836b66fc631ded8d367da0a786f78e84012ffba05460aad2e2
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7A31D272A001059FC728DF59C490A69FBA6FB69340B64C6E5E41DCB266DB30EEC1CB80

Function 00CC040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CC0519

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1a78ac05e2ed45b043cacc7da2a7d2f58ac184e615cbc0b50d7d42b37bcb4946
Instruction ID: c97d71696093f204ed3f3dab4c52eb55eea55b0796e5915dd20aa847cf82f645
Opcode Fuzzy Hash: 1a78ac05e2ed45b043cacc7da2a7d2f58ac184e615cbc0b50d7d42b37bcb4946
Instruction Fuzzy Hash: E4319A75204628CFCB01EF11C091B6E7BB0FF59320F20C44AEA995B386DB70A901EF86

Function 00C6C6A5 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000040,?,00000000,00000016,00000000,?,?,00C6B6ED,?,00000016,00CFDDB4,00000000,?,00000016,00CFDDB4,00000000), ref: 00C6C703

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 02d14085de866204d5bd959eebceb964c58d843d9fa13d2aaacdef0a5dd587f4
Instruction ID: abef7e7ffe1597cbfead75706e8ab47a79fb2ba7a3dced917017dbb27929f309
Opcode Fuzzy Hash: 02d14085de866204d5bd959eebceb964c58d843d9fa13d2aaacdef0a5dd587f4
Instruction Fuzzy Hash: 6F217B796001029BCF345F29C4C8ABD3765BB44B50B28013BFAE5573A1CF20AD959F66

Function 00CD9A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00CD9A80

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 22be9846e4f91f3d4f399bdb8363dc977ace22e44229767c824606162ad44d11
Instruction ID: 194d21f6d792f37c9c9be419a21ad924b5ac2ea7b2bb94024f9ebdccb6bd06ed
Opcode Fuzzy Hash: 22be9846e4f91f3d4f399bdb8363dc977ace22e44229767c824606162ad44d11
Instruction Fuzzy Hash: A8415B74504641CFDB24DF18C484B1ABBE1BF45304F2989ADE9AA4B362C372E946DF52

Function 00C8ED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: cd81724c224a436c23cac62a02fe6a4a5f59e50a7a6acadd567ddf6614d685e7
Instruction ID: 818e9a1b9482bd04aa74cfa3648e949c5bd2222aa115090c6d88d8f838161ad5
Opcode Fuzzy Hash: cd81724c224a436c23cac62a02fe6a4a5f59e50a7a6acadd567ddf6614d685e7
Instruction Fuzzy Hash: 8B216D728046009FD7227FA8C8453683AA16F4233EF260741E4704B2E2EBB4C945ABAD

Function 00C641A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C64214: FreeLibrary.KERNEL32(00000000,?), ref: 00C64247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00C639FE,?,00000001), ref: 00C641DB

Part of subcall function 00C64291: FreeLibrary.KERNEL32(00000000), ref: 00C642C4

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: fff3cf49bbdef3de5502160274f6a5221dc457067e6edf16c5f0574ec7dce536
Instruction ID: c45239822470818eb6618f6666d232954c62ecb835fa5d8a3011ef7f1695b93d
Opcode Fuzzy Hash: fff3cf49bbdef3de5502160274f6a5221dc457067e6edf16c5f0574ec7dce536
Instruction Fuzzy Hash: 6F110A31600306ABCB28FB71DC96F9E77A99F40704F208429F596A61D1DF70DE00AB60

Function 00CD9B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CD9B51

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: e5a87615fbe7f0b1f9c48f5a60a3234bb2e8f206d2490829b026061ac99314e4
Instruction ID: 5aabd223cef6545eed7d43f18ed6d3eedc0931ae3ee0247292e2759830a986e9
Opcode Fuzzy Hash: e5a87615fbe7f0b1f9c48f5a60a3234bb2e8f206d2490829b026061ac99314e4
Instruction Fuzzy Hash: 91212A70508701CFDB25DF64C484B1ABBE1BF84304F25896CEAAA47262D731E846DF53

Function 00C8AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00C8AFC0

Part of subcall function 00C87BDA: __getptd_noexit.LIBCMT ref: 00C87BDA

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: 5391021daa7ae703ea9b0180a2a53e4eafaa868b1b723ffbaa562eda5bae1d7b
Instruction ID: d81ac6c493e910b3de60d6c0738d0ffc619d77f598851266f609d676400538f3
Opcode Fuzzy Hash: 5391021daa7ae703ea9b0180a2a53e4eafaa868b1b723ffbaa562eda5bae1d7b
Instruction Fuzzy Hash: 7711BFB28046009FD7127FA4C84636E3A61AF4133EF2A4340E4344F2E2DBB48D41ABAD

Function 00C639DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction ID: d726f307ea16003b13f1e5464acad0d641766b30738cc06cebc7a69445988107
Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction Fuzzy Hash: BD013671500109AECF19EFE5C8D18EEBB74AF21344F108026F566971A6EA309B49EB60

Function 00C82AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00C82AED

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: aa9088adbe1e2d245c7ebf9b8c6a7d2fd62f7049a35b5bbc2fb0873619b878f6
Instruction ID: f9cb2d8f6156ccddaafcd8b3767dc025005bea690191c6d6ea774044e05cb0bb
Opcode Fuzzy Hash: aa9088adbe1e2d245c7ebf9b8c6a7d2fd62f7049a35b5bbc2fb0873619b878f6
Instruction Fuzzy Hash: 37F0C231500205ABDF25BF648C0A3DF36A5BF0072CF154415F4209B191D778CA52FB59

Function 00C64252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00C639FE,?,00000001), ref: 00C64286

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: afea7e8645a2e52a69bafedf42e2edd9401191db89ef357b80c747f67ab6a213
Instruction ID: efe9bc9a9aeeb0844581de1fc20fe79bcfe177fd87b8748db338cce9d92ef0b9
Opcode Fuzzy Hash: afea7e8645a2e52a69bafedf42e2edd9401191db89ef357b80c747f67ab6a213
Instruction Fuzzy Hash: 4AF039B1509742CFCB389F65D8E0856BBE4BF043293348A3EF1E686611C7329984DF50

Function 00C640A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00C640C6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 24038d099124c0802273adc482e0af41c50e663af12944fa10261cf031d1fbdc
Instruction ID: a3afb07e910c9383065773ec27a8827659c16ae275646518ea9d76a25e4dbd9f
Opcode Fuzzy Hash: 24038d099124c0802273adc482e0af41c50e663af12944fa10261cf031d1fbdc
Instruction Fuzzy Hash: 96E0C2366002245BC721A698CC86FEE77ADDF886A4F0900B5F909EB244DA64AD81A691

Function 00CABCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00CABD16

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: f0d660ffc060b25a2dd5a6ed739c9904c4df4dee158535af3015a5603a32ceed
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: CAE09AB0604B409BDB388A24D800BE373E0EB0A309F00081DF2AB83242EBA27C418B59

Function 0174DED8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 0174DEE9

Memory Dump Source

Source File: 00000000.00000002.1448622572.000000000174B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0174B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_174b000_New_Order_Inquiry.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: d5aa5bc239bed64622bbe2811975caa7211fd294dfd86bf4810058dc2ce32fa5
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: BBE0E67494410DDFDB10DFF4D54969D7BB4EF04301F100161FD01D2281D7309D508A62

Non-executed Functions

Function 00CCF7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 00CCF87D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00CCF8DC
GetWindowLongW.USER32(?,000000F0), ref: 00CCF919
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00CCF940
SendMessageW.USER32 ref: 00CCF966
_wcsncpy.LIBCMT ref: 00CCF9D2
GetKeyState.USER32(00000011), ref: 00CCF9F3
GetKeyState.USER32(00000009), ref: 00CCFA00
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00CCFA16
GetKeyState.USER32(00000010), ref: 00CCFA20
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00CCFA4F
SendMessageW.USER32 ref: 00CCFA72
SendMessageW.USER32(?,00001030,?,00CCE059), ref: 00CCFB6F
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 00CCFB85
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00CCFB96
SetCapture.USER32(?), ref: 00CCFB9F
ClientToScreen.USER32(?,?), ref: 00CCFC03
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00CCFC0F
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00CCFC29
ReleaseCapture.USER32 ref: 00CCFC34
GetCursorPos.USER32(?), ref: 00CCFC69
ScreenToClient.USER32(?,?), ref: 00CCFC76
SendMessageW.USER32(?,00001012,00000000,?), ref: 00CCFCD8
SendMessageW.USER32 ref: 00CCFD02
SendMessageW.USER32(?,00001111,00000000,?), ref: 00CCFD41
SendMessageW.USER32 ref: 00CCFD6C
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00CCFD84
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00CCFD8F
GetCursorPos.USER32(?), ref: 00CCFDB0
ScreenToClient.USER32(?,?), ref: 00CCFDBD
GetParent.USER32(?), ref: 00CCFDD9
SendMessageW.USER32(?,00001012,00000000,?), ref: 00CCFE3F
SendMessageW.USER32 ref: 00CCFE6F
ClientToScreen.USER32(?,?), ref: 00CCFEC5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00CCFEF1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00CCFF19
SendMessageW.USER32 ref: 00CCFF3C
ClientToScreen.USER32(?,?), ref: 00CCFF86
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00CCFFB6
GetWindowLongW.USER32(?,000000F0), ref: 00CD004B

Strings

@GUI_DRAGID, xrefs: 00CCFBCC
F, xrefs: 00CCFF42

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: ba5fd5815bf940c110dbbdff90a1646c28efa5e89a21bf6f72f0661e81d2281c
Instruction ID: ff2d9a15f1a1f31439f4da2bd1fbd4d291a5f0b60798bcb5252c1e3e8f2d5721
Opcode Fuzzy Hash: ba5fd5815bf940c110dbbdff90a1646c28efa5e89a21bf6f72f0661e81d2281c
Instruction Fuzzy Hash: 4032AA74604345AFDB20CF64C884FAABBAAFF49354F144A2EF665872A0C731DE46CB51

Function 00CCAACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00CCB1CD

Strings

%d/%02d/%02d, xrefs: 00CCAEFC

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: cccbd53a470624b34dff12d9d9f302e83593d435f6ec318094a0ef45b45651b6
Instruction ID: 681c0452abf10a81c17ff3c1c4b07af7eb17a2151a68b7766974496c1fa538a4
Opcode Fuzzy Hash: cccbd53a470624b34dff12d9d9f302e83593d435f6ec318094a0ef45b45651b6
Instruction Fuzzy Hash: CA12BD71500248ABEF258FA5CC8AFAE7BB8FF45314F14815DF92ADA290DB708E41CB51

Function 00C7EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 00C7EB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00CD3AEA
IsIconic.USER32(000000FF), ref: 00CD3AF3
ShowWindow.USER32(000000FF,00000009), ref: 00CD3B00
SetForegroundWindow.USER32(000000FF), ref: 00CD3B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00CD3B20
GetCurrentThreadId.KERNEL32 ref: 00CD3B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00CD3B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00CD3B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00CD3B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 00CD3B54
SetForegroundWindow.USER32(000000FF), ref: 00CD3B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CD3B6C
keybd_event.USER32(00000012,00000000), ref: 00CD3B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CD3B81
keybd_event.USER32(00000012,00000000), ref: 00CD3B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CD3B8F
keybd_event.USER32(00000012,00000000), ref: 00CD3B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CD3B9E
keybd_event.USER32(00000012,00000000), ref: 00CD3BA3
SetForegroundWindow.USER32(000000FF), ref: 00CD3BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00CD3BCD

Strings

Shell_TrayWnd, xrefs: 00CD3AE5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 128fa789e34743f433ccda12ce11118fccc3d4bb5fc0ff3659912d58d5fe40ce
Instruction ID: c1407961328365cc34c7e32bfb4c5c6abdf8ef8f3955f82972088c28959124e1
Opcode Fuzzy Hash: 128fa789e34743f433ccda12ce11118fccc3d4bb5fc0ff3659912d58d5fe40ce
Instruction Fuzzy Hash: E43154B1A403587FEB215BA59C89F7F7E6CEB44B50F104017FB05EE2D1D6B19E00AAA1

Function 00C9ACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00C9B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C9B180
Part of subcall function 00C9B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C9B1AD
Part of subcall function 00C9B134: GetLastError.KERNEL32 ref: 00C9B1BA

_memset.LIBCMT ref: 00C9AD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00C9AD5A
CloseHandle.KERNEL32(?), ref: 00C9AD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00C9AD82
GetProcessWindowStation.USER32 ref: 00C9AD9B
SetProcessWindowStation.USER32(00000000), ref: 00C9ADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00C9ADBF

Part of subcall function 00C9AB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C9ACC0), ref: 00C9AB99
Part of subcall function 00C9AB84: CloseHandle.KERNEL32(?,?,00C9ACC0), ref: 00C9ABAB

Strings

default, xrefs: 00C9ADBA
, xrefs: 00C9AD17
winsta0, xrefs: 00C9AD7D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: da7baf9843028ed4dff82014a10f71f0e4c407563c41c04a75c3161fcfadcff8
Instruction ID: daffa79172fa970d7d789bf0cef2901e4e345e32aa9b4e0067e44accbad9208b
Opcode Fuzzy Hash: da7baf9843028ed4dff82014a10f71f0e4c407563c41c04a75c3161fcfadcff8
Instruction Fuzzy Hash: 56817D71800249BFDF11DFA4DC89AEE7BB9FF08304F144119F925A6161DB318E65DBA1

Function 00CA60DD Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CA5FA6,?), ref: 00CA6ED8

Part of subcall function 00CA6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CA5FA6,?), ref: 00CA6EF1

Part of subcall function 00CA725E: __wsplitpath.LIBCMT ref: 00CA727B
Part of subcall function 00CA725E: __wsplitpath.LIBCMT ref: 00CA728E

Part of subcall function 00CA72CB: GetFileAttributesW.KERNEL32(?,00CA6019), ref: 00CA72CC

_wcscat.LIBCMT ref: 00CA6149
_wcscat.LIBCMT ref: 00CA6167
__wsplitpath.LIBCMT ref: 00CA618E
FindFirstFileW.KERNEL32(?,?), ref: 00CA61A4
_wcscpy.LIBCMT ref: 00CA6209
_wcscat.LIBCMT ref: 00CA621C
_wcscat.LIBCMT ref: 00CA622F
lstrcmpiW.KERNEL32(?,?), ref: 00CA625D
DeleteFileW.KERNEL32(?), ref: 00CA626E
MoveFileW.KERNEL32(?,?), ref: 00CA6289
MoveFileW.KERNEL32(?,?), ref: 00CA6298
CopyFileW.KERNEL32(?,?,00000000), ref: 00CA62AD
DeleteFileW.KERNEL32(?), ref: 00CA62BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CA62E1
FindClose.KERNEL32(00000000), ref: 00CA62FD
FindClose.KERNEL32(00000000), ref: 00CA630B

Strings

\*.*, xrefs: 00CA6138, 00CA6147, 00CA6165
p1Wu`KXu, xrefs: 00CA61BA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*$p1Wu`KXu
API String ID: 1917200108-2866000061
Opcode ID: a7655724eb0c764aecb8debf40c18bc2baf8ed886d98c45b59397494db9824d1
Instruction ID: 489f67d796a4dce39eb9c4d103fe0c2c5d89b29e587e648293b279ba007ff9bd
Opcode Fuzzy Hash: a7655724eb0c764aecb8debf40c18bc2baf8ed886d98c45b59397494db9824d1
Instruction Fuzzy Hash: D851737280811DAACB21EBA1CC44EEF77BCAF05304F0901EAE595E3141DE729B49DFA4

Function 00CB6B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00CFDC00), ref: 00CB6B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 00CB6B44
GetClipboardData.USER32(0000000D), ref: 00CB6B4C
CloseClipboard.USER32 ref: 00CB6B58
GlobalLock.KERNEL32(00000000), ref: 00CB6B74
CloseClipboard.USER32 ref: 00CB6B7E
GlobalUnlock.KERNEL32(00000000), ref: 00CB6B93
IsClipboardFormatAvailable.USER32(00000001), ref: 00CB6BA0
GetClipboardData.USER32(00000001), ref: 00CB6BA8
GlobalLock.KERNEL32(00000000), ref: 00CB6BB5
GlobalUnlock.KERNEL32(00000000), ref: 00CB6BE9
CloseClipboard.USER32 ref: 00CB6CF6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 9c79c144d82e587c58bc64ade3d55eead501d35b5b5d585a04f89a027676ccc4
Instruction ID: 5a1b2554fd84acb70a1119fbeb48ee3f21fb2e598d445a5d8d7eda2e6cd3cb56
Opcode Fuzzy Hash: 9c79c144d82e587c58bc64ade3d55eead501d35b5b5d585a04f89a027676ccc4
Instruction Fuzzy Hash: AA519E71200341ABD310AF64DDD6FBE77B8AF94B01F000529F697DA1E1DF74D905AA62

Function 00CAF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CAF62B
FindClose.KERNEL32(00000000), ref: 00CAF67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CAF6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CAF6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CAF6E2
__swprintf.LIBCMT ref: 00CAF72E
__swprintf.LIBCMT ref: 00CAF767
__swprintf.LIBCMT ref: 00CAF7BB

Part of subcall function 00C8172B: __woutput_l.LIBCMT ref: 00C81784

__swprintf.LIBCMT ref: 00CAF809
__swprintf.LIBCMT ref: 00CAF858
__swprintf.LIBCMT ref: 00CAF8A7
__swprintf.LIBCMT ref: 00CAF8F6

Strings

%02d, xrefs: 00CAF7B0, 00CAF7B9, 00CAF807, 00CAF856, 00CAF8A5, 00CAF8F4
%4d%02d%02d%02d%02d%02d, xrefs: 00CAF728
%4d, xrefs: 00CAF761

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: c92733eaa9163318bde46043d95960528f74ace77aea3de7e80a2c6103932b95
Instruction ID: 1c5fb80fee98dc1821aa734b166e696cfb30f0fefb13acdaa10b02e83fdb3bad
Opcode Fuzzy Hash: c92733eaa9163318bde46043d95960528f74ace77aea3de7e80a2c6103932b95
Instruction Fuzzy Hash: 83A100B1408344ABD310EBA5C885DAFB7ECEF98704F44482DF695C7151EB34DA49D762

Function 00CB1B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 00CB1B50
_wcscmp.LIBCMT ref: 00CB1B65
_wcscmp.LIBCMT ref: 00CB1B7C
GetFileAttributesW.KERNEL32(?), ref: 00CB1B8E
SetFileAttributesW.KERNEL32(?,?), ref: 00CB1BA8
FindNextFileW.KERNEL32(00000000,?), ref: 00CB1BC0
FindClose.KERNEL32(00000000), ref: 00CB1BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 00CB1BE7
_wcscmp.LIBCMT ref: 00CB1C0E
_wcscmp.LIBCMT ref: 00CB1C25
SetCurrentDirectoryW.KERNEL32(?), ref: 00CB1C37
SetCurrentDirectoryW.KERNEL32(00D139FC), ref: 00CB1C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CB1C5F
FindClose.KERNEL32(00000000), ref: 00CB1C6C
FindClose.KERNEL32(00000000), ref: 00CB1C7C

Strings

*.*, xrefs: 00CB1BE2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 0d775499b4f125537b004f9b308093125fb6d6600a7f9afc73bf900f1e3aa23f
Instruction ID: 91c536ac60669e9296cec5849190b997a6f7ab1c619f892b4b5b1ac176a761c2
Opcode Fuzzy Hash: 0d775499b4f125537b004f9b308093125fb6d6600a7f9afc73bf900f1e3aa23f
Instruction Fuzzy Hash: DB31B3725002596FDF10AFA0EC99BEE7BAC9F05320F580195ED12E7090EB70DF858A64

Function 00CB1C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 00CB1CAB
_wcscmp.LIBCMT ref: 00CB1CC0
_wcscmp.LIBCMT ref: 00CB1CD7

Part of subcall function 00CA6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00CA6BEF

FindNextFileW.KERNEL32(00000000,?), ref: 00CB1D06
FindClose.KERNEL32(00000000), ref: 00CB1D11
FindFirstFileW.KERNEL32(*.*,?), ref: 00CB1D2D
_wcscmp.LIBCMT ref: 00CB1D54
_wcscmp.LIBCMT ref: 00CB1D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 00CB1D7D
SetCurrentDirectoryW.KERNEL32(00D139FC), ref: 00CB1D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CB1DA5
FindClose.KERNEL32(00000000), ref: 00CB1DB2
FindClose.KERNEL32(00000000), ref: 00CB1DC2

Strings

*.*, xrefs: 00CB1D28

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 1838e69a823d1c8957c8ec0c8ec9f69b43dbbec5c0e1d7bfffe8beadc8c763b7
Instruction ID: 7674b41dc813350eca3aea869901d59c8dd0147154c317d5bdfb07ea02bcb2e4
Opcode Fuzzy Hash: 1838e69a823d1c8957c8ec0c8ec9f69b43dbbec5c0e1d7bfffe8beadc8c763b7
Instruction Fuzzy Hash: FD31F23250061ABECF11AFB0EC59BEE3BAD9F05324F580561EC21A6090DB70DF859B64

Function 00CB091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00CB09DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CB09EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00CB09FB
__wsplitpath.LIBCMT ref: 00CB0A59
_wcscat.LIBCMT ref: 00CB0A71
_wcscat.LIBCMT ref: 00CB0A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00CB0A98
SetCurrentDirectoryW.KERNEL32(?), ref: 00CB0AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 00CB0ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 00CB0AFF
_wcscpy.LIBCMT ref: 00CB0B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00CB0B4A

Strings

*.*, xrefs: 00CB0B05

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 2ad5faf30c08218f6a3a8cf95621a13007ee47fc163804f079ccb5c3d45979d2
Instruction ID: 152599335386e9355c8d48874932d47552d8d93b2b0169d1db50ebd4c41e3850
Opcode Fuzzy Hash: 2ad5faf30c08218f6a3a8cf95621a13007ee47fc163804f079ccb5c3d45979d2
Instruction Fuzzy Hash: CC6159725043059FD710EF60C885AAFB3E8FF89314F14891AF99AD7251DB31EA49CB92

Function 00C9A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00C9ABD7
Part of subcall function 00C9ABBB: GetLastError.KERNEL32(?,00C9A69F,?,?,?), ref: 00C9ABE1
Part of subcall function 00C9ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00C9A69F,?,?,?), ref: 00C9ABF0
Part of subcall function 00C9ABBB: HeapAlloc.KERNEL32(00000000,?,00C9A69F,?,?,?), ref: 00C9ABF7
Part of subcall function 00C9ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00C9AC0E

Part of subcall function 00C9AC56: GetProcessHeap.KERNEL32(00000008,00C9A6B5,00000000,00000000,?,00C9A6B5,?), ref: 00C9AC62
Part of subcall function 00C9AC56: HeapAlloc.KERNEL32(00000000,?,00C9A6B5,?), ref: 00C9AC69
Part of subcall function 00C9AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00C9A6B5,?), ref: 00C9AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C9A6D0
_memset.LIBCMT ref: 00C9A6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C9A704
GetLengthSid.ADVAPI32(?), ref: 00C9A715
GetAce.ADVAPI32(?,00000000,?), ref: 00C9A752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C9A76E
GetLengthSid.ADVAPI32(?), ref: 00C9A78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00C9A79A
HeapAlloc.KERNEL32(00000000), ref: 00C9A7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C9A7C2
CopySid.ADVAPI32(00000000), ref: 00C9A7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C9A7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C9A820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C9A834

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: fc1cf954e908fa47825727125fa81a3a3b67ab50e04f37a1e7a71e9f7f2b0aa2
Instruction ID: 1d665fd643bd24fa2b1a0f1ba655133e715a9c729bc6755c35e96c5bb03ecf2d
Opcode Fuzzy Hash: fc1cf954e908fa47825727125fa81a3a3b67ab50e04f37a1e7a71e9f7f2b0aa2
Instruction Fuzzy Hash: C9514D71900249AFDF10DF95DC89EEEBBB9FF04300F048129F921AB290DB359A05CBA5

Function 00CA63F9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CA5FA6,?), ref: 00CA6ED8

Part of subcall function 00CA72CB: GetFileAttributesW.KERNEL32(?,00CA6019), ref: 00CA72CC

_wcscat.LIBCMT ref: 00CA6441
__wsplitpath.LIBCMT ref: 00CA645F
FindFirstFileW.KERNEL32(?,?), ref: 00CA6474
_wcscpy.LIBCMT ref: 00CA64A3
_wcscat.LIBCMT ref: 00CA64B8
_wcscat.LIBCMT ref: 00CA64CA
DeleteFileW.KERNEL32(?), ref: 00CA64DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CA64EB
FindClose.KERNEL32(00000000), ref: 00CA6506

Strings

\*.*, xrefs: 00CA643B
p1Wu`KXu, xrefs: 00CA64DA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*$p1Wu`KXu
API String ID: 2643075503-2866000061
Opcode ID: a4f2ebc14045dcabd3e0dfe451862cd171ddf995dc0d93372014dc6eccb11fd3
Instruction ID: 4024165cdf5f323122ddd0342504fefee91667bfdee6c6060d9415c4e4250119
Opcode Fuzzy Hash: a4f2ebc14045dcabd3e0dfe451862cd171ddf995dc0d93372014dc6eccb11fd3
Instruction Fuzzy Hash: 0031A2B2408385AEC321EFA48885ADF77ECAF56314F04092EF6D9C3141EA35D60D9767

Function 00C66F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

NO_START_OPT), xrefs: 00CE2CD1
BSR_ANYCRLF), xrefs: 00CE2EA0
UTF16), xrefs: 00CE2C56
NO_AUTO_POSSESS), xrefs: 00CE2CB0
LIMIT_MATCH=, xrefs: 00CE2CF2
BSR_UNICODE), xrefs: 00CE2EBA
LIMIT_RECURSION=, xrefs: 00CE2D7E
ANY), xrefs: 00CE2E60
ANYCRLF), xrefs: 00CE2E7D
LF), xrefs: 00CE2E26
CRLF), xrefs: 00CE2E43
CR), xrefs: 00CE2E09
UTF), xrefs: 00CE2C7C
UCP), xrefs: 00CE2C8F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 7cbb65a44754a54c1333bf6e6b0b2b450f881fd75a39597261dfd6d38278f60b
Instruction ID: 6b6e96d16a2acf6cd11f66033777349c74549fde897faf20affc7c48b9440ba4
Opcode Fuzzy Hash: 7cbb65a44754a54c1333bf6e6b0b2b450f881fd75a39597261dfd6d38278f60b
Instruction Fuzzy Hash: A5726071E04269DBDB24CF5AD8807AEB7B5BF48314F14456AE815EB380DB709E81DF90

Function 00CC31BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CC2BB5,?,?), ref: 00CC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CC328E

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00CC332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00CC33C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00CC3604
RegCloseKey.ADVAPI32(00000000), ref: 00CC3611

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: fd1a40307bd8c06ece420736639ff8a9d984032205641dd1d7ce2effc8037b7d
Instruction ID: 79579309005237a1fd58c12c3d745f5977cc6029098e58ebd0123e9ddcb715eb
Opcode Fuzzy Hash: fd1a40307bd8c06ece420736639ff8a9d984032205641dd1d7ce2effc8037b7d
Instruction Fuzzy Hash: 1AE16B31604240AFCB14DF29D995E2ABBE8EF89314F04C46DF45ADB2A1DB30EA05DB52

Function 00CA2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CA2B5F
GetAsyncKeyState.USER32(000000A0), ref: 00CA2BE0
GetKeyState.USER32(000000A0), ref: 00CA2BFB
GetAsyncKeyState.USER32(000000A1), ref: 00CA2C15
GetKeyState.USER32(000000A1), ref: 00CA2C2A
GetAsyncKeyState.USER32(00000011), ref: 00CA2C42
GetKeyState.USER32(00000011), ref: 00CA2C54
GetAsyncKeyState.USER32(00000012), ref: 00CA2C6C
GetKeyState.USER32(00000012), ref: 00CA2C7E
GetAsyncKeyState.USER32(0000005B), ref: 00CA2C96
GetKeyState.USER32(0000005B), ref: 00CA2CA8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6372e4af20dc24a8aa84b6396a124d44d333c11d61364cb0aa3c027d7c2697ae
Instruction ID: 78262370852a797145b4fff89d59abf4a24d12b78cbacbd3398af0117cb7ba63
Opcode Fuzzy Hash: 6372e4af20dc24a8aa84b6396a124d44d333c11d61364cb0aa3c027d7c2697ae
Instruction Fuzzy Hash: B94107706047DB6EFF349B6888443AABEA06F1332CF044049D9D75A2C1DB949BC4C7A2

Function 00CB6D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00CB6D2E
EmptyClipboard.USER32 ref: 00CB6D34
GlobalAlloc.KERNEL32(00000002,?), ref: 00CB6D49
CloseClipboard.USER32 ref: 00CB6DE8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 707075f7a23ca371af3a3ef8fda1384526eaf0220a88c41089c54cc9add8f7ce
Instruction ID: aa82b6742e0a9b93e74fb6044e57f249335e660f88e9fa3f2a4be81d204d4d79
Opcode Fuzzy Hash: 707075f7a23ca371af3a3ef8fda1384526eaf0220a88c41089c54cc9add8f7ce
Instruction Fuzzy Hash: 4721BD31300210AFEB11AF64ED89B6D77A8FF14710F04C41AF90ADB2A1CB38ED019B94

Function 00CBC18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00C99ABF: CLSIDFromProgID.OLE32 ref: 00C99ADC
Part of subcall function 00C99ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00C99AF7
Part of subcall function 00C99ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00C99B05
Part of subcall function 00C99ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00C99B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00CBC235
_memset.LIBCMT ref: 00CBC242
_memset.LIBCMT ref: 00CBC360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00CBC38C
CoTaskMemFree.OLE32(?), ref: 00CBC397

Strings

NULL Pointer assignment, xrefs: 00CBC3E5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 6b709118250302ca1820132f07ff1cb908fa55d5e9b02563313db70cb494fcff
Instruction ID: bb48442eb956fed7bf86bbaf97ad88f714db1b6c086806a0c4901d03ae6fcf73
Opcode Fuzzy Hash: 6b709118250302ca1820132f07ff1cb908fa55d5e9b02563313db70cb494fcff
Instruction Fuzzy Hash: F4913A71D00218EBDB20DF94DC95EEEBBB8EF08710F10812AF519A7291DB705A45DFA0

Function 00CA79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C9B180
Part of subcall function 00C9B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C9B1AD
Part of subcall function 00C9B134: GetLastError.KERNEL32 ref: 00C9B1BA

ExitWindowsEx.USER32(?,00000000), ref: 00CA7A0F

Strings

, xrefs: 00CA79FD
SeShutdownPrivilege, xrefs: 00CA79DD
@, xrefs: 00CA7A02

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 027d312d1e877f45052e13db7dbb97df50c47a3a0c0dc187c332f6f1f86e7a18
Instruction ID: e58d497ffbb3b2485486bbd0b7daa5eebe40441ed9a6797476122ec4ec4cafde
Opcode Fuzzy Hash: 027d312d1e877f45052e13db7dbb97df50c47a3a0c0dc187c332f6f1f86e7a18
Instruction Fuzzy Hash: 6301F7757582137EFB2817789C8ABBF3358FB02348F142624B923A20D2DA605F00A2B0

Function 00CB8C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00CB8CA8
WSAGetLastError.WSOCK32(00000000), ref: 00CB8CB7
bind.WSOCK32(00000000,?,00000010), ref: 00CB8CD3
listen.WSOCK32(00000000,00000005), ref: 00CB8CE2
WSAGetLastError.WSOCK32(00000000), ref: 00CB8CFC
closesocket.WSOCK32(00000000,00000000), ref: 00CB8D10

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 5bb9c20d9f0669792687fd9473dc7668fc459bb1cd25b6ed2511d16054296aad
Instruction ID: 2135b31598ac4e368f89bfd7b9b0f42a9116d91fba0cb50692af90ec9d422610
Opcode Fuzzy Hash: 5bb9c20d9f0669792687fd9473dc7668fc459bb1cd25b6ed2511d16054296aad
Instruction Fuzzy Hash: B221AD716002019FDB20AF68CD85BAEB7E9EF49324F108159F957AB2D2CB30AD45DB51

Function 00CA6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00CA6554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00CA6564
Process32NextW.KERNEL32(00000000,0000022C), ref: 00CA6583
__wsplitpath.LIBCMT ref: 00CA65A7
_wcscat.LIBCMT ref: 00CA65BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00CA65F9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: 9855b599546bc751615bccffd0f2c3d33bcfb9d5db0f61a783a8b704e4a1388d
Instruction ID: 154dd2a4d6ce9035b6f8d2268d0a86cd06639920d045cd18d3fbd6458e03c907
Opcode Fuzzy Hash: 9855b599546bc751615bccffd0f2c3d33bcfb9d5db0f61a783a8b704e4a1388d
Instruction Fuzzy Hash: 722162B1D00259ABDB10AFA4CC89BEEB7BCAB49314F5404A9E505E7141EB719F85CB60

Function 00CB923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00CBA84E

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00CB9296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 00CB92B9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: a88a542024d56aecf6d2f5a0fae9a2803ee25333aadd0d3b06073ea51c78e149
Instruction ID: 1a250a68d878eb4224713bc654f98d9e6451f636b8ecd80cc529da325eb21387
Opcode Fuzzy Hash: a88a542024d56aecf6d2f5a0fae9a2803ee25333aadd0d3b06073ea51c78e149
Instruction Fuzzy Hash: 43419270600204AFEB14AB68CC82F7E77EDEF44724F148558F95AAB3D2DB749D019B91

Function 00CAEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CAEB8A
_wcscmp.LIBCMT ref: 00CAEBBA
_wcscmp.LIBCMT ref: 00CAEBCF
FindNextFileW.KERNEL32(00000000,?), ref: 00CAEBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00CAEC0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 736f03cfff3fff4c62017ac435db6ca58b511b568b646c56f53715c29e474d85
Instruction ID: 6f3a6dd39c2e9cbb64fd9ba616e0564111afe0f5a7a03a8b61f5d492b54899df
Opcode Fuzzy Hash: 736f03cfff3fff4c62017ac435db6ca58b511b568b646c56f53715c29e474d85
Instruction Fuzzy Hash: DC41B0356043029FDB18DF28C4D1E99B7E4FF4A328F10855DE96A8B3A1DB31A941CB95

Function 00CC8111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00CC8160
IsWindowEnabled.USER32 ref: 00CC816E
GetForegroundWindow.USER32(?,?,00000001), ref: 00CC817B
IsIconic.USER32 ref: 00CC8189
IsZoomed.USER32 ref: 00CC8197

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 97ea8635135581b40c498266a266479a08dd3ed431588edfbd7aa8763844be1f
Instruction ID: c29dbd370465c9dc2c5450ba322dd0cacd22a954e7a92fa49be31f27c8df0731
Opcode Fuzzy Hash: 97ea8635135581b40c498266a266479a08dd3ed431588edfbd7aa8763844be1f
Instruction Fuzzy Hash: 3E116D313006116FE7216F26DC84F6FBBDDEF95760B09442DF85ADB281CF74AA0686A4

Function 00C69B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00C69E95
VUUU, xrefs: 00C69EA7
VUUU, xrefs: 00CEBE14
VUUU, xrefs: 00C69ED4
ERCP, xrefs: 00C69C32

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 2b224b6182a7edc1adb912e804ed2544bc9dd7684b52f41c16240cb682865ded
Instruction ID: fdb3e1cca82f03b3e8b7b36906d9a3c6d7afe7a21154c192e99a8d39a1f489be
Opcode Fuzzy Hash: 2b224b6182a7edc1adb912e804ed2544bc9dd7684b52f41c16240cb682865ded
Instruction Fuzzy Hash: 80926D71A0025ACBDF34CF59C8907BDB7B1FB54314F25819AE82AA7280D7719E82DF91

Function 00C7E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C7E014,75570AE0,00C7DEF1,00CFDC38,?,?), ref: 00C7E02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00C7E03E

Strings

GetNativeSystemInfo, xrefs: 00C7E038
kernel32.dll, xrefs: 00C7E027

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 04c8b211ddca7882f5902f3e61e54298ef62f5d31eb01c079a9fb132f4856f1c
Instruction ID: 66307f93f85a704b54e939046df9812cb4eb878e83acfecf65fa6ad9db85e8e8
Opcode Fuzzy Hash: 04c8b211ddca7882f5902f3e61e54298ef62f5d31eb01c079a9fb132f4856f1c
Instruction Fuzzy Hash: 86D0A731500712AFC7314F60FC4C7AA76E4AB06310F18845DF4A6D2150DBB4C8C48760

Function 00CA13CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00CA13DC

Strings

(, xrefs: 00CA1422
|, xrefs: 00CA140C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: af346ef7cea3a777a25528dd6ee37545883512666f9a5b28c4a118c0ffba92d6
Instruction ID: f39a84ff97c7b33b7300c76078828f995f0bab76ad4ee1a5e17e07789eb94424
Opcode Fuzzy Hash: af346ef7cea3a777a25528dd6ee37545883512666f9a5b28c4a118c0ffba92d6
Instruction Fuzzy Hash: F3321675A006069FC728CF69C48096AB7F0FF49324F15C56EE9AADB3A1D770E941CB44

Function 00C7B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 00C7B22F

Part of subcall function 00C7B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00C7B5A5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: 75aa04cd9a91c6bfb1f55457385edcc39ad1d920fddfed84230e953d30f0c62b
Instruction ID: f7a8f516217a5b1e58db2906a6ec66ef6289e05d2b900967daf8c8919ea86715
Opcode Fuzzy Hash: 75aa04cd9a91c6bfb1f55457385edcc39ad1d920fddfed84230e953d30f0c62b
Instruction Fuzzy Hash: EFA169B0115105BADB387F2B9C88FBF695DEF96344B10C11EF52ADA293DB149E01E272

Function 00CB4EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00CB43BF,00000000), ref: 00CB4FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00CB4FD2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: d7682e5422d30a09c8733a87bfe8cd51000de7cba53c9da27cf2a827062aa0ef
Instruction ID: 68c859ec8801de16b7e1dffaa964b40be32e87ef3cae9ada5dc9fc2fd93727aa
Opcode Fuzzy Hash: d7682e5422d30a09c8733a87bfe8cd51000de7cba53c9da27cf2a827062aa0ef
Instruction Fuzzy Hash: EA41D571508609BFEB249EC5DC85FFFB7BCEB40754F10402AF615A7182DA719E4196A0

Function 00CAE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CAE20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00CAE267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00CAE2B4

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: a3bce250fee6b709273897051b815a3ed9c7af5b4f011cf61ee7e401736e024b
Instruction ID: d50b10d761e2655b360bb4d5650c0fb7422149009357d15242a9892f69b5b7ad
Opcode Fuzzy Hash: a3bce250fee6b709273897051b815a3ed9c7af5b4f011cf61ee7e401736e024b
Instruction Fuzzy Hash: 15213A35A00218EFDB00EFA5D8C5AADBBF8FF49314F0584A9E946EB351DB319905DB50

Function 00C9B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00C7F4EA: std::exception::exception.LIBCMT ref: 00C7F51E
Part of subcall function 00C7F4EA: __CxxThrowException@8.LIBCMT ref: 00C7F533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C9B180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C9B1AD
GetLastError.KERNEL32 ref: 00C9B1BA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 1a2e94068ab63d60eb9052d764ba41da17d7a63122d3ad1a516fdd2f8e14f292
Instruction ID: b10f89e351deac3fa99a6c3f6c9c2b73363f3972def32fa1783585a5caf6960d
Opcode Fuzzy Hash: 1a2e94068ab63d60eb9052d764ba41da17d7a63122d3ad1a516fdd2f8e14f292
Instruction Fuzzy Hash: 5D118FB2504205BFE7189F54EDC5E2FB7BDEB44710B20852EE45A97250DB70FC428A60

Function 00CA6685 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CA66AF
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00CA66EC
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CA66F5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 036c345a69b6eebdbfd84b21728b60d6ee72bfdfdbd470b3214bb1636adb562c
Instruction ID: 072df5353398b9cc029663d8f8677a1c5c341f8f62406f5afe7bb2c28dad995b
Opcode Fuzzy Hash: 036c345a69b6eebdbfd84b21728b60d6ee72bfdfdbd470b3214bb1636adb562c
Instruction Fuzzy Hash: 0D11C4B2911229BFE7118BA8DC45FBFBBBCEB09718F004556F911E7190C2B49E0487A1

Function 00CA71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00CA7223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00CA723A
FreeSid.ADVAPI32(?), ref: 00CA724A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8b161e333f6fa98e72b9676143cee5615527e7f062f718677dd95fec85e732cf
Instruction ID: 9c69bcee971b92c2a1b04cf9c7ffc10cd97317ce481207e4b352cb6a71542e3e
Opcode Fuzzy Hash: 8b161e333f6fa98e72b9676143cee5615527e7f062f718677dd95fec85e732cf
Instruction Fuzzy Hash: C0F01776A04209FFDF04DFE4DD89BEEBBBCFF08205F104869B612E6591E2749A448B10

Function 00CAF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CAF599
FindClose.KERNEL32(00000000), ref: 00CAF5C9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: aa002e916b38c0629199df0b3f5eafe875f517baff51d0de06513b672f9c9d18
Instruction ID: 069a9ac1b2281fe6a2d55f411f310d495332156d29029be4e2f43f9e76eefc1e
Opcode Fuzzy Hash: aa002e916b38c0629199df0b3f5eafe875f517baff51d0de06513b672f9c9d18
Instruction Fuzzy Hash: C11188716046019FD710DF69D845A2EB7E9FF95324F00C51EF869D7391DB34AD018B85

Function 00CACE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00CBBE6A,?,?,00000000,?), ref: 00CACEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00CBBE6A,?,?,00000000,?), ref: 00CACEB9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 4ef2449d64e498feedf8236d6fd64eadd01f3cc6a735f67cbddc8ed03b481a4a
Instruction ID: 522a2ac4fd6f16263e153498eb58baa8c0a8ff61011f2c5cfc7b0b2ea67658a6
Opcode Fuzzy Hash: 4ef2449d64e498feedf8236d6fd64eadd01f3cc6a735f67cbddc8ed03b481a4a
Instruction Fuzzy Hash: A9F08271100329ABDB20ABA4DC89FEA776DFF09355F008165F915D6191D6309A40CBA1

Function 00CA411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00CA4153
keybd_event.USER32(?,76C1C0D0,?,00000000), ref: 00CA4166

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 52638ec2c2645c81ac9608aa84f02ae9289e0e3459cb03cd422ad806353ecafc
Instruction ID: d7304adcdf96c23e513eccf8f118c85fdc101981badc1316a78c04e9fc3b3fbb
Opcode Fuzzy Hash: 52638ec2c2645c81ac9608aa84f02ae9289e0e3459cb03cd422ad806353ecafc
Instruction Fuzzy Hash: 09F06D7080038EAFDB058FA0C845BBE7BB0EF00309F008409F9669A191D7B986129FA0

Function 00C9AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C9ACC0), ref: 00C9AB99
CloseHandle.KERNEL32(?,?,00C9ACC0), ref: 00C9ABAB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 7ead2c4c0527ba7f15d22029bf3ab295f83b4cbe7fd45dcce01f1748daf94b6f
Instruction ID: e21f14433d449d0c9e6a92daac6b98d4357830d294c24ff3a97cd1abd9b41dc8
Opcode Fuzzy Hash: 7ead2c4c0527ba7f15d22029bf3ab295f83b4cbe7fd45dcce01f1748daf94b6f
Instruction Fuzzy Hash: 28E0E671000510AFE7662F54EC49E7777EAEF04320710C42DF45A85470D7625D91DB51

Function 00C881AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00C86DB3,-0000031A,?,?,00000001), ref: 00C881B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00C881BA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 209dd1981017b7e8955f203c336510c59f2abba5db86ede57e0210dc186e77d1
Instruction ID: 02c970475dfd73df735d852cc9d5318a92a6ead2312978121d3ba689984c8e7b
Opcode Fuzzy Hash: 209dd1981017b7e8955f203c336510c59f2abba5db86ede57e0210dc186e77d1
Instruction Fuzzy Hash: BEB09232044648ABDB002BA1EC49B5D7F78EB08652F004010F60E480B18B7394508A92

Function 00C677B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C67921

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f47571a709365bb626ced387b3ab51468bdee90b6de15823dbf009e4d3b0baeb
Instruction ID: 47fa6eaa1234ffb860a9521212a2b13c2cafc671f526c858b06471c53db19212
Opcode Fuzzy Hash: f47571a709365bb626ced387b3ab51468bdee90b6de15823dbf009e4d3b0baeb
Instruction Fuzzy Hash: D0A25C71904219CFDB24CF59C4807ADBBB1FF48314F2586AAE869AB391D7349E81DF90

Function 00C8D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610d3f09ef1b2fd588110b72fc6edb961798b736d1351f318fe5e153603c3ff3
Instruction ID: 2180585803d21c198fe3172e35e1230d876dcbb2fd9476a3c84cffec63e867b4
Opcode Fuzzy Hash: 610d3f09ef1b2fd588110b72fc6edb961798b736d1351f318fe5e153603c3ff3
Instruction Fuzzy Hash: CF322832D25F414DD7236634D8223396388AFB73D8F15D727E82AB59EADF29C5834205

Function 00C696C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 4dddf8a87dc6df79ffbf59e7b1aaea79b82445c1450bebdd7e9976049cf45ee0
Instruction ID: f915aab742c8b58fb522c377db3472d6f12aa6e83ca4ae931a6019bc16b908e7
Opcode Fuzzy Hash: 4dddf8a87dc6df79ffbf59e7b1aaea79b82445c1450bebdd7e9976049cf45ee0
Instruction Fuzzy Hash: F92297716083019FD724DF24C8D1B6BB7E8EF84314F10891EF9AA9B291DB71E945DB82

Function 00C9038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73effe1b97b2fd3d60fa51606adffa9bb79aa0f8f65a04cbc338818c034252a0
Instruction ID: 48a6a999ac2d6c8fc8a313716ea1503657c2f81e280168cabea4bcbca11e0168
Opcode Fuzzy Hash: 73effe1b97b2fd3d60fa51606adffa9bb79aa0f8f65a04cbc338818c034252a0
Instruction Fuzzy Hash: 9DB1E430D2AF414DD7239639883133ABA5C6FBB2D5F92D717FD1674D62EB2185838181

Function 00CAB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00CAB6DF

Part of subcall function 00C8344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00CABDC3,00000000,?,?,?,?,00CABF70,00000000,?), ref: 00C83453
Part of subcall function 00C8344A: __aulldiv.LIBCMT ref: 00C83473

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 392164a665f4d6217f84eb11c71815839a35202149eac4c26ad8afa1677b9843
Instruction ID: 55691071797e7b7b68663f789ddcb3d4547e37990bb01820aeda08822ddf94c9
Opcode Fuzzy Hash: 392164a665f4d6217f84eb11c71815839a35202149eac4c26ad8afa1677b9843
Instruction Fuzzy Hash: E22175726346118BC729CF28C481A52B7E1EB95314B248E7DE4E5CB2C1CB78BE05DB64

Function 00CB6AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00CB6ACA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 56d199500ef0a49a0aed5df14184ee0b930cf77f91a7cb4066e6069f99b7f964
Instruction ID: ba9da847eada536c4e087e03c0c27c6507550687fa8b240ea9a5ce76f29aff28
Opcode Fuzzy Hash: 56d199500ef0a49a0aed5df14184ee0b930cf77f91a7cb4066e6069f99b7f964
Instruction Fuzzy Hash: 08E012352102046FD700EB59D844A9AB7ECAF74755F04C416F946D7251DAB4E8449B90

Function 00CA74E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00CA750A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 6f0f927d412bbb904a0fdb552654bfaa9cb0bea06abd04f6d1d5dfa5de8f9f48
Instruction ID: bd647a58735b4b4afe3c52c0131ff41083b25d20096789c2f06e179111b5e400
Opcode Fuzzy Hash: 6f0f927d412bbb904a0fdb552654bfaa9cb0bea06abd04f6d1d5dfa5de8f9f48
Instruction Fuzzy Hash: 30D09EA556C6077DEC1A07249C1FFB71508F306B89FD447497613D90C0A8D45E42A435

Function 00C9B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00C9AD3E), ref: 00C9B124

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 1ab40c4383dd2ed8aca59d2f1ef535a8f379f953ba93241e60bebf648bf06264
Instruction ID: 229491ef0fbb11dcdb4a6b5085328d4b281ed861ec2e2ffb22ebdc4a235604a3
Opcode Fuzzy Hash: 1ab40c4383dd2ed8aca59d2f1ef535a8f379f953ba93241e60bebf648bf06264
Instruction Fuzzy Hash: AAD09E321A464EAEDF025FA4DC06FAE3F6AEB04701F448511FA26D94A1C675D531AB50

Function 00CDB340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00CDB352

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: cc3ba1df1455a30e5e85396b5cf7510435f32f639abb893ea65264ed7a28adab
Instruction ID: 69f35703dd1393f41ade3de5f5ba40b84dc43e6aae301c69cb2a689c2aa4783c
Opcode Fuzzy Hash: cc3ba1df1455a30e5e85396b5cf7510435f32f639abb893ea65264ed7a28adab
Instruction Fuzzy Hash: 02C04CB2400159DFC751CBC4C984AEEB7BCAB04301F1440929206F1110D7719B459B72

Function 00C88189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00C8818F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d404879b9895b0a43b8d7f900f540c8ac1a593a72e872a10d95c153e8d0bff74
Instruction ID: ce305abf94de5b2a2cd698077d818f2d1b48c1aa490ce617d8d7845f7cdfc27d
Opcode Fuzzy Hash: d404879b9895b0a43b8d7f900f540c8ac1a593a72e872a10d95c153e8d0bff74
Instruction Fuzzy Hash: F2A0113200020CAB8F002B82EC08A883F2CEA002A0B000020F80E080308B22A8A08A82

Function 00C6E3B0 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f069c9c3a56ccf887561ae01e1e50bb594c808e6986b4e8839746037314b24fd
Instruction ID: ae91ef53391bb07c73de0dffa824fd05dac6ecade984b2b0418b64fa5270950a
Opcode Fuzzy Hash: f069c9c3a56ccf887561ae01e1e50bb594c808e6986b4e8839746037314b24fd
Instruction Fuzzy Hash: 0722AD78904209DFDB24DF58C4C0ABEB7F1FF18304F14816AE95A9B391E731AA81DB91

Function 00C693F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c439e83ea76cfa4e5524fde9c91dc03136ca5bd3df4b387fd468ff6ce445bb2b
Instruction ID: 62ac66e72aa5b37a69872b5fdcbe60893e016175cb2946b826355514f67b6aca
Opcode Fuzzy Hash: c439e83ea76cfa4e5524fde9c91dc03136ca5bd3df4b387fd468ff6ce445bb2b
Instruction Fuzzy Hash: DB128E70A00209EFDF14DFA5D985AEEB7F9FF48300F108569E416E7250EB36AA11DB50

Function 00C6AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 728b5b8db641c7563fd6ce601079e7621138f0ebacd52d32a3c77d0a2715b4c1
Instruction ID: 4ff1c21699026c3cd9f2544a0a46d4cf9c6488f7b0bb414f1533143d2f7f72c7
Opcode Fuzzy Hash: 728b5b8db641c7563fd6ce601079e7621138f0ebacd52d32a3c77d0a2715b4c1
Instruction Fuzzy Hash: C4029F70A00205EBCF14DF69D9916AEBBB5EF48300F10C46AE90ADB355EB31DA51DB91

Function 00C802A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 03e577205429cebdd9521c81483786ec30a452f8be63b9366e88dae3a0ebb464
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 02C1D6322051930ADF6D463A847443EBBA15EA27B572A077DD8B7CB4D5FF20CA28D724

Function 00C806D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 8697f53bc525f8481a0b8fc82b94d9bd4fa326bdd5624d3ca0c7dd3ad5684017
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 1AC1C43220519309DFAD463AC47443EBBA15EA2BB572A077DD4B7CB4D5EF20DA28D720

Function 00C7FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 4834acb56cec652792f2d082c23886a683e5b96d8962869bd8fd1f448d2d00e1
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: E6C1B83220909309DF2D463AC4B443EFBA15EA17B531A877DD4BBCB5D5EF20CA66D620

Function 00CBA2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00CBA2FE
DeleteObject.GDI32(00000000), ref: 00CBA310
DestroyWindow.USER32 ref: 00CBA31E
GetDesktopWindow.USER32 ref: 00CBA338
GetWindowRect.USER32(00000000), ref: 00CBA33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00CBA480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00CBA490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA4D8
GetClientRect.USER32(00000000,?), ref: 00CBA4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00CBA51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA55E
GlobalLock.KERNEL32(00000000), ref: 00CBA567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA576
GlobalUnlock.KERNEL32(00000000), ref: 00CBA57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA586
GlobalFree.KERNEL32(00000000), ref: 00CBA591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00CED9BC,00000000), ref: 00CBA5B9
GlobalFree.KERNEL32(00000000), ref: 00CBA5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00CBA5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00CBA60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CBA81D

Strings

DISPLAY, xrefs: 00CBA680
, xrefs: 00CBA7A3
static, xrefs: 00CBA518, 00CBA66F
AutoIt v3, xrefs: 00CBA4D0

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: a9a6c7e54f08339661db91f378d3f36a9a4be2e518445a33b91ea458204d9b98
Instruction ID: 7d106a2e16b471bb1f17a2721ab15881f7344da2813ddfb1930167f2c05db6e6
Opcode Fuzzy Hash: a9a6c7e54f08339661db91f378d3f36a9a4be2e518445a33b91ea458204d9b98
Instruction Fuzzy Hash: B8026B75A00254EFDB14DFA4CD89EAE7BB9FB48310F108158F916AB2A1CB71ED41CB60

Function 00CCD285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00CCD2DB
GetSysColorBrush.USER32(0000000F), ref: 00CCD30C
GetSysColor.USER32(0000000F), ref: 00CCD318
SetBkColor.GDI32(?,000000FF), ref: 00CCD332
SelectObject.GDI32(?,00000000), ref: 00CCD341
InflateRect.USER32(?,000000FF,000000FF), ref: 00CCD36C
GetSysColor.USER32(00000010), ref: 00CCD374
CreateSolidBrush.GDI32(00000000), ref: 00CCD37B
FrameRect.USER32(?,?,00000000), ref: 00CCD38A
DeleteObject.GDI32(00000000), ref: 00CCD391
InflateRect.USER32(?,000000FE,000000FE), ref: 00CCD3DC
FillRect.USER32(?,?,00000000), ref: 00CCD40E
GetWindowLongW.USER32(?,000000F0), ref: 00CCD439

Part of subcall function 00CCD575: GetSysColor.USER32(00000012), ref: 00CCD5AE
Part of subcall function 00CCD575: SetTextColor.GDI32(?,?), ref: 00CCD5B2
Part of subcall function 00CCD575: GetSysColorBrush.USER32(0000000F), ref: 00CCD5C8
Part of subcall function 00CCD575: GetSysColor.USER32(0000000F), ref: 00CCD5D3
Part of subcall function 00CCD575: GetSysColor.USER32(00000011), ref: 00CCD5F0
Part of subcall function 00CCD575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00CCD5FE
Part of subcall function 00CCD575: SelectObject.GDI32(?,00000000), ref: 00CCD60F
Part of subcall function 00CCD575: SetBkColor.GDI32(?,00000000), ref: 00CCD618
Part of subcall function 00CCD575: SelectObject.GDI32(?,?), ref: 00CCD625
Part of subcall function 00CCD575: InflateRect.USER32(?,000000FF,000000FF), ref: 00CCD644
Part of subcall function 00CCD575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00CCD65B
Part of subcall function 00CCD575: GetWindowLongW.USER32(00000000,000000F0), ref: 00CCD670
Part of subcall function 00CCD575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00CCD698

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 3b0d995ff4f56cb12b7cd2fc1c6b867d7b9ed513bdd0608a57dd8a05b14df722
Instruction ID: 6cecf2efec3b44315bf198a9b169b59d58e64195a95580a9a279ad5697589b9d
Opcode Fuzzy Hash: 3b0d995ff4f56cb12b7cd2fc1c6b867d7b9ed513bdd0608a57dd8a05b14df722
Instruction Fuzzy Hash: 9B917DB2009341AFCB109F64DC88F6FBBA9FB85325F104A2DF9639A1A0D771D945CB52

Function 00C7B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00C7B98B
DeleteObject.GDI32(00000000), ref: 00C7B9CD
DeleteObject.GDI32(00000000), ref: 00C7B9D8
DestroyIcon.USER32(00000000), ref: 00C7B9E3
DestroyWindow.USER32(00000000), ref: 00C7B9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 00CDD2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00CDD2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00CDD711

Part of subcall function 00C7B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C7B759,?,00000000,?,?,?,?,00C7B72B,00000000,?), ref: 00C7BA58

SendMessageW.USER32 ref: 00CDD758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00CDD76F
ImageList_Destroy.COMCTL32(00000000), ref: 00CDD785
ImageList_Destroy.COMCTL32(00000000), ref: 00CDD790

Strings

0, xrefs: 00CDD5A5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: abc002c5b554b698d398f2ec586fca00acbe89e08639c1f0b8cfe05d2092f806
Instruction ID: c010857bdd2178789b1e3e140731e021e124313a96f2ee5ae455616f1362e894
Opcode Fuzzy Hash: abc002c5b554b698d398f2ec586fca00acbe89e08639c1f0b8cfe05d2092f806
Instruction Fuzzy Hash: 9B128C70A04241DFDB11CF25C884BA9BBF5BF45304F14856AFAAACB262C731ED46DB91

Function 00CADBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CADBD6
GetDriveTypeW.KERNEL32(?,00CFDC54,?,\\.\,00CFDC00), ref: 00CADCC3
SetErrorMode.KERNEL32(00000000,00CFDC54,?,\\.\,00CFDC00), ref: 00CADE29

Strings

SSD, xrefs: 00CADD50
SAS, xrefs: 00CADDD2
\\.\, xrefs: 00CADC2B
SCSI, xrefs: 00CADD93
FileBackedVirtual, xrefs: 00CADDF5
Virtual, xrefs: 00CADDEE
1394, xrefs: 00CADDA8
Fibre, xrefs: 00CADDB6
PhysicalDrive, xrefs: 00CADC67
Network, xrefs: 00CADD01
Unknown, xrefs: 00CADCE3, 00CADD8C
iSCSI, xrefs: 00CADDCB
SSA, xrefs: 00CADDAF
USB, xrefs: 00CADDBD
SATA, xrefs: 00CADDD9
Removable, xrefs: 00CADD15
MMC, xrefs: 00CADDE7
CDROM, xrefs: 00CADCF7
ATAPI, xrefs: 00CADD9A
RAMDisk, xrefs: 00CADCED
ATA, xrefs: 00CADDA1
RAID, xrefs: 00CADDC4
Fixed, xrefs: 00CADD0B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: b494138b2a750c69cd350e487889ba7ce2112f89c4ffeff20ddb59eab4fcc088
Instruction ID: 7004032f0c54183573c42dc4f0cafcdacfd68fddd59126975cde65577531540e
Opcode Fuzzy Hash: b494138b2a750c69cd350e487889ba7ce2112f89c4ffeff20ddb59eab4fcc088
Instruction Fuzzy Hash: 2B51B130648303EF8710DF11D982969B7A1FBAA71CB244819F0579BA91DF70DB89E763

Function 00C6CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C6CC68
__wcsnicmp.LIBCMT ref: 00C6CC80
__wcsnicmp.LIBCMT ref: 00C6CC98
__wcsnicmp.LIBCMT ref: 00C6CCB0
__wcsnicmp.LIBCMT ref: 00C6CCC8
__wcsnicmp.LIBCMT ref: 00C6CCE0
__wcsnicmp.LIBCMT ref: 00C6CCF8
__wcsnicmp.LIBCMT ref: 00C6CD0C
__wcsnicmp.LIBCMT ref: 00C6CD4D
__wcsnicmp.LIBCMT ref: 00C6CD61
__wcsnicmp.LIBCMT ref: 00C6CD75
__wcsnicmp.LIBCMT ref: 00C6CD89

Strings

#OnAutoItStartRegister, xrefs: 00C6CCAA
#pragma compile, xrefs: 00C6CC62
Unterminated group of comments, xrefs: 00CD2FB4
Cannot parse #include, xrefs: 00CD2FA1
Bad directive syntax error, xrefs: 00CD2ECB
#notrayicon, xrefs: 00C6CC7A
#comments-start, xrefs: 00C6CCF2, 00C6CD47
#ce, xrefs: 00C6CD83
#comments-end, xrefs: 00C6CD6F
#cs, xrefs: 00C6CD06, 00C6CD5B
#requireadmin, xrefs: 00C6CC92
#include-once, xrefs: 00C6CCC2
#include, xrefs: 00C6CCDA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 0d009e2ad95a496acdac6d9b4a5e0fc3cadc84e5acf81d41745ea2ab71a51013
Instruction ID: ab655f60540397480b83cf8d3c3462e62b6e1b6329385490f6ba7da94e017332
Opcode Fuzzy Hash: 0d009e2ad95a496acdac6d9b4a5e0fc3cadc84e5acf81d41745ea2ab71a51013
Instruction Fuzzy Hash: 6581E830640219BBCB34BFA4DCC3FBE3769AF24705F044039FA45A61C2EB61DA45D6A5

Function 00CCC6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 00CCC788
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00CCC83E
SendMessageW.USER32(?,00001102,00000002,?), ref: 00CCC859
SendMessageW.USER32(?,000000F1,?,00000000), ref: 00CCCB15

Strings

0, xrefs: 00CCC89C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: bd319d93184feefa8beac748f74eb4d2fd70d57d27a4e9b0be39002178e57c86
Instruction ID: cf30fb7194cdc8f8baf6e530c648ee2e72d1a570202a3aa42c9c5398b6c74418
Opcode Fuzzy Hash: bd319d93184feefa8beac748f74eb4d2fd70d57d27a4e9b0be39002178e57c86
Instruction Fuzzy Hash: C1F19B71204341AFE7218F24C8C9FAABBA4FF49354F084A2DF5ADD62A1C7748A45DB91

Function 00CC638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00CFDC00), ref: 00CC6449

Strings

UNCHECK, xrefs: 00CC66A1
GETSELECTED, xrefs: 00CC66C1
SHOWDROPDOWN, xrefs: 00CC6500
ISENABLED, xrefs: 00CC648C
TABLEFT, xrefs: 00CC64A7
GETCURRENTSELECTION, xrefs: 00CC6603
ISCHECKED, xrefs: 00CC6659
SETCURRENTSELECTION, xrefs: 00CC65D6
HIDEDROPDOWN, xrefs: 00CC6520
ISVISIBLE, xrefs: 00CC6455
GETLINECOUNT, xrefs: 00CC66E4
GETCURRENTCOL, xrefs: 00CC6724
CURRENTTAB, xrefs: 00CC64DD
SENDCOMMANDID, xrefs: 00CC67CA
EDITPASTE, xrefs: 00CC675B
TABRIGHT, xrefs: 00CC64BD
ADDSTRING, xrefs: 00CC6536
CHECK, xrefs: 00CC668B
DELSTRING, xrefs: 00CC6569
GETLINE, xrefs: 00CC678B
GETCURRENTLINE, xrefs: 00CC6704
SELECTSTRING, xrefs: 00CC6626
FINDSTRING, xrefs: 00CC6596

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: e2e3b5f1e9b92a3cb79bd991b4330b0eb6b0a11938a5dd1be89ee159b00f9ba2
Instruction ID: 992388cbe72342ae9ab2a964e0b9c348abeecb4d4786901078f69c48ad5d9c09
Opcode Fuzzy Hash: e2e3b5f1e9b92a3cb79bd991b4330b0eb6b0a11938a5dd1be89ee159b00f9ba2
Instruction Fuzzy Hash: F6C172342042459BCB04EF10D691EAE7799AF94344F14885DF89A5B3E2DF30ED4BDB92

Function 00CCD575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00CCD5AE
SetTextColor.GDI32(?,?), ref: 00CCD5B2
GetSysColorBrush.USER32(0000000F), ref: 00CCD5C8
GetSysColor.USER32(0000000F), ref: 00CCD5D3
CreateSolidBrush.GDI32(?), ref: 00CCD5D8
GetSysColor.USER32(00000011), ref: 00CCD5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00CCD5FE
SelectObject.GDI32(?,00000000), ref: 00CCD60F
SetBkColor.GDI32(?,00000000), ref: 00CCD618
SelectObject.GDI32(?,?), ref: 00CCD625
InflateRect.USER32(?,000000FF,000000FF), ref: 00CCD644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00CCD65B
GetWindowLongW.USER32(00000000,000000F0), ref: 00CCD670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00CCD698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00CCD6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 00CCD6DD
DrawFocusRect.USER32(?,?), ref: 00CCD6E8
GetSysColor.USER32(00000011), ref: 00CCD6F6
SetTextColor.GDI32(?,00000000), ref: 00CCD6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00CCD712
SelectObject.GDI32(?,00CCD2A5), ref: 00CCD729
DeleteObject.GDI32(?), ref: 00CCD734
SelectObject.GDI32(?,?), ref: 00CCD73A
DeleteObject.GDI32(?), ref: 00CCD73F
SetTextColor.GDI32(?,?), ref: 00CCD745
SetBkColor.GDI32(?,?), ref: 00CCD74F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: f991fe9903791b66c83fc7407cd125f11eeb5f38db5a8e339d111697ed03ec8b
Instruction ID: 55ffa5cd8fa99430776d7799c1a5b9d85ae5993308c1bf5dd4a1246dbae2e320
Opcode Fuzzy Hash: f991fe9903791b66c83fc7407cd125f11eeb5f38db5a8e339d111697ed03ec8b
Instruction Fuzzy Hash: 92512CB2901248BFDF109FA4DC88FAE7B79FB08324F114515F926AB2A1D7759A40DF50

Function 00CCB6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00CCB7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00CCB7C1
CharNextW.USER32(0000014E), ref: 00CCB7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00CCB831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00CCB847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00CCB858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00CCB875
SetWindowTextW.USER32(?,0000014E), ref: 00CCB8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00CCB8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 00CCB90E
_memset.LIBCMT ref: 00CCB933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00CCB97C
_memset.LIBCMT ref: 00CCB9DB
SendMessageW.USER32 ref: 00CCBA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 00CCBA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 00CCBB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 00CCBB2C
GetMenuItemInfoW.USER32(?), ref: 00CCBB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00CCBBA3
DrawMenuBar.USER32(?), ref: 00CCBBB2
SetWindowTextW.USER32(?,0000014E), ref: 00CCBBDA

Strings

0, xrefs: 00CCBB4F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: f3e0162f3c3aa6cf442691f355b89b120d3e0dd24f8edbef7dbe0219528115ae
Instruction ID: b0f7b1125377d9e5eb10550a621d74cbe0cc344fa10351f3a006b3996c4cd22c
Opcode Fuzzy Hash: f3e0162f3c3aa6cf442691f355b89b120d3e0dd24f8edbef7dbe0219528115ae
Instruction Fuzzy Hash: C0E15C75900218ABDF209FA5CC86FEE7B78FF05714F14815AF929AA290D7709E81DF60

Function 00CC764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00CC778A
GetDesktopWindow.USER32 ref: 00CC779F
GetWindowRect.USER32(00000000), ref: 00CC77A6
GetWindowLongW.USER32(?,000000F0), ref: 00CC7808
DestroyWindow.USER32(?), ref: 00CC7834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00CC785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00CC787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00CC78A1
SendMessageW.USER32(?,00000421,?,?), ref: 00CC78B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00CC78C9
IsWindowVisible.USER32(?), ref: 00CC78E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00CC7904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00CC7918
GetWindowRect.USER32(?,?), ref: 00CC7930
MonitorFromPoint.USER32(?,?,00000002), ref: 00CC7956
GetMonitorInfoW.USER32 ref: 00CC7970
CopyRect.USER32(?,?), ref: 00CC7987
SendMessageW.USER32(?,00000412,00000000), ref: 00CC79F2

Strings

tooltips_class32, xrefs: 00CC7856
0, xrefs: 00CC7735
(, xrefs: 00CC7965

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 38cd6a942c6334ecb4174af1122e537d3de13201a58466687d6ac390b7a83675
Instruction ID: 156217c4a281e959fdb4b7c2354f24309a47451f40c794d264fc478d61e04316
Opcode Fuzzy Hash: 38cd6a942c6334ecb4174af1122e537d3de13201a58466687d6ac390b7a83675
Instruction Fuzzy Hash: 87B17A71608341AFDB14DF64C989B6ABBE4FF88310F008A1DF59A9B291D770E945CF92

Function 00CA6CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00CA6CFB
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00CA6D21
_wcscpy.LIBCMT ref: 00CA6D4F
_wcscmp.LIBCMT ref: 00CA6D5A
_wcscat.LIBCMT ref: 00CA6D70
_wcsstr.LIBCMT ref: 00CA6D7B
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00CA6D97
_wcscat.LIBCMT ref: 00CA6DE0
_wcscat.LIBCMT ref: 00CA6DE7
_wcsncpy.LIBCMT ref: 00CA6E12

Strings

\VarFileInfo\Translation, xrefs: 00CA6D8F
StringFileInfo\, xrefs: 00CA6D6A
%u.%u.%u.%u, xrefs: 00CA6E75
DefaultLangCodepage, xrefs: 00CA6DFA
04090000, xrefs: 00CA6DCD

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: b5d6a50ad3b45b13869a9fe0e6ddbd937f9783a0db35ae8a5135c337fb33e4b8
Instruction ID: 46f03ae33dfd8dc91e808fe5a6b16c24c6c923651df11c376dc42ba108ea639c
Opcode Fuzzy Hash: b5d6a50ad3b45b13869a9fe0e6ddbd937f9783a0db35ae8a5135c337fb33e4b8
Instruction Fuzzy Hash: C941D672A00205BFEB00BB64DC87EBF77BCDF41718F144029F905A6182EB759A05A7A6

Function 00C7A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C7A939
GetSystemMetrics.USER32(00000007), ref: 00C7A941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C7A96C
GetSystemMetrics.USER32(00000008), ref: 00C7A974
GetSystemMetrics.USER32(00000004), ref: 00C7A999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00C7A9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00C7A9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00C7A9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00C7AA0D
GetClientRect.USER32(00000000,000000FF), ref: 00C7AA2B
GetStockObject.GDI32(00000011), ref: 00C7AA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 00C7AA52

Part of subcall function 00C7B63C: GetCursorPos.USER32(000000FF), ref: 00C7B64F
Part of subcall function 00C7B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00C7B66C
Part of subcall function 00C7B63C: GetAsyncKeyState.USER32(00000001), ref: 00C7B691
Part of subcall function 00C7B63C: GetAsyncKeyState.USER32(00000002), ref: 00C7B69F

SetTimer.USER32(00000000,00000000,00000028,00C7AB87), ref: 00C7AA79

Strings

AutoIt v3 GUI, xrefs: 00C7A9F1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 17f59627f46599c092043ee4581792c91c59422f952ab58b9654ce6a0b04358f
Instruction ID: 4db582c3ffd7e3bc4c5a45df5bb6dae543f8c0169da87059f1e93f6678bff443
Opcode Fuzzy Hash: 17f59627f46599c092043ee4581792c91c59422f952ab58b9654ce6a0b04358f
Instruction Fuzzy Hash: 83B1AD71A0020A9FDB14DFA8DC85BAD7BB4FB58315F118229FA1AEB290DB30D941DF51

Function 00C62EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C62F7A
IsWindow.USER32(?), ref: 00CD22FD

Strings

TITLE, xrefs: 00CD2292
ALL, xrefs: 00CD2264
ACTIVE, xrefs: 00CD20CC
INSTANCE, xrefs: 00CD223C
REGEXPCLASS, xrefs: 00CD2149
REGEXPTITLE, xrefs: 00CD20F8
CLASS, xrefs: 00CD2128
LAST, xrefs: 00CD20B6
HANDLE, xrefs: 00CD20E2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 62970417-1919597938
Opcode ID: e8986d834a026176fcd145dc120f5b3377fa4f615f568dd3a7fe8bd3e21d75b0
Instruction ID: 84651b94e783d71d7180accc6e0b30b63f2930b0d8a18737bf2e4497f8bd0a40
Opcode Fuzzy Hash: e8986d834a026176fcd145dc120f5b3377fa4f615f568dd3a7fe8bd3e21d75b0
Instruction Fuzzy Hash: E1D1FD31104742EBCB14EF50C481AAEBBB8FF64354F00891EF556572A1DB30EA9ADBD1

Function 00CC3639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CC3735
RegCreateKeyExW.ADVAPI32(?,?,00000000,00CFDC00,00000000,?,00000000,?,?), ref: 00CC37A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00CC37EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00CC3874
RegCloseKey.ADVAPI32(?), ref: 00CC3B94
RegCloseKey.ADVAPI32(00000000), ref: 00CC3BA1

Strings

REG_MULTI_SZ, xrefs: 00CC395C
REG_EXPAND_SZ, xrefs: 00CC3811
REG_BINARY, xrefs: 00CC3B2F
REG_SZ, xrefs: 00CC38B2
REG_QWORD, xrefs: 00CC3AE2
REG_DWORD, xrefs: 00CC3A65

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 95f3e65277cd3b68ba0e3e6175985ed5a3e6ad97b0e89fbc03c858823034eb8f
Instruction ID: 207e3670fe651292d13c61749c461827bd7eadf37db3cc4bfb08f7e84d8b513f
Opcode Fuzzy Hash: 95f3e65277cd3b68ba0e3e6175985ed5a3e6ad97b0e89fbc03c858823034eb8f
Instruction Fuzzy Hash: 950269756046419FCB14EF14D895E2AB7E9FF88720F04846CF99A9B3A1CB30EE41DB85

Function 00CC6BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00CC6C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00CC6D16

Strings

GETSELECTED, xrefs: 00CC6E3C
GETITEMCOUNT, xrefs: 00CC6C84
SELECT, xrefs: 00CC6DA8
ISSELECTED, xrefs: 00CC6D21
GETTEXT, xrefs: 00CC6CBF
SELECTCLEAR, xrefs: 00CC6D8D
VIEWCHANGE, xrefs: 00CC6ECD
FINDITEM, xrefs: 00CC6E81
DESELECT, xrefs: 00CC6DFC
GETSUBITEMCOUNT, xrefs: 00CC6CA1
SELECTINVERT, xrefs: 00CC6DDE
SELECTALL, xrefs: 00CC6D75
GETSELECTEDCOUNT, xrefs: 00CC6CF9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: d2591460ce76a0f0797142072f10d230ecb7e996def252806d4d83b6af4c8703
Instruction ID: 5c610d7b9003af300053344c87dc1af02ab0e804b7e257346c200ac651e58caf
Opcode Fuzzy Hash: d2591460ce76a0f0797142072f10d230ecb7e996def252806d4d83b6af4c8703
Instruction Fuzzy Hash: 19A16F342142419BCB14EF20DA91F6AB3A9FF84314F14896DF86A9B3D2DB30ED06DB51

Function 00C9CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C9CF91
__swprintf.LIBCMT ref: 00C9D032
_wcscmp.LIBCMT ref: 00C9D045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00C9D09A
_wcscmp.LIBCMT ref: 00C9D0D6
GetClassNameW.USER32(?,?,00000400), ref: 00C9D10D
GetDlgCtrlID.USER32(?), ref: 00C9D15F
GetWindowRect.USER32(?,?), ref: 00C9D195
GetParent.USER32(?), ref: 00C9D1B3
ScreenToClient.USER32(00000000), ref: 00C9D1BA
GetClassNameW.USER32(?,?,00000100), ref: 00C9D234
_wcscmp.LIBCMT ref: 00C9D248
GetWindowTextW.USER32(?,?,00000400), ref: 00C9D26E
_wcscmp.LIBCMT ref: 00C9D282

Strings

%s%u, xrefs: 00C9D02C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: a0d84a123de7f88f0cb6a838a382b5e0ef3a551937fcff89a3796b7923c1929f
Instruction ID: 79f5df5d2bdf87d5983cdd540bce4fb6f355daa18d42c0a451ddf92af5d297f0
Opcode Fuzzy Hash: a0d84a123de7f88f0cb6a838a382b5e0ef3a551937fcff89a3796b7923c1929f
Instruction Fuzzy Hash: FBA1B371604702AFDB15DF64C888BAAB7A8FF44354F104519F9AAE7150DB30EE45CB91

Function 00C9D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00C9D8EB
_wcscmp.LIBCMT ref: 00C9D8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00C9D924
CharUpperBuffW.USER32(?,00000000), ref: 00C9D941
_wcscmp.LIBCMT ref: 00C9D95F
_wcsstr.LIBCMT ref: 00C9D970
GetClassNameW.USER32(00000018,?,00000400), ref: 00C9D9A8
_wcscmp.LIBCMT ref: 00C9D9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00C9D9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 00C9DA28
_wcscmp.LIBCMT ref: 00C9DA38
GetClassNameW.USER32(00000010,?,00000400), ref: 00C9DA60
GetWindowRect.USER32(00000004,?), ref: 00C9DAC9

Strings

ThumbnailClass, xrefs: 00C9D9B3, 00C9DA33
@, xrefs: 00C9D8C6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 0666c3c1a7708af2d12a93d3f6db911d6769871bc42a9802c3e4c3315f8d40ad
Instruction ID: 54785bb3944a7bcccfc2119f0adebfdd99950aa634e56faf030e4ea5235ae4c5
Opcode Fuzzy Hash: 0666c3c1a7708af2d12a93d3f6db911d6769871bc42a9802c3e4c3315f8d40ad
Instruction Fuzzy Hash: 9481B2310083459FDF11DF14C889FAA7BE8EF44714F044469FD9AAA096DB30DE56DBA1

Function 00C9D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C9D753

Strings

CLASSNAME=, xrefs: 00C9D790
[LAST, xrefs: 00C9D800
ALL, xrefs: 00C9D7E7
[HANDLE:, xrefs: 00C9D75F
REGEXP=, xrefs: 00C9D768
ACTIVE, xrefs: 00C9D72E
[ACTIVE, xrefs: 00C9D740
[REGEXPTITLE:, xrefs: 00C9D77B
[CLASS:, xrefs: 00C9D7A3
[ALL, xrefs: 00C9D7F9
LAST, xrefs: 00C9D718
HANDLE=, xrefs: 00C9D74C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: c945db4e4d5a3efa4e039838e16402920aec33e00416f997efa6e3e2ed1f0775
Instruction ID: ea38af9f1fc2911822b965e4acc162177f4d8a4ef9b71f9570e5b0095d18ee09
Opcode Fuzzy Hash: c945db4e4d5a3efa4e039838e16402920aec33e00416f997efa6e3e2ed1f0775
Instruction Fuzzy Hash: A5319031A48205FADB24FE90EE87EFD73659F20714F200029F552710DAEF52AF58E665

Function 00C9EA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00C9EAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00C9EAC2
SetWindowTextW.USER32(?,?), ref: 00C9EAD9
GetDlgItem.USER32(?,000003EA), ref: 00C9EAEE
SetWindowTextW.USER32(00000000,?), ref: 00C9EAF4
GetDlgItem.USER32(?,000003E9), ref: 00C9EB04
SetWindowTextW.USER32(00000000,?), ref: 00C9EB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00C9EB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00C9EB45
GetWindowRect.USER32(?,?), ref: 00C9EB4E
SetWindowTextW.USER32(?,?), ref: 00C9EBB9
GetDesktopWindow.USER32 ref: 00C9EBBF
GetWindowRect.USER32(00000000), ref: 00C9EBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00C9EC12
GetClientRect.USER32(?,?), ref: 00C9EC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00C9EC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00C9EC6F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 539e5595bafc7ea55887ccc7e149264c5e309193b7cf1e6e68c01668a68c644e
Instruction ID: e05e091941c9e7a63a65e0f79ef9ed93aebb21f5e2bf1c7c73ed661eab91a841
Opcode Fuzzy Hash: 539e5595bafc7ea55887ccc7e149264c5e309193b7cf1e6e68c01668a68c644e
Instruction Fuzzy Hash: 9B514971900709AFDB20DFA8CD89B6EBBF9FF14704F004928E696A66A0C775A944DB10

Function 00CB79B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00CB79C6
LoadCursorW.USER32(00000000,00007F00), ref: 00CB79D1
LoadCursorW.USER32(00000000,00007F03), ref: 00CB79DC
LoadCursorW.USER32(00000000,00007F8B), ref: 00CB79E7
LoadCursorW.USER32(00000000,00007F01), ref: 00CB79F2
LoadCursorW.USER32(00000000,00007F81), ref: 00CB79FD
LoadCursorW.USER32(00000000,00007F88), ref: 00CB7A08
LoadCursorW.USER32(00000000,00007F80), ref: 00CB7A13
LoadCursorW.USER32(00000000,00007F86), ref: 00CB7A1E
LoadCursorW.USER32(00000000,00007F83), ref: 00CB7A29
LoadCursorW.USER32(00000000,00007F85), ref: 00CB7A34
LoadCursorW.USER32(00000000,00007F82), ref: 00CB7A3F
LoadCursorW.USER32(00000000,00007F84), ref: 00CB7A4A
LoadCursorW.USER32(00000000,00007F04), ref: 00CB7A55
LoadCursorW.USER32(00000000,00007F02), ref: 00CB7A60
LoadCursorW.USER32(00000000,00007F89), ref: 00CB7A6B
GetCursorInfo.USER32(?), ref: 00CB7A7B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: dc96d0ca6665fc0923bb6f91a8b0c431574264fa5d9db5958928e7cbdc12f3f3
Instruction ID: 463824ce07618b943636d60cf8d1c8c890d5f3842ef021045e1835aa60cf1d0a
Opcode Fuzzy Hash: dc96d0ca6665fc0923bb6f91a8b0c431574264fa5d9db5958928e7cbdc12f3f3
Instruction Fuzzy Hash: A03136B1D0831A6ADF509FB68C8999FBFE8FF44750F50452AE50DE7280DA78A5008FA1

Function 00C6C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 00C7E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00C6C8B7,?,00002000,?,?,00000000,?,00C6419E,?,?,?,00CFDC00), ref: 00C7E984

Part of subcall function 00C6660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C653B1,?,?,00C661FF,?,00000000,00000001,00000000), ref: 00C6662F

__wsplitpath.LIBCMT ref: 00C6C93E

Part of subcall function 00C81DFC: __wsplitpath_helper.LIBCMT ref: 00C81E3C

_wcscpy.LIBCMT ref: 00C6C953
_wcscat.LIBCMT ref: 00C6C968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00C6C978
SetCurrentDirectoryW.KERNEL32(?), ref: 00C6CABE

Part of subcall function 00C6B337: _wcscpy.LIBCMT ref: 00C6B36F

Strings

Error opening the file, xrefs: 00CD30B4, 00CD313D
Unterminated string, xrefs: 00CD3470
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00CD3098
>>>AUTOIT SCRIPT<<<, xrefs: 00CD311B
AU3!, xrefs: 00C6C90C
Bad directive syntax error, xrefs: 00CD3429
EA06, xrefs: 00CD30C9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: 03b92876fbe7cb2c0a73f9273126032e5206c68b56041a926dd9837c2ca4b0e2
Instruction ID: 45ff7d1854d6b8499db76a44a69856f7da791ddbe5be5e9f995cd9c2b9fac0af
Opcode Fuzzy Hash: 03b92876fbe7cb2c0a73f9273126032e5206c68b56041a926dd9837c2ca4b0e2
Instruction Fuzzy Hash: C1127C715083419FC724EF64C881AAFBBE5AF99304F04491EF59A93262DB30DA49EB53

Function 00CCCE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CCCEFB
DestroyWindow.USER32(?,?), ref: 00CCCF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00CCCFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00CCD016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00CCD025
DestroyWindow.USER32(?), ref: 00CCD042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00C60000,00000000), ref: 00CCD075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00CCD094
GetDesktopWindow.USER32 ref: 00CCD0A9
GetWindowRect.USER32(00000000), ref: 00CCD0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00CCD0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00CCD0DA

Part of subcall function 00C7B526: GetWindowLongW.USER32(?,000000EB), ref: 00C7B537

Strings

0, xrefs: 00CCCF1B
tooltips_class32, xrefs: 00CCCFED, 00CCD06E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: 017c2db839e005bc4dec5e33808c5b39b45bf2337349ffd139f2a525a1a16fce
Instruction ID: 32f278ca0a64cb370ab4003f4a0e5dd3caf0d9d77cbdfcfc8140bec29080e8d2
Opcode Fuzzy Hash: 017c2db839e005bc4dec5e33808c5b39b45bf2337349ffd139f2a525a1a16fce
Instruction Fuzzy Hash: 2371C074140345AFD720CF28CC85FAA77E5EB98704F14852EF9968B2A1D770E946DB22

Function 00CCF351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

DragQueryPoint.SHELL32(?,?), ref: 00CCF37A

Part of subcall function 00CCD7DE: ClientToScreen.USER32(?,?), ref: 00CCD807
Part of subcall function 00CCD7DE: GetWindowRect.USER32(?,?), ref: 00CCD87D
Part of subcall function 00CCD7DE: PtInRect.USER32(?,?,00CCED5A), ref: 00CCD88D

SendMessageW.USER32(?,000000B0,?,?), ref: 00CCF3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00CCF3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00CCF411
_wcscat.LIBCMT ref: 00CCF441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00CCF458
SendMessageW.USER32(?,000000B0,?,?), ref: 00CCF471
SendMessageW.USER32(?,000000B1,?,?), ref: 00CCF488
SendMessageW.USER32(?,000000B1,?,?), ref: 00CCF4AA
DragFinish.SHELL32(?), ref: 00CCF4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00CCF59C

Strings

@GUI_DRAGFILE, xrefs: 00CCF54B
@GUI_DRAGID, xrefs: 00CCF510
@GUI_DROPID, xrefs: 00CCF4D1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 87f90b883236edfb696b8b34712d50e31d1d6a45c6d044fa24e3eb7d8e0475ed
Instruction ID: 7ca1494146700f57cdc3e8587655635a0617db91ac0fa0686414a987048f0b01
Opcode Fuzzy Hash: 87f90b883236edfb696b8b34712d50e31d1d6a45c6d044fa24e3eb7d8e0475ed
Instruction Fuzzy Hash: 45616B71108300AFC711DF64DC85EAFBBF8EF98714F004A1EF695961A1DB709A0ADB62

Function 00CAAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00CAAB3D
VariantCopy.OLEAUT32(?,?), ref: 00CAAB46
VariantClear.OLEAUT32(?), ref: 00CAAB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00CAAC40
__swprintf.LIBCMT ref: 00CAAC70
VarR8FromDec.OLEAUT32(?,?), ref: 00CAAC9C
VariantInit.OLEAUT32(?), ref: 00CAAD4D
SysFreeString.OLEAUT32(00000016), ref: 00CAADDF
VariantClear.OLEAUT32(?), ref: 00CAAE35
VariantClear.OLEAUT32(?), ref: 00CAAE44
VariantInit.OLEAUT32(00000000), ref: 00CAAE80

Strings

Default, xrefs: 00CAACFD
%4d%02d%02d%02d%02d%02d, xrefs: 00CAAC6A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 8af57e61b744fe86ad6db91098ebb258a2162cfc8eb6a40e77f9600aebadf368
Instruction ID: 218fe7cfc0fd5f5e30d21b1f8bbbb096c66876f010304d1c8b94e21e6688d931
Opcode Fuzzy Hash: 8af57e61b744fe86ad6db91098ebb258a2162cfc8eb6a40e77f9600aebadf368
Instruction Fuzzy Hash: 17D1F171A00207EBDB209F66E885BAEB7B5FF06708F148455F4159B1D0DB70ED50EBA2

Function 00CC716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00CC71FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00CC7247

Strings

UNCHECK, xrefs: 00CC740B
GETSELECTED, xrefs: 00CC733F
COLLAPSE, xrefs: 00CC728D
GETTOTALCOUNT, xrefs: 00CC722A
GETITEMCOUNT, xrefs: 00CC7311
CHECK, xrefs: 00CC7267
ISCHECKED, xrefs: 00CC73B2
SELECT, xrefs: 00CC73E0
GETTEXT, xrefs: 00CC7382
EXPAND, xrefs: 00CC72E1
EXISTS, xrefs: 00CC72B0

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 7e5768b62ea366a5c00a1b36812ab1a9cb5969402099e782c1bb84190d08d1e6
Instruction ID: 853f1ce0cfa779274efb146cc48b1918dfebc138cb1c2286c793a9fd36560771
Opcode Fuzzy Hash: 7e5768b62ea366a5c00a1b36812ab1a9cb5969402099e782c1bb84190d08d1e6
Instruction Fuzzy Hash: 45914F742087019BCB15EF10C891A6EB7A5EF94314F04896DF89A5B3A3DB30ED46EF91

Function 00CCE4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00CCE5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00CCBEAF), ref: 00CCE607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00CCE647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00CCE68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00CCE6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,?,00CCBEAF), ref: 00CCE6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00CCE6DF
DestroyIcon.USER32(?,?,?,?,?,00CCBEAF), ref: 00CCE6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00CCE70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00CCE717

Part of subcall function 00C80FA7: __wcsicmp_l.LIBCMT ref: 00C81030

Strings

.icl, xrefs: 00CCE521
.dll, xrefs: 00CCE564
.exe, xrefs: 00CCE541

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 4841b7b48d00d2ee716133d0d216f646363790c6ff9a35e5f46333c57156a526
Instruction ID: cd95762274153325657ce6b756a675fb614d2a923958edec6c4c1af68521f2d1
Opcode Fuzzy Hash: 4841b7b48d00d2ee716133d0d216f646363790c6ff9a35e5f46333c57156a526
Instruction Fuzzy Hash: B861E471510219FEEB20DF64CC86FFE7BA8BB19724F104119F922DA0D0EB709A84D760

Function 00CAD219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

CharLowerBuffW.USER32(?,?), ref: 00CAD292
GetDriveTypeW.KERNEL32 ref: 00CAD2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CAD327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CAD35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CAD38C

Strings

open , xrefs: 00CAD2EE
wait, xrefs: 00CAD349
set cd door , xrefs: 00CAD32D
close cd wait, xrefs: 00CAD377
type cdaudio alias cd wait, xrefs: 00CAD30A
closed, xrefs: 00CAD2A6, 00CAD2AF
open, xrefs: 00CAD2B9
close, xrefs: 00CAD298

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: 2fa439b03cb90fc60f93379cb8b624c2e1e7eacd00cbec9042ef27a6845fee80
Instruction ID: 427d1d52c295290350c9dbbf1a1b305e87d03c5358307f22d7ba86803a24e556
Opcode Fuzzy Hash: 2fa439b03cb90fc60f93379cb8b624c2e1e7eacd00cbec9042ef27a6845fee80
Instruction Fuzzy Hash: B0512971104305AFC710EF10D88196EB7F8EF99758F10896DF89AA7261DB31EE0ADB52

Function 00CA26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00CD3973,00000016,0000138C,00000016,?,00000016,00CFDDB4,00000000,?), ref: 00CA26F1
LoadStringW.USER32(00000000,?,00CD3973,00000016), ref: 00CA26FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00CD3973,00000016,0000138C,00000016,?,00000016,00CFDDB4,00000000,?,00000016), ref: 00CA271C
LoadStringW.USER32(00000000,?,00CD3973,00000016), ref: 00CA271F
__swprintf.LIBCMT ref: 00CA276F
__swprintf.LIBCMT ref: 00CA2780
_wprintf.LIBCMT ref: 00CA2829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CA2840

Strings

Line %d (File "%s"):, xrefs: 00CA2769
^ ERROR, xrefs: 00CA27D5
Line %d:, xrefs: 00CA277A
Error: , xrefs: 00CA27F7
%s (%d) : ==> %s: %s %s, xrefs: 00CA2824

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: 75f999ca1ac5a64d000c29867dc44a3ef4b846c59c0c4df885b7efbe150216d7
Instruction ID: 973134aa75b4060a3b09ce7b6dc21a761ca58b2d42eb46b16655ac3a68e8ac58
Opcode Fuzzy Hash: 75f999ca1ac5a64d000c29867dc44a3ef4b846c59c0c4df885b7efbe150216d7
Instruction Fuzzy Hash: DA415F72800219BACF24FBD4DDC6EEEB778AF15344F100065B606B6092EE756F49EB61

Function 00CAD0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00CAD0D8
__swprintf.LIBCMT ref: 00CAD0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 00CAD137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00CAD15C
_memset.LIBCMT ref: 00CAD17B
_wcsncpy.LIBCMT ref: 00CAD1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00CAD1EC
CloseHandle.KERNEL32(00000000), ref: 00CAD1F7
RemoveDirectoryW.KERNEL32(?), ref: 00CAD200
CloseHandle.KERNEL32(00000000), ref: 00CAD20A

Strings

\, xrefs: 00CAD110
\??\%s, xrefs: 00CAD0F4
:, xrefs: 00CAD11B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 4d3eb508b67c8aac9f78a9a684e39cf85009370358d35244631037a8c42da521
Instruction ID: c7708a4816e284fb13d9a47c7827f1516892bcaff6fa5d2e3fed8937fea11cc4
Opcode Fuzzy Hash: 4d3eb508b67c8aac9f78a9a684e39cf85009370358d35244631037a8c42da521
Instruction Fuzzy Hash: F43192B250014AABDB21DFA0DC89FEF37BCAF89744F1041B6F61AD6160E7709B458B24

Function 00CCE731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00CCBEF4,?,?), ref: 00CCE754
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00CCBEF4,?,?,00000000,?), ref: 00CCE76B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00CCBEF4,?,?,00000000,?), ref: 00CCE776
CloseHandle.KERNEL32(00000000,?,?,?,?,00CCBEF4,?,?,00000000,?), ref: 00CCE783
GlobalLock.KERNEL32(00000000), ref: 00CCE78C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00CCBEF4,?,?,00000000,?), ref: 00CCE79B
GlobalUnlock.KERNEL32(00000000), ref: 00CCE7A4
CloseHandle.KERNEL32(00000000,?,?,?,?,00CCBEF4,?,?,00000000,?), ref: 00CCE7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00CCBEF4,?,?,00000000,?), ref: 00CCE7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,00CED9BC,?), ref: 00CCE7D5
GlobalFree.KERNEL32(00000000), ref: 00CCE7E5
GetObjectW.GDI32(00000000,00000018,?), ref: 00CCE809
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00CCE834
DeleteObject.GDI32(00000000), ref: 00CCE85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00CCE872

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 02aac31308cda0caa232c5dd19024e921acd5ae7f2069a35476d20bbd0e918bd
Instruction ID: 4131f2e8d858e78ae47af334bdfc68dd6a7cf154c3502e610de3878f55891bfd
Opcode Fuzzy Hash: 02aac31308cda0caa232c5dd19024e921acd5ae7f2069a35476d20bbd0e918bd
Instruction Fuzzy Hash: 95413975600244EFDB119F65DC88FAE7BB8EF8A715F108058F916EB2A0D7319E41DB60

Function 00CB05F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00CB076F
_wcscat.LIBCMT ref: 00CB0787
_wcscat.LIBCMT ref: 00CB0799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00CB07AE
SetCurrentDirectoryW.KERNEL32(?), ref: 00CB07C2
GetFileAttributesW.KERNEL32(?), ref: 00CB07DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 00CB07F4
SetCurrentDirectoryW.KERNEL32(?), ref: 00CB0806

Strings

*.*, xrefs: 00CB0845

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 0581e8ea51a5e050ec8bca6331a643183f5ff9ca55ee835e3f3a6f9eb3ec3ea5
Instruction ID: fa56cea2691366e335f22b778f1042d764f4cceb926d685f94b3b4a57b90bf50
Opcode Fuzzy Hash: 0581e8ea51a5e050ec8bca6331a643183f5ff9ca55ee835e3f3a6f9eb3ec3ea5
Instruction Fuzzy Hash: FD8181715043419FDB24EF24C8859AFB7E8BBD8314F24882EF899D7251EA30DE558B92

Function 00CCEEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00CCEF3B
GetFocus.USER32 ref: 00CCEF4B
GetDlgCtrlID.USER32(00000000), ref: 00CCEF56
_memset.LIBCMT ref: 00CCF081
GetMenuItemInfoW.USER32 ref: 00CCF0AC
GetMenuItemCount.USER32(00000000), ref: 00CCF0CC
GetMenuItemID.USER32(?,00000000), ref: 00CCF0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00CCF113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00CCF15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00CCF193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00CCF1C8

Strings

0, xrefs: 00CCF079

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 61ee462f46ffc96cc0b5b6baea42cc4c71cfccd96507fc602eb10553e8f82d30
Instruction ID: e28d719bca8184503be50b3245bc62acef60740e99e0e0e6fa2cb1c59e317702
Opcode Fuzzy Hash: 61ee462f46ffc96cc0b5b6baea42cc4c71cfccd96507fc602eb10553e8f82d30
Instruction Fuzzy Hash: 89817B71504301AFD720CF14C884FAEBBEAFB88314F14452EF9A597291D770DA06CBA2

Function 00C9A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00C9ABD7
Part of subcall function 00C9ABBB: GetLastError.KERNEL32(?,00C9A69F,?,?,?), ref: 00C9ABE1
Part of subcall function 00C9ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00C9A69F,?,?,?), ref: 00C9ABF0
Part of subcall function 00C9ABBB: HeapAlloc.KERNEL32(00000000,?,00C9A69F,?,?,?), ref: 00C9ABF7
Part of subcall function 00C9ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00C9AC0E

Part of subcall function 00C9AC56: GetProcessHeap.KERNEL32(00000008,00C9A6B5,00000000,00000000,?,00C9A6B5,?), ref: 00C9AC62
Part of subcall function 00C9AC56: HeapAlloc.KERNEL32(00000000,?,00C9A6B5,?), ref: 00C9AC69
Part of subcall function 00C9AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00C9A6B5,?), ref: 00C9AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C9A8CB
_memset.LIBCMT ref: 00C9A8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C9A8FF
GetLengthSid.ADVAPI32(?), ref: 00C9A910
GetAce.ADVAPI32(?,00000000,?), ref: 00C9A94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C9A969
GetLengthSid.ADVAPI32(?), ref: 00C9A986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00C9A995
HeapAlloc.KERNEL32(00000000), ref: 00C9A99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C9A9BD
CopySid.ADVAPI32(00000000), ref: 00C9A9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C9A9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C9AA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C9AA2F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 21d189e246b7e305ea234b66fd0e51edd05827be6a28aa29eb09c7ff5c98a3d9
Instruction ID: dd684ada666f8db444f0111ce32501a1e1b37f7b8ee70209a4b8662be1eb8577
Opcode Fuzzy Hash: 21d189e246b7e305ea234b66fd0e51edd05827be6a28aa29eb09c7ff5c98a3d9
Instruction Fuzzy Hash: 49513C71900249AFDF10DF94DD89EEEBBB9FF04310F048119F926AB290DB359A05DBA1

Function 00CACC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 00CACCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 00CACCC5
__swprintf.LIBCMT ref: 00CACD1E
__swprintf.LIBCMT ref: 00CACD37
_wprintf.LIBCMT ref: 00CACDED
_wprintf.LIBCMT ref: 00CACE0B

Strings

Line %d (File "%s"):, xrefs: 00CACD18, 00CACD31
"%s" (%d) : ==> %s:%s%s, xrefs: 00CACDE8
^ ERROR, xrefs: 00CACD8F
"%s" (%d) : ==> %s:, xrefs: 00CACE06
Error: , xrefs: 00CACDB5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: fb48d883c1c41a51805ee9a4818780dcdfbe43e02d42ccfb6df20f4516539b22
Instruction ID: 9e0f6a8996516409d75d609be4ebe53a0e0f7c16b72effb604c4e7089c9ce844
Opcode Fuzzy Hash: fb48d883c1c41a51805ee9a4818780dcdfbe43e02d42ccfb6df20f4516539b22
Instruction Fuzzy Hash: 71518D7290020ABACF25EBE0DDC2EEEB778AF15304F104165F515721A2EB316F59EB61

Function 00CACA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00CACA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00CACAB0
__swprintf.LIBCMT ref: 00CACB09
__swprintf.LIBCMT ref: 00CACB22
_wprintf.LIBCMT ref: 00CACBCD
_wprintf.LIBCMT ref: 00CACBEB

Strings

Line %d (File "%s"):, xrefs: 00CACB03, 00CACB1C
"%s" (%d) : ==> %s:%s%s, xrefs: 00CACBC8
^ ERROR , xrefs: 00CACB64
"%s" (%d) : ==> %s:, xrefs: 00CACBE6
Error: , xrefs: 00CACB95

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: f4087b60391b72a7edbf308506c6bc11ff4c104cd0031a16ef40a82b268cdb3c
Instruction ID: a643fc992b9645de8307e1f77a68f758c0cae70adb66924e88570bff7464ddd9
Opcode Fuzzy Hash: f4087b60391b72a7edbf308506c6bc11ff4c104cd0031a16ef40a82b268cdb3c
Instruction Fuzzy Hash: AE519F7190020ABACF25EBE0DE82EEEB778AF15304F104165F50672092EB716F59EF61

Function 00CA55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA55D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00CA5664
GetMenuItemCount.USER32(00D21708), ref: 00CA56ED
DeleteMenu.USER32(00D21708,00000005,00000000,000000F5,?,?), ref: 00CA577D
DeleteMenu.USER32(00D21708,00000004,00000000), ref: 00CA5785
DeleteMenu.USER32(00D21708,00000006,00000000), ref: 00CA578D
DeleteMenu.USER32(00D21708,00000003,00000000), ref: 00CA5795
GetMenuItemCount.USER32(00D21708), ref: 00CA579D
SetMenuItemInfoW.USER32(00D21708,00000004,00000000,00000030), ref: 00CA57D3
GetCursorPos.USER32(?), ref: 00CA57DD
SetForegroundWindow.USER32(00000000), ref: 00CA57E6
TrackPopupMenuEx.USER32(00D21708,00000000,?,00000000,00000000,00000000), ref: 00CA57F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00CA5805

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: f6a57ea8259b4cbf51fc3f6b2ad5f2660fbcb478cd0fe62b1344073b829610c3
Instruction ID: b66c9336e6830b9318d5e9633e2168aa9be6f5496a3fec7252e226ac8b36b0d4
Opcode Fuzzy Hash: f6a57ea8259b4cbf51fc3f6b2ad5f2660fbcb478cd0fe62b1344073b829610c3
Instruction Fuzzy Hash: 7771F47064160ABFEB209F55CC89FAABF65FF4236CF248205F625AA2D0C7B15D10DB90

Function 00C9A14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C9A1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00C9A211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00C9A22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00C9A249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00C9A273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00C9A29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C9A2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C9A2AB

Strings

\IPC$, xrefs: 00C9A1F3
\CLSID, xrefs: 00C9A193
SOFTWARE\Classes\, xrefs: 00C9A17D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: 379007aecc82931c9abc0dd5c37f88353d050a1a80262d9e1b98bd6597e9b7bf
Instruction ID: 222f084c1772c4b274b7fad3faeb30f2718463ca9cbd03737fd9a14bf211dc34
Opcode Fuzzy Hash: 379007aecc82931c9abc0dd5c37f88353d050a1a80262d9e1b98bd6597e9b7bf
Instruction Fuzzy Hash: D841F776C10229AFCF21EBA4DC85EEDB778BF04300F004129F916A71A1EB719E45DB91

Function 00CC3C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CC2BB5,?,?), ref: 00CC3C1D

Strings

HKEY_USERS, xrefs: 00CC3D04
HKEY_CLASSES_ROOT, xrefs: 00CC3C96
HKCR, xrefs: 00CC3CAB
HKEY_LOCAL_MACHINE, xrefs: 00CC3C6C
HKCU, xrefs: 00CC3CF3
HKU, xrefs: 00CC3D15
HKEY_CURRENT_CONFIG, xrefs: 00CC3CC0
HKLM, xrefs: 00CC3C81
HKEY_CURRENT_USER, xrefs: 00CC3CE2
HKCC, xrefs: 00CC3CD1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 2c6febf61ed0cccdd3fcf70db00cbab09d6bf7763972dad15ec343b034f0a75b
Instruction ID: 526b6f51828b0c16b5ccfb691c7016130b144b3fe0e7ac8e91b9985045f56118
Opcode Fuzzy Hash: 2c6febf61ed0cccdd3fcf70db00cbab09d6bf7763972dad15ec343b034f0a75b
Instruction Fuzzy Hash: 9E4153751102899BDF11EF10F891FEA3769AF56300F10C858FC661B291EB70DE5ADB20

Function 00CA25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00CD36F4,00000010,?,Bad directive syntax error,00CFDC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00CA25D6
LoadStringW.USER32(00000000,?,00CD36F4,00000010), ref: 00CA25DD
_wprintf.LIBCMT ref: 00CA2610
__swprintf.LIBCMT ref: 00CA2632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00CA26A1

Strings

Line %d (File "%s"):, xrefs: 00CA2647
., xrefs: 00CA2687
Error: , xrefs: 00CA266F
%s (%d) : ==> %s.: %s %s, xrefs: 00CA260B
Line %d:, xrefs: 00CA262C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: 451a490241d98935eb8bef5eccdc88115b4502c0ff5b4a3a3152edb2eeb840f5
Instruction ID: 58748a280242965b9be3a46b7194c8cd57d3d3c5018d088076043a8c462c3ded
Opcode Fuzzy Hash: 451a490241d98935eb8bef5eccdc88115b4502c0ff5b4a3a3152edb2eeb840f5
Instruction Fuzzy Hash: 0521603180021AFFCF21BF90DC8AFEE7779BF19308F040459F516660A2DA71A659EB65

Function 00CA7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00CA7B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00CA7B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CA7B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00CA7B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00CA7B8C

Strings

open , xrefs: 00CA7AF1
alias PlayMe, xrefs: 00CA7B1B
status PlayMe mode, xrefs: 00CA7B3D
close PlayMe, xrefs: 00CA7B53, 00CA7B80
play PlayMe wait, xrefs: 00CA7B76
play PlayMe, xrefs: 00CA7B87

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 9e2b0a36a41fedb5b196e7c3fe11fbe380215c328feaf87228d2c88abd59d7b0
Instruction ID: 3a383750961a80476700d9e66c73fc79fef6bb02c1f1e3014060a82b51440d05
Opcode Fuzzy Hash: 9e2b0a36a41fedb5b196e7c3fe11fbe380215c328feaf87228d2c88abd59d7b0
Instruction Fuzzy Hash: 211182E1A5026A7ED720A761EC8ADFF7A7CEB92B14F0005197421A60D1DEA01A89C6B0

Function 00CA778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00CA7794

Part of subcall function 00C7DC38: timeGetTime.WINMM(?,76C1B400,00CD58AB), ref: 00C7DC3C

Sleep.KERNEL32(0000000A), ref: 00CA77C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 00CA77E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00CA7806
SetActiveWindow.USER32 ref: 00CA7825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00CA7833
SendMessageW.USER32(00000010,00000000,00000000), ref: 00CA7852
Sleep.KERNEL32(000000FA), ref: 00CA785D
IsWindow.USER32 ref: 00CA7869
EndDialog.USER32(00000000), ref: 00CA787A

Strings

BUTTON, xrefs: 00CA77F8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: d05bdff32baa6a383cbc700efc7e900aab4b07448280a5acd7ea0a25547a71a2
Instruction ID: 6af5521998cb2fff394cce92d896932ff89b8e5e3d529ade54fd66f4954c0e9f
Opcode Fuzzy Hash: d05bdff32baa6a383cbc700efc7e900aab4b07448280a5acd7ea0a25547a71a2
Instruction Fuzzy Hash: 93213BB0204346AFE7119B60ECCDB2A3F69FB56388F004124F516D62A2CB799E06DB25

Function 00CB02EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

CoInitialize.OLE32(00000000), ref: 00CB034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00CB03DE
SHGetDesktopFolder.SHELL32(?), ref: 00CB03F2
CoCreateInstance.OLE32(00CEDA8C,00000000,00000001,00D13CF8,?), ref: 00CB043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00CB04AD
CoTaskMemFree.OLE32(?,?), ref: 00CB0505
_memset.LIBCMT ref: 00CB0542
SHBrowseForFolderW.SHELL32(?), ref: 00CB057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00CB05A1
CoTaskMemFree.OLE32(00000000), ref: 00CB05A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00CB05DF
CoUninitialize.OLE32(00000001,00000000), ref: 00CB05E1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 95ba30ebffbd2a5ad60760f95764728b41c0b02c5eae297da64e31df6f42651c
Instruction ID: e790e6f0c1dc236f66d095b77fcf4450a75ecd361ccddb270e4e03bdfe75ad32
Opcode Fuzzy Hash: 95ba30ebffbd2a5ad60760f95764728b41c0b02c5eae297da64e31df6f42651c
Instruction Fuzzy Hash: A3B1D975A00109AFDB14DFA4C888EAEBBB9FF48304F148469F906EB261D770EE45DB54

Function 00CA2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CA2ED6
SetKeyboardState.USER32(?), ref: 00CA2F41
GetAsyncKeyState.USER32(000000A0), ref: 00CA2F61
GetKeyState.USER32(000000A0), ref: 00CA2F78
GetAsyncKeyState.USER32(000000A1), ref: 00CA2FA7
GetKeyState.USER32(000000A1), ref: 00CA2FB8
GetAsyncKeyState.USER32(00000011), ref: 00CA2FE4
GetKeyState.USER32(00000011), ref: 00CA2FF2
GetAsyncKeyState.USER32(00000012), ref: 00CA301B
GetKeyState.USER32(00000012), ref: 00CA3029
GetAsyncKeyState.USER32(0000005B), ref: 00CA3052
GetKeyState.USER32(0000005B), ref: 00CA3060

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 43c6af48a5e3003559b16a725de387179f1f833fcec7cfeee5e6a7cd3faa40d5
Instruction ID: d51af0fba3e279728bb62ad0a304651d4c2540b4073e41b5b7f8b5c03fb39a12
Opcode Fuzzy Hash: 43c6af48a5e3003559b16a725de387179f1f833fcec7cfeee5e6a7cd3faa40d5
Instruction Fuzzy Hash: AB51E8606047EA29FB35DBB888507EEBFB45F13348F08858DD5D25A1C2DB949B8CC761

Function 00C9ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00C9ED1E
GetWindowRect.USER32(00000000,?), ref: 00C9ED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00C9ED8E
GetDlgItem.USER32(?,00000002), ref: 00C9ED99
GetWindowRect.USER32(00000000,?), ref: 00C9EDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00C9EE01
GetDlgItem.USER32(?,000003E9), ref: 00C9EE0F
GetWindowRect.USER32(00000000,?), ref: 00C9EE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00C9EE63
GetDlgItem.USER32(?,000003EA), ref: 00C9EE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00C9EE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 00C9EE9B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d6720ec171a3d795167c804b3a2069e4565ad4bdb84ddb96903a0ebaa9ae8f1d
Instruction ID: f0417035e7d2a0a96a4d1d10f583a0dc790300cc8cd3b510aa63accab023616b
Opcode Fuzzy Hash: d6720ec171a3d795167c804b3a2069e4565ad4bdb84ddb96903a0ebaa9ae8f1d
Instruction Fuzzy Hash: 21510571B00205AFDF18CF69DD89BAEBBBAFB98701F148529F516D7290D7709E008B10

Function 00C7B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C7B759,?,00000000,?,?,?,?,00C7B72B,00000000,?), ref: 00C7BA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00C7B72B), ref: 00C7B7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,00C7B72B,00000000,?,?,00C7B2EF,?,?), ref: 00C7B88D
DestroyAcceleratorTable.USER32(00000000), ref: 00CDD8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C7B72B,00000000,?,?,00C7B2EF,?,?), ref: 00CDD8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C7B72B,00000000,?,?,00C7B2EF,?,?), ref: 00CDD8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C7B72B,00000000,?,?,00C7B2EF,?,?), ref: 00CDD90A
DeleteObject.GDI32(00000000), ref: 00CDD91C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: b14e2cc6f65c7765f59596c3bfb431f6b562ea17690d77478d401312c8108dc0
Instruction ID: cc1af9a0a72393e5b8dd26458f44c9fe0d0688d64d60182479321433ef2bd8ab
Opcode Fuzzy Hash: b14e2cc6f65c7765f59596c3bfb431f6b562ea17690d77478d401312c8108dc0
Instruction Fuzzy Hash: 54619D34500700DFDB369F15D888B29B7B5FBA0312F15852EE15B8AAA0CB31AD81DB61

Function 00C7B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00C7B526: GetWindowLongW.USER32(?,000000EB), ref: 00C7B537

GetSysColor.USER32(0000000F), ref: 00C7B438

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 7d13a9748796256acd719404f97e794c5dc7d3df23947e3baf644b88718d6ab8
Instruction ID: d4229140a60889782e5635d2fb67490625414e998252b063d7c5c7a6a0eff0e3
Opcode Fuzzy Hash: 7d13a9748796256acd719404f97e794c5dc7d3df23947e3baf644b88718d6ab8
Instruction Fuzzy Hash: D6419131500154AFDF205F29DC89BBD3B66AB46731F188265FE7A8E2E6D7308D42DB21

Function 00CA690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00CA6923
_wcscpy.LIBCMT ref: 00CA6934
__wsplitpath.LIBCMT ref: 00CA6958
__wsplitpath.LIBCMT ref: 00CA6979
_wcscpy.LIBCMT ref: 00CA699B
_wcscpy.LIBCMT ref: 00CA69B9
_wcscpy.LIBCMT ref: 00CA69C7
_wcscat.LIBCMT ref: 00CA69D6
_wcscat.LIBCMT ref: 00CA6A2B
_wcscat.LIBCMT ref: 00CA6A61
_wcscat.LIBCMT ref: 00CA6A73

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: ff2257e10c640e518be6a0ada16ac529c4897fafd355d1db2ce20a99706afa99
Instruction ID: 37d71b95a151a96b48c6e67d388e6a1df272caa72db7f6c5ce3707f15ae304f8
Opcode Fuzzy Hash: ff2257e10c640e518be6a0ada16ac529c4897fafd355d1db2ce20a99706afa99
Instruction Fuzzy Hash: B4415E7784521CAECF61EB90CC42DCB73BCEB44304F1041A6B659A2041EB70ABE99F55

Function 00CAD76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00CFDC00,00CFDC00,00CFDC00), ref: 00CAD7CE
GetDriveTypeW.KERNEL32(?,00D13A70,00000061), ref: 00CAD898
_wcscpy.LIBCMT ref: 00CAD8C2

Strings

fixed, xrefs: 00CAD816
ramdisk, xrefs: 00CAD842
removable, xrefs: 00CAD800
all, xrefs: 00CAD7D4
unknown, xrefs: 00CAD859
cdrom, xrefs: 00CAD7EA
network, xrefs: 00CAD82C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 2920e7a0a599cfce747b746e2ad2b3482a4f3d3d212bc0936df46859955503ad
Instruction ID: f7d7b69de0da27e22f51f33512a6f8e124ca1ba3492f7dfbcaef16982482890a
Opcode Fuzzy Hash: 2920e7a0a599cfce747b746e2ad2b3482a4f3d3d212bc0936df46859955503ad
Instruction Fuzzy Hash: 7151A035104301AFC710EF14D8C2AAEB7A9EF85318F10892DF5AB576A2DB31DE45DB82

Function 00C6936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00C693AB
__itow.LIBCMT ref: 00C693DF

Part of subcall function 00C81557: _xtow@16.LIBCMT ref: 00C81578

Strings

0x%p, xrefs: 00CD4CAD
True, xrefs: 00CD4C8C
False, xrefs: 00CD4C93
%.15g, xrefs: 00C693A5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 75d80bd426169c91dd53c66ada3bc509bb4dca086be2adb3b87d2b9c764b08e1
Instruction ID: 8dfdf57ddc0d0213c8a58a303e18e0d3489238dcda5aa2d4ebe8f9aa7a6f7482
Opcode Fuzzy Hash: 75d80bd426169c91dd53c66ada3bc509bb4dca086be2adb3b87d2b9c764b08e1
Instruction Fuzzy Hash: AE41E432514204EFDB28EB74D982E6A77ECEF84300F24447FE65AD7291EA31DA42DB10

Function 00CCA1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00CCA259
CreateCompatibleDC.GDI32(00000000), ref: 00CCA260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00CCA273
SelectObject.GDI32(00000000,00000000), ref: 00CCA27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00CCA286
DeleteDC.GDI32(00000000), ref: 00CCA28F
GetWindowLongW.USER32(?,000000EC), ref: 00CCA299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00CCA2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00CCA2B9

Strings

static, xrefs: 00CCA1F1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: d009e4e5d7ba2e68e04761dbea874874a3485d6ce48b3b4bb3ce075425e67236
Instruction ID: aaaaba0d92a0bd322e2b48e94762f04c47b4ad37842c3d55978c0a71847d1355
Opcode Fuzzy Hash: d009e4e5d7ba2e68e04761dbea874874a3485d6ce48b3b4bb3ce075425e67236
Instruction Fuzzy Hash: 97318D32100219BFDF215FA4DC49FEE3B69FF19364F100218FA2AAA0A0C731D911DBA5

Function 00CA6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00CA6F1D
gethostname.WSOCK32(?,00000100), ref: 00CA6F37
gethostbyname.WSOCK32(?), ref: 00CA6F44
_wcscpy.LIBCMT ref: 00CA6F6C
inet_ntoa.WSOCK32(?), ref: 00CA6F8A
_strcat.LIBCMT ref: 00CA6F98
_wcscpy.LIBCMT ref: 00CA6FAF
WSACleanup.WSOCK32 ref: 00CA6FBD
_wcscpy.LIBCMT ref: 00CA6FCB

Strings

0.0.0.0, xrefs: 00CA6F66

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: 1dd13e7726d04a91d8cc8cf4f93365bf5dac011b82593145c8703d6edc5f99d6
Instruction ID: f73b1ec74efc4d08c9fccc5493b56c0f5aac99383b8faf0e824a579aa193641d
Opcode Fuzzy Hash: 1dd13e7726d04a91d8cc8cf4f93365bf5dac011b82593145c8703d6edc5f99d6
Instruction Fuzzy Hash: 6F110672504216AFCB24ABB0EC4AFDE77ACEF41718F140069F116AA081EF70EA859B51

Function 00C8500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C85047

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

__gmtime64_s.LIBCMT ref: 00C850E0
__gmtime64_s.LIBCMT ref: 00C85116
__gmtime64_s.LIBCMT ref: 00C85133
__allrem.LIBCMT ref: 00C85189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C851A5
__allrem.LIBCMT ref: 00C851BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C851DA
__allrem.LIBCMT ref: 00C851F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C8520F
__invoke_watson.LIBCMT ref: 00C85280

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 33f7890e018ffc4d5e10b983a395192f889cf37cd333bc653536f622624fb9b3
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: 9871ED71A01F17ABDB14BE79CC86BAA73A8BF01768F144129F910D7281EBB0DE4097D4

Function 00CA4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA4DF8
GetMenuItemInfoW.USER32(00D21708,000000FF,00000000,00000030), ref: 00CA4E59
SetMenuItemInfoW.USER32(00D21708,00000004,00000000,00000030), ref: 00CA4E8F
Sleep.KERNEL32(000001F4), ref: 00CA4EA1
GetMenuItemCount.USER32(?), ref: 00CA4EE5
GetMenuItemID.USER32(?,00000000), ref: 00CA4F01
GetMenuItemID.USER32(?,-00000001), ref: 00CA4F2B
GetMenuItemID.USER32(?,?), ref: 00CA4F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00CA4FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CA4FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CA4FEB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 2566825cb2ab6dffe81d3b388442a0e8d9cd9306be6859c0406e1a1070b133b1
Instruction ID: 6e74c3ed19379d8414290e426073837fa05ea5b55a62a3def2eb83851728b50c
Opcode Fuzzy Hash: 2566825cb2ab6dffe81d3b388442a0e8d9cd9306be6859c0406e1a1070b133b1
Instruction Fuzzy Hash: 2161A3B150038AAFDF24CFA8DD84AAEBBB8FB8230CF144059F41297251D7B19E45DB21

Function 00CC9C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00CC9C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00CC9C9B
GetWindowLongW.USER32(?,000000F0), ref: 00CC9CBF
_memset.LIBCMT ref: 00CC9CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00CC9CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00CC9D5A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 88e100b946ddcf704ba72646ab3b5d1dbe32227b116c3923f2da67eb93b4afea
Instruction ID: 1814fe01d633dd62c87afad5eeb85b2e0164d1dcbd0857c07548f3030ec0a5f2
Opcode Fuzzy Hash: 88e100b946ddcf704ba72646ab3b5d1dbe32227b116c3923f2da67eb93b4afea
Instruction Fuzzy Hash: E6618C75900208AFDB20DFA4CC85FEE77B8EB19704F104159FA15E7291C770AE42DB60

Function 00C994E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00C994FE
SafeArrayAllocData.OLEAUT32(?), ref: 00C99549
VariantInit.OLEAUT32(?), ref: 00C9955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 00C9957B
VariantCopy.OLEAUT32(?,?), ref: 00C995BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 00C995D2
VariantClear.OLEAUT32(?), ref: 00C995E7
SafeArrayDestroyData.OLEAUT32(?), ref: 00C995F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C995FD
VariantClear.OLEAUT32(?), ref: 00C9960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C9961A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 36433cfab3c7e7c0e4b424150591072fa5f4ba2c2ed05e65992fe5844aaa7a54
Instruction ID: 5b05911339375e2b740a07097e02b0fe2cc1a14e42a22bfe9a6c53e5d39733b8
Opcode Fuzzy Hash: 36433cfab3c7e7c0e4b424150591072fa5f4ba2c2ed05e65992fe5844aaa7a54
Instruction Fuzzy Hash: D5411E31900219AFDF01DFA8D888ADEBB79FF18354F008069F516A7251DB31EA45DBA1

Function 00CBADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

CoInitialize.OLE32 ref: 00CBADF6
CoUninitialize.OLE32 ref: 00CBAE01
CoCreateInstance.OLE32(?,00000000,00000017,00CED8FC,?), ref: 00CBAE61
IIDFromString.OLE32(?,?), ref: 00CBAED4
VariantInit.OLEAUT32(?), ref: 00CBAF6E
VariantClear.OLEAUT32(?), ref: 00CBAFCF

Strings

NULL Pointer assignment, xrefs: 00CBAEA6
Failed to create object, xrefs: 00CBAE6C, 00CBAF22
Invalid parameter, xrefs: 00CBAEED

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: bf0df4c34c6c846245d28af9fb90a20683d7a644c7b0552f95aa26f531392dfa
Instruction ID: 0ceb084d0eaba8b1c7c105f4796f363229f5ec2fee5bb82f95b554a379fd8775
Opcode Fuzzy Hash: bf0df4c34c6c846245d28af9fb90a20683d7a644c7b0552f95aa26f531392dfa
Instruction Fuzzy Hash: 2061AE70208341AFC720DF95C889BAEB7E8EF49714F104419F9869B291C770EE44CB93

Function 00CB8107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00CB8168
inet_addr.WSOCK32(?,?,?), ref: 00CB81AD
gethostbyname.WSOCK32(?), ref: 00CB81B9
IcmpCreateFile.IPHLPAPI ref: 00CB81C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00CB8237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00CB824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00CB82C2
WSACleanup.WSOCK32 ref: 00CB82C8

Strings

Ping, xrefs: 00CB81EB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 555030664d9fb4f02c41b5a3641c054cfcfdfe59993bbd106fcff01ff3ddef1e
Instruction ID: a5c44f7e85a1b1d0d821cd63eaf0ae3c1611145a010aed8698928a7b3418fc90
Opcode Fuzzy Hash: 555030664d9fb4f02c41b5a3641c054cfcfdfe59993bbd106fcff01ff3ddef1e
Instruction Fuzzy Hash: 985170316047019FD7209F65CC85BAEB7E8EF48720F048969F96ADB2E1DB70E905DB42

Function 00CAE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CAE396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00CAE40C
GetLastError.KERNEL32 ref: 00CAE416
SetErrorMode.KERNEL32(00000000,READY), ref: 00CAE483

Strings

READONLY, xrefs: 00CAE44E
NOTREADY, xrefs: 00CAE442
READY, xrefs: 00CAE45C
UNKNOWN, xrefs: 00CAE43B
INVALID, xrefs: 00CAE455

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 7e94c295e170308664396375143e7dda3cddc6eb6ddfab630648737d22b1d479
Instruction ID: 2474cd7aa2c60d97a22c7821dce1bb0d5f0284435924326e4c62aa2406ddf2b3
Opcode Fuzzy Hash: 7e94c295e170308664396375143e7dda3cddc6eb6ddfab630648737d22b1d479
Instruction Fuzzy Hash: E931A635A0020AAFDB11EFA8D885BBDB7B8EF5A308F148015E515EB291DB70DE41D7D1

Function 00C9B907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00C9B98C
GetDlgCtrlID.USER32 ref: 00C9B997
GetParent.USER32 ref: 00C9B9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C9B9B6
GetDlgCtrlID.USER32(?), ref: 00C9B9BF
GetParent.USER32(?), ref: 00C9B9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C9B9DE

Strings

ComboBox, xrefs: 00C9B911
ListBox, xrefs: 00C9B949

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 1bf736ea3a9576afbc18cfb66caeb5db0ef88af49fd51ed03872c0a40e6ca8b6
Instruction ID: 32874b462572981e43e6541eb17e0de0f1206130767066cfa5a6ae5fbe2b4b84
Opcode Fuzzy Hash: 1bf736ea3a9576afbc18cfb66caeb5db0ef88af49fd51ed03872c0a40e6ca8b6
Instruction Fuzzy Hash: 292174B4900204BFDF04ABA5DCC5FFEB779EF45310B104115F662A7291DB7559159B20

Function 00C9B9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00C9BA73
GetDlgCtrlID.USER32 ref: 00C9BA7E
GetParent.USER32 ref: 00C9BA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C9BA9D
GetDlgCtrlID.USER32(?), ref: 00C9BAA6
GetParent.USER32(?), ref: 00C9BAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C9BAC5

Strings

ComboBox, xrefs: 00C9B9FA
ListBox, xrefs: 00C9BA32

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 342f9280c33c8e89dc6abc09f67272a513c9caa568fdff03bc91efbd56a789b4
Instruction ID: ef28d40e4050e82d330690aaa35110270517ff7cda21ea94c680a37206440225
Opcode Fuzzy Hash: 342f9280c33c8e89dc6abc09f67272a513c9caa568fdff03bc91efbd56a789b4
Instruction Fuzzy Hash: 5C2192B4A40208BFDF01ABA4DCC9FFEBB79EF45300F104015F562A7191DBBA5919AB20

Function 00C9BAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00C9BAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 00C9BAF8
_wcscmp.LIBCMT ref: 00C9BB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00C9BB85

Strings

list, xrefs: 00C9BB67
smallicons, xrefs: 00C9BB4D
largeicons, xrefs: 00C9BB19
SHELLDLL_DefView, xrefs: 00C9BB04
details, xrefs: 00C9BB33

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: fdc0de2e15d1ff552abc203f3fee0f9a0f58389c9386a9995b9a75576f5beda3
Instruction ID: 063874f3a5f6c50cf106a7f3466c1389fd31f5d6fc697d3541b4b3ad7ab241c8
Opcode Fuzzy Hash: fdc0de2e15d1ff552abc203f3fee0f9a0f58389c9386a9995b9a75576f5beda3
Instruction Fuzzy Hash: 7811E376648307FFFE246625BC0BEAA379C9F11728F200022FA15E50D5EFA26D655628

Function 00CBB2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CBB2D5
CoInitialize.OLE32(00000000), ref: 00CBB302
CoUninitialize.OLE32 ref: 00CBB30C
GetRunningObjectTable.OLE32(00000000,?), ref: 00CBB40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 00CBB539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00CBB56D
CoGetObject.OLE32(?,00000000,00CED91C,?), ref: 00CBB590
SetErrorMode.KERNEL32(00000000), ref: 00CBB5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00CBB623
VariantClear.OLEAUT32(00CED91C), ref: 00CBB633

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: b61e9543d50e3edcb12c0bc6bfd91754da390da60cd67054b87dbf27e84cf754
Instruction ID: 3759fa06a3237a1c1642e2696723fc438d3c3d61efea5578ed903867b120a997
Opcode Fuzzy Hash: b61e9543d50e3edcb12c0bc6bfd91754da390da60cd67054b87dbf27e84cf754
Instruction Fuzzy Hash: 57C123B1608345AFC710DF69C884A6BB7E9FF88304F04491DF58A9B261DBB1ED05CB92

Function 00CA67E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CA67FD
__swprintf.LIBCMT ref: 00CA680A

Part of subcall function 00C8172B: __woutput_l.LIBCMT ref: 00C81784

FindResourceW.KERNEL32(?,?,0000000E), ref: 00CA6834
LoadResource.KERNEL32(?,00000000), ref: 00CA6840
LockResource.KERNEL32(00000000), ref: 00CA684D
FindResourceW.KERNEL32(?,?,00000003), ref: 00CA686D
LoadResource.KERNEL32(?,00000000), ref: 00CA687F
SizeofResource.KERNEL32(?,00000000), ref: 00CA688E
LockResource.KERNEL32(?), ref: 00CA689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00CA68F9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 98386e35d97a92887333dfa5335c6fefc4e5fff2b15d169f656b8a1d16f00aad
Instruction ID: 4704a22c165f639b3c2decb3c0bc6c203f1533edd0f9206476996ffa712840ba
Opcode Fuzzy Hash: 98386e35d97a92887333dfa5335c6fefc4e5fff2b15d169f656b8a1d16f00aad
Instruction Fuzzy Hash: D031807190025BABDB119F61DD85BBF7BACEF09348F048425F912D6190E738DA11DB70

Function 00CA4025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CA4047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00CA30A5,?,00000001), ref: 00CA405B
GetWindowThreadProcessId.USER32(00000000), ref: 00CA4062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CA30A5,?,00000001), ref: 00CA4071
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CA4083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00CA30A5,?,00000001), ref: 00CA409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CA30A5,?,00000001), ref: 00CA40AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00CA30A5,?,00000001), ref: 00CA40F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00CA30A5,?,00000001), ref: 00CA4108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00CA30A5,?,00000001), ref: 00CA4113

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: df6ca5fc99b5e1f3e88559191d068937ec1fff8e9ffd9e6b4eec3d8f198dcaa9
Instruction ID: 1808e7916e244d3ffa6f9339f45dfe16f88c5a25654cb53d7c09eced2abbe38d
Opcode Fuzzy Hash: df6ca5fc99b5e1f3e88559191d068937ec1fff8e9ffd9e6b4eec3d8f198dcaa9
Instruction Fuzzy Hash: 1A31D571500305EFDB25DF54DC85B6D77ADBBA131AF10800AFA15DA290CBF9DE819B60

Function 00C9CB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00C9CF50), ref: 00C9CE90

Strings

INSTANCE, xrefs: 00C9CD9E
TEXT, xrefs: 00C9CDC7
CLASSNN, xrefs: 00C9CC33
REGEXPCLASS, xrefs: 00C9CC56
CLASS, xrefs: 00C9CC10
NAME, xrefs: 00C9CCC2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: fa4636dd625b023eed5271b2a5054d06db9927d38b1d2e94c97533b60fc9b493
Instruction ID: 952ddf4d3ac647aed1ea3125b219f4fa275a789fd8f2696c846da89861001195
Opcode Fuzzy Hash: fa4636dd625b023eed5271b2a5054d06db9927d38b1d2e94c97533b60fc9b493
Instruction Fuzzy Hash: 6E918431604506ABCF18DF60C4C5BEAFB79FF04300F548559E85AA7291DF306AAADBE0

Function 00C63093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00C630DC
CoUninitialize.OLE32(?,00000000), ref: 00C63181
UnregisterHotKey.USER32(?), ref: 00C632A9
DestroyWindow.USER32(?), ref: 00CD5079
FreeLibrary.KERNEL32(?), ref: 00CD50F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00CD5125

Strings

close all, xrefs: 00C630D7

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: d2ee8c66a3f5d2dd15b1713d05bb7a2f1a7d4aa58e4dbd23eca1eed40b090640
Instruction ID: ec215fcb46f2559beb37f7b055371ed89372b9fa286ca726576e77800551ac73
Opcode Fuzzy Hash: d2ee8c66a3f5d2dd15b1713d05bb7a2f1a7d4aa58e4dbd23eca1eed40b090640
Instruction Fuzzy Hash: 1C912A74600282CFC725EF14C9D5B68F3A4FF15304F5482A9E51AAB2A2DF30AE5ADF54

Function 00C7CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00C7CC15

Part of subcall function 00C7CCCD: GetClientRect.USER32(?,?), ref: 00C7CCF6
Part of subcall function 00C7CCCD: GetWindowRect.USER32(?,?), ref: 00C7CD37
Part of subcall function 00C7CCCD: ScreenToClient.USER32(?,?), ref: 00C7CD5F

GetDC.USER32 ref: 00CDD137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00CDD14A
SelectObject.GDI32(00000000,00000000), ref: 00CDD158
SelectObject.GDI32(00000000,00000000), ref: 00CDD16D
ReleaseDC.USER32(?,00000000), ref: 00CDD175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00CDD200

Strings

U, xrefs: 00CDD0D5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: e7b9265e240a0059652bf70a79eff0439294899d9e93c3f070eba40158ffaf65
Instruction ID: befd82d5a03dee4dd7679ce55bce1aef071dfbcc0d5d21a8ca438194cd5065f8
Opcode Fuzzy Hash: e7b9265e240a0059652bf70a79eff0439294899d9e93c3f070eba40158ffaf65
Instruction Fuzzy Hash: 9C71C031800205DFCF219F64CC81AAE7BB5FF59364F14826AEE6A5A2A5C7319D41DB60

Function 00CCECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

Part of subcall function 00C7B63C: GetCursorPos.USER32(000000FF), ref: 00C7B64F
Part of subcall function 00C7B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00C7B66C
Part of subcall function 00C7B63C: GetAsyncKeyState.USER32(00000001), ref: 00C7B691
Part of subcall function 00C7B63C: GetAsyncKeyState.USER32(00000002), ref: 00C7B69F

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 00CCED3C
ImageList_EndDrag.COMCTL32 ref: 00CCED42
ReleaseCapture.USER32 ref: 00CCED48
SetWindowTextW.USER32(?,00000000), ref: 00CCEDF0
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00CCEE03
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 00CCEEDC

Strings

@GUI_DRAGFILE, xrefs: 00CCEE77
@GUI_DROPID, xrefs: 00CCEE33

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 37e537247bf1865520834d14cff612467d89bd413bb7b6002b141f9a937cfee2
Instruction ID: bb260deac94c727d0129fc03ebb7519c118b7dc09e3740f8c085513b2a1a02ea
Opcode Fuzzy Hash: 37e537247bf1865520834d14cff612467d89bd413bb7b6002b141f9a937cfee2
Instruction Fuzzy Hash: A0519974204304AFD720DF20DC8AFAE77E5EB98704F00892DF596972E2DB719909DB62

Function 00CB45C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00CB45FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00CB462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00CB466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00CB4682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CB468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00CB46BF
InternetCloseHandle.WININET(00000000), ref: 00CB4706

Part of subcall function 00CB5052: GetLastError.KERNEL32(?,?,00CB43CC,00000000,00000000,00000001), ref: 00CB5067

Strings

, xrefs: 00CB46B8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 343cb38d5c1922ecd56f254c02da71bfd5a72974b96282ec15aacf2d6dad9216
Instruction ID: 314d9b23a2b41f12efc7a882195b42e8e92f42b8f9994471bb2b616f9bb04c43
Opcode Fuzzy Hash: 343cb38d5c1922ecd56f254c02da71bfd5a72974b96282ec15aacf2d6dad9216
Instruction Fuzzy Hash: 69417CB1505619BFEB159F50CC89FFE77ACEF09305F004016FA159A186DBB09E449BA4

Function 00CBB644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00CFDC00), ref: 00CBB715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00CFDC00), ref: 00CBB749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00CBB8C1
SysFreeString.OLEAUT32(?), ref: 00CBB8EB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: b1a153ab2d3baeb4d986cd34676d893a1bc48323882e21c8c5d802ede6dc7b16
Instruction ID: 46abfcd00671e26f6f5acd5ff1a534e9f706602b1113f8d8234fc1dbd1dbd92a
Opcode Fuzzy Hash: b1a153ab2d3baeb4d986cd34676d893a1bc48323882e21c8c5d802ede6dc7b16
Instruction Fuzzy Hash: 96F11875A00209AFCF14DF94C888EEEB7B9FF49315F108458F915AB250DB71AE45DB90

Function 00CC24D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CC24F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CC2688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CC26AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CC26EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CC270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00CC286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00CC28A1
CloseHandle.KERNEL32(?), ref: 00CC28D0
CloseHandle.KERNEL32(?), ref: 00CC2947

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 86a4e79db6a7db48e675d202eb9fe874b697f6b76d3d32ce44641a2d30fa9ec2
Instruction ID: 4a20b7d2bf10ff7e7e3e6bb17241331aac3a63add4b9aad5c2c42a283cd96a83
Opcode Fuzzy Hash: 86a4e79db6a7db48e675d202eb9fe874b697f6b76d3d32ce44641a2d30fa9ec2
Instruction Fuzzy Hash: 75D1BC31604201DFCB14EF24C891F6EBBE5AF85314F14846DF89A9B2A2DB31ED45DB52

Function 00CCB33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00CCB3F4

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 6965484e580cb5443cc9e6a1f16559b68e8926d14e62ccbfb68d624dbed57c90
Instruction ID: 5fac9e131c4ab6dd0da2beea1013e9f60fdeaa223ef7e5dd8d99d4f4425557ba
Opcode Fuzzy Hash: 6965484e580cb5443cc9e6a1f16559b68e8926d14e62ccbfb68d624dbed57c90
Instruction Fuzzy Hash: FD51A230504254BFEF249FA9CD86FAD3B68BF05314F28401AF625D62E2DB71EE849B51

Function 00C7A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00CDDB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00CDDB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00CDDB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00CDDB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00CDDB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00C7A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00CDDBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00CDDBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00C7A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00CDDBC8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: dd8e3c83c8d37cea5f1a821419b1ef207b4bf5edd812c89b9359bd9485136353
Instruction ID: 628e5b6258f91c16ac6ea0c0166e0fb846917734bc12fbad32332c1df8793466
Opcode Fuzzy Hash: dd8e3c83c8d37cea5f1a821419b1ef207b4bf5edd812c89b9359bd9485136353
Instruction Fuzzy Hash: 00516B70A00309EFDB24DF65CC81FAE77B8BB58754F10851AFA5A9A290D7B0AD80DB50

Function 00CA7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CA5FA6,?), ref: 00CA6ED8

Part of subcall function 00CA6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CA5FA6,?), ref: 00CA6EF1

Part of subcall function 00CA72CB: GetFileAttributesW.KERNEL32(?,00CA6019), ref: 00CA72CC

lstrcmpiW.KERNEL32(?,?), ref: 00CA75CA
_wcscmp.LIBCMT ref: 00CA75E2
MoveFileW.KERNEL32(?,?), ref: 00CA75FB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 71b0919cd3cc88d4ded7e92810770b099ef4360b11484115dc92fd8280b6da79
Instruction ID: a07fd7617ca2efe51fe08a6adf83edd96def6a8fecfbd6e7ee466045a8934149
Opcode Fuzzy Hash: 71b0919cd3cc88d4ded7e92810770b099ef4360b11484115dc92fd8280b6da79
Instruction Fuzzy Hash: 585143B2A092199EDF50EB94DC41DDE73BCAF09314F1041AAFA05E3041EA74D7C9CB64

Function 00C7EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00CDDAD1,00000004,00000000,00000000), ref: 00C7EAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00CDDAD1,00000004,00000000,00000000), ref: 00C7EB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00CDDAD1,00000004,00000000,00000000), ref: 00CDDC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00CDDAD1,00000004,00000000,00000000), ref: 00CDDCF2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 51a3b2dc2c420268930206d9e9176e639e15ad60f5c29eacf948bbdf66a735a9
Instruction ID: 8e2e17be702e1fe887a350eddfb4a785ea6d6060138bbf2917552bd7b5c8c7d7
Opcode Fuzzy Hash: 51a3b2dc2c420268930206d9e9176e639e15ad60f5c29eacf948bbdf66a735a9
Instruction Fuzzy Hash: 80413B326143809BC7354B29CDCDB3A7F95FB99311F19888EF16F86661C670B980D318

Function 00C9B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00C9AEF1,00000B00,?,?), ref: 00C9B26C
HeapAlloc.KERNEL32(00000000,?,00C9AEF1,00000B00,?,?), ref: 00C9B273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C9AEF1,00000B00,?,?), ref: 00C9B288
GetCurrentProcess.KERNEL32(?,00000000,?,00C9AEF1,00000B00,?,?), ref: 00C9B290
DuplicateHandle.KERNEL32(00000000,?,00C9AEF1,00000B00,?,?), ref: 00C9B293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00C9AEF1,00000B00,?,?), ref: 00C9B2A3
GetCurrentProcess.KERNEL32(00C9AEF1,00000000,?,00C9AEF1,00000B00,?,?), ref: 00C9B2AB
DuplicateHandle.KERNEL32(00000000,?,00C9AEF1,00000B00,?,?), ref: 00C9B2AE
CreateThread.KERNEL32(00000000,00000000,00C9B2D4,00000000,00000000,00000000), ref: 00C9B2C8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 3277211f8458b66c174c6df1217c3f6ac9ef774efce07f59daeb6850bc53bdb7
Instruction ID: 9cf9bbd302879180ba1e3b04503666ca3dece62c2dfa8e58cbd9bc72a760b471
Opcode Fuzzy Hash: 3277211f8458b66c174c6df1217c3f6ac9ef774efce07f59daeb6850bc53bdb7
Instruction Fuzzy Hash: 6701BBB5240344BFE710ABA5DD8DF6F7BACEB88711F018411FA15DF1A1CA759800CB61

Function 00CBC43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00CBC876, 00CBC887
Not an Object type, xrefs: 00CBC49E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: c604841bfef7aea5d38a5c36244e3d0ba9eb4897c5a76977164d7e182b6e955f
Instruction ID: 699f5700ba3253fe83111f9523eee2c2757ff1da0f9e3ec9d3a6242dcad47003
Opcode Fuzzy Hash: c604841bfef7aea5d38a5c36244e3d0ba9eb4897c5a76977164d7e182b6e955f
Instruction Fuzzy Hash: 4BE1B371A0021AAFDF14DFA8C8C5BEE77B5EF48314F148029F915AB281D771AE45DB90

Function 00CBBB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CBBB5C
VariantInit.OLEAUT32(?), ref: 00CBBC2D
VariantInit.OLEAUT32(?), ref: 00CBBD2E
VariantClear.OLEAUT32(?), ref: 00CBBD38
VariantClear.OLEAUT32(?), ref: 00CBBD99

Strings

Null Object assignment in FOR..IN loop, xrefs: 00CBBBBD, 00CBBCEB, 00CBBDA7
Incorrect Object type in FOR..IN loop, xrefs: 00CBBD11

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: e3f2f60d2b6806140c45c997fab92a0339697d856e6dd7b7f60b2a82e0a1f1e5
Instruction ID: 11a44387c4144a7dcd4fc7a5ec8c58951408cb4767310ef55a5aecc7613ac0a5
Opcode Fuzzy Hash: e3f2f60d2b6806140c45c997fab92a0339697d856e6dd7b7f60b2a82e0a1f1e5
Instruction Fuzzy Hash: 1C917C71A00219ABDF24CFA5C844FEEBBB8EF45710F108559F515AB284DBB49E45CBA0

Function 00CC9A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00CC9B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 00CC9B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00CC9B47
_wcscat.LIBCMT ref: 00CC9BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00CC9BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00CC9BE7

Strings

SysListView32, xrefs: 00CC9AEB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: a3f0a8c3bc27eb94a25b07095b2c59615afcd05b0e2a86c6f14429bbbfd1d15f
Instruction ID: 3c4f25b931e5295494338596a60c91432678910a24395977ae1599d44f484338
Opcode Fuzzy Hash: a3f0a8c3bc27eb94a25b07095b2c59615afcd05b0e2a86c6f14429bbbfd1d15f
Instruction Fuzzy Hash: 6141BE71A00308AFDB219FA4DC89FEE77A8EF08350F10482AF559E7291C6719E85DB60

Function 00CC172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00CA6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00CA6554
Part of subcall function 00CA6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00CA6564
Part of subcall function 00CA6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00CA65F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CC179A
GetLastError.KERNEL32 ref: 00CC17AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CC17D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 00CC1855
GetLastError.KERNEL32(00000000), ref: 00CC1860
CloseHandle.KERNEL32(00000000), ref: 00CC1895

Strings

SeDebugPrivilege, xrefs: 00CC17B8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f0ac945e4f79f54a8ccec262d6faa13b465ca657768d985061f25c2318a01295
Instruction ID: ce72b1317f632e126c4d1ec7caa8e7090219d33eebd98eeb4fa52ed2394625fa
Opcode Fuzzy Hash: f0ac945e4f79f54a8ccec262d6faa13b465ca657768d985061f25c2318a01295
Instruction Fuzzy Hash: A041B971600201AFEB05EF95CCE5F6DB7A1AF15310F098058F9069F2D2DB79AA00DB95

Function 00CA5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00CA58B8

Strings

blank, xrefs: 00CA583A
warning, xrefs: 00CA58A1
question, xrefs: 00CA5871
info, xrefs: 00CA5859
stop, xrefs: 00CA5889

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 9441dbb9a9efff9f4b9a18b277ac21a4e92c6f52f77618ee7f48145370b9f55b
Instruction ID: 58347811181716fff9c8fc2e42c86da6a60020e804dd957b0e420037e263979e
Opcode Fuzzy Hash: 9441dbb9a9efff9f4b9a18b277ac21a4e92c6f52f77618ee7f48145370b9f55b
Instruction Fuzzy Hash: 69110D36749747BEE7055B559C82DAE339C9F1631CF30803AF611E52C1E778AB444368

Function 00CAA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00CAA806

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: ad5f60bac5bddf6570ab91a69b3db702e462474e8481fb11578a40e419bb3828
Instruction ID: 277ff0e94aba09d568a0368970652a712cf29b72b6d0b509327dab1c78ebbc63
Opcode Fuzzy Hash: ad5f60bac5bddf6570ab91a69b3db702e462474e8481fb11578a40e419bb3828
Instruction Fuzzy Hash: B3C16E7590021A9FDB00DF94C485BAEB7F4FF0A319F20846AE616E7281D735AE41DF91

Function 00CA6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00CA6B63
LoadStringW.USER32(00000000), ref: 00CA6B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00CA6B80
LoadStringW.USER32(00000000), ref: 00CA6B87
_wprintf.LIBCMT ref: 00CA6BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CA6BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00CA6BA8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: da6b9b9a936c361a7ac9c6deb2ffae64c9e2032c465bfa2893d76c919b552624
Instruction ID: 723b5165537e1dc829bcdc49ff35419c60b5f33c7a6a7feead149eeafcdbd9b2
Opcode Fuzzy Hash: da6b9b9a936c361a7ac9c6deb2ffae64c9e2032c465bfa2893d76c919b552624
Instruction Fuzzy Hash: 29016DF2900248BFEB11ABA09DC9FFA336CD708304F0044A1BB56EA041EA749E848F74

Function 00CC2B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CC2BB5,?,?), ref: 00CC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CC2BF6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: e5efa60553986ea39ab8b92323839081e042ad662a71a5209ec7533a4f163a3c
Instruction ID: e3ea05f166b8d50ddcbe8d331383d0fdac71c27f18ba9d6610ab056155106ee9
Opcode Fuzzy Hash: e5efa60553986ea39ab8b92323839081e042ad662a71a5209ec7533a4f163a3c
Instruction Fuzzy Hash: A1919A316042019FDB11EF54C891F6EB7E5FF98310F04881DF99A9B2A2DB35EA05EB42

Function 00CB95BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 00CB9691
WSAGetLastError.WSOCK32(00000000), ref: 00CB969E
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 00CB96C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00CB96E9
WSAGetLastError.WSOCK32(00000000), ref: 00CB96F8
htons.WSOCK32(?,?,?,00000000,?), ref: 00CB97AA
inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,00CFDC00), ref: 00CB9765

Part of subcall function 00C9D2FF: _strlen.LIBCMT ref: 00C9D309

_strlen.LIBCMT ref: 00CB9800

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorLast_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3480843537-0
Opcode ID: d218bdc7c9d0f00ed90f1cf86a799c4ca8d9f7c904ab22882ad56d93b3fe4755
Instruction ID: 7d65d558b2175b5d6574435b88ac19215add191c97498b30a59b2e5d7e600a54
Opcode Fuzzy Hash: d218bdc7c9d0f00ed90f1cf86a799c4ca8d9f7c904ab22882ad56d93b3fe4755
Instruction Fuzzy Hash: 1C81AE71504240ABC724EF64CCC5FABB7E8EB89714F14461DF6569B291EB30DD04DB92

Function 00C8A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 00C8A991

Part of subcall function 00C87D7C: __FF_MSGBANNER.LIBCMT ref: 00C87D91
Part of subcall function 00C87D7C: __NMSG_WRITE.LIBCMT ref: 00C87D98
Part of subcall function 00C87D7C: __malloc_crt.LIBCMT ref: 00C87DB8

__lock.LIBCMT ref: 00C8A9A4
__lock.LIBCMT ref: 00C8A9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00D16DE0,00000018,00C95E7B,?,00000000,00000109), ref: 00C8AA0C
EnterCriticalSection.KERNEL32(8000000C,00D16DE0,00000018,00C95E7B,?,00000000,00000109), ref: 00C8AA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 00C8AA39

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: e9cc4d10d98730b8cd60edd26b7665ef3fdc66453a0d7bf72277d0342431f449
Instruction ID: e320bb64bde013bba0f5b68affc308469952c50071d93a64cbeff51754277a6a
Opcode Fuzzy Hash: e9cc4d10d98730b8cd60edd26b7665ef3fdc66453a0d7bf72277d0342431f449
Instruction Fuzzy Hash: 92412A719003019BFB28AF68D9447ACBBB0AF0532DF14431AE426AB6D1D7749941DF9A

Function 00CC8ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00CC8EE4
GetDC.USER32(00000000), ref: 00CC8EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CC8EF7
ReleaseDC.USER32(00000000,00000000), ref: 00CC8F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00CC8F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CC8F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00CCBD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00CC8F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00CC8FAA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 5aca96f8ceb1fb4664bb0aadc2521754c32b2da9dee982b827c06a59e67f5cfe
Instruction ID: a9eb344dca2ae51d6d32df68f95c66a3a5f1e80fc0ded93218779259a469d793
Opcode Fuzzy Hash: 5aca96f8ceb1fb4664bb0aadc2521754c32b2da9dee982b827c06a59e67f5cfe
Instruction Fuzzy Hash: 9B316B72200254BFEB108F50CC8AFEB3BAEEF49715F084069FE099E191CAB59841CB74

Function 00CB16DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

Part of subcall function 00C7C6F4: _wcscpy.LIBCMT ref: 00C7C717

_wcstok.LIBCMT ref: 00CB184E
_wcscpy.LIBCMT ref: 00CB18DD
_memset.LIBCMT ref: 00CB1910

Strings

X, xrefs: 00CB1948

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 360f780a5326ebe81a84b9fa591cc172ef6b3393fc6d491608ddef0360638c7f
Instruction ID: 35af9653a0bb63d81adf85a8b7398d95e476c00e18f0c68ae6cf12efe4c90ec4
Opcode Fuzzy Hash: 360f780a5326ebe81a84b9fa591cc172ef6b3393fc6d491608ddef0360638c7f
Instruction Fuzzy Hash: F7C17C316043409FC724EF24C891AAEB7E4BF85350F54492DF89A9B2A2DB30ED45DB82

Function 00CD0133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

GetSystemMetrics.USER32(0000000F), ref: 00CD016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00CD038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00CD03AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 00CD03D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00CD03FF
ShowWindow.USER32(00000003,00000000), ref: 00CD0421
DefDlgProcW.USER32(?,00000005,?,?), ref: 00CD0440

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: 1ce9b11ad0bb649d9a660c01267d9d976207b00a047a6276f2c94cc03aad3c27
Instruction ID: 2e3de0f4f1c2cf46da13ffceb57e8fe2cba9ee2a31c245e6b77fd34b9736fc97
Opcode Fuzzy Hash: 1ce9b11ad0bb649d9a660c01267d9d976207b00a047a6276f2c94cc03aad3c27
Instruction Fuzzy Hash: 08A18E35600616EBDB18CF6CC9857BEBBB1BF44701F24811AEA65AB390D774AE50CB90

Function 00C7AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7843ef4a4046f59bc26b0665d1fe96560a4746559eb4f6f4bab23ced060a78
Instruction ID: 92369310985999a8d849a41cfec63173188f43e2fa07129b2c1d34a3b5ce258e
Opcode Fuzzy Hash: 0e7843ef4a4046f59bc26b0665d1fe96560a4746559eb4f6f4bab23ced060a78
Instruction Fuzzy Hash: 13715AB1900109EFCB14DF99CC89ABEBB74FF85314F24C149F929AB251C730AA51CB61

Function 00CC2230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CC225A
_memset.LIBCMT ref: 00CC2323
ShellExecuteExW.SHELL32(?), ref: 00CC2368

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

Part of subcall function 00C7C6F4: _wcscpy.LIBCMT ref: 00C7C717

CloseHandle.KERNEL32(00000000), ref: 00CC242F
FreeLibrary.KERNEL32(00000000), ref: 00CC243E

Strings

@, xrefs: 00CC2334

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: b147ddb0aea62996cbdab0b8e57df608ffff7dcd4c02722881ef17c49c170b0f
Instruction ID: 1dfbed7db0c5bdbfd18f448ada37fd1d678d37a5df281dbf827368fcb12b8456
Opcode Fuzzy Hash: b147ddb0aea62996cbdab0b8e57df608ffff7dcd4c02722881ef17c49c170b0f
Instruction Fuzzy Hash: 95715C74A006199FCF15EFA4C881A9EBBF5FF48310F148459E85AAB361CB34AE41DB94

Function 00CA3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00CA3C02
GetKeyboardState.USER32(?), ref: 00CA3C17
SetKeyboardState.USER32(?), ref: 00CA3C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00CA3CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00CA3CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00CA3D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00CA3D26

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d54a03edbb1f20876a91a8e6a95bd363cf8389d21ca69bb5da48f61d04ec847d
Instruction ID: 1f8f319e33181849eb55995dcd03e7af5555900ecc6099f402d0e7be1ebf74db
Opcode Fuzzy Hash: d54a03edbb1f20876a91a8e6a95bd363cf8389d21ca69bb5da48f61d04ec847d
Instruction Fuzzy Hash: 725108A09147D77DFB3643648C65BBABF995B0730CF088588F1E55A8C2D294EF84E760

Function 00CC8FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00CC8FE7
GetWindowLongW.USER32(0152DA90,000000F0), ref: 00CC901A
GetWindowLongW.USER32(0152DA90,000000F0), ref: 00CC904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00CC9081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00CC90AB
GetWindowLongW.USER32(00000000,000000F0), ref: 00CC90BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00CC90D6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 8557b3f19cdf1197676ed5d928c236c440a6bcc7135b376bcd6a122919c5bf61
Instruction ID: 82e73a317a2190c9e33be1ce12965454ba04b38b877048805db27eaae7d846e9
Opcode Fuzzy Hash: 8557b3f19cdf1197676ed5d928c236c440a6bcc7135b376bcd6a122919c5bf61
Instruction Fuzzy Hash: F7315534604254EFDB20CF58DC88F6937AAFB6A315F1441A8F929CF2B1CB71A941DB51

Function 00CA08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CA08F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CA0918
SysAllocString.OLEAUT32(00000000), ref: 00CA091B
SysAllocString.OLEAUT32(?), ref: 00CA0939
SysFreeString.OLEAUT32(?), ref: 00CA0942
StringFromGUID2.OLE32(?,?,00000028), ref: 00CA0967
SysAllocString.OLEAUT32(?), ref: 00CA0975

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c3868254d8daaf33e7d96f7f1425dc8eb816ee2d1c159df18572265959f0ce3e
Instruction ID: 529e4b56f4e5470fab3a81e872d9c711ff897aa6b138113bbe74ae2cd1a8e3ce
Opcode Fuzzy Hash: c3868254d8daaf33e7d96f7f1425dc8eb816ee2d1c159df18572265959f0ce3e
Instruction Fuzzy Hash: C921A776601219AFAB109FB8DC88EBF73ACEB093A4B108125F919DB191D670ED45CB60

Function 00CA2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CA2485
__wcsnicmp.LIBCMT ref: 00CA24A6
__wcsnicmp.LIBCMT ref: 00CA24C0

Strings

#notrayicon, xrefs: 00CA247D
#OnAutoItStartRegister, xrefs: 00CA24BA
#requireadmin, xrefs: 00CA24A0

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 4a1af092aba3d6596f754b7f8a1162dda7784510c3fc188dfc167112b86faaea
Instruction ID: f95a4af876adf3f207312aa4447d53af864edc8fe0772da33bbff26ad92e3892
Opcode Fuzzy Hash: 4a1af092aba3d6596f754b7f8a1162dda7784510c3fc188dfc167112b86faaea
Instruction Fuzzy Hash: D4214C3150423367D321BB7CDC12EBB73D9EF66308F648029F94A97081E6519A42E3A9

Function 00CA0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CA09CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CA09F1
SysAllocString.OLEAUT32(00000000), ref: 00CA09F4
SysAllocString.OLEAUT32 ref: 00CA0A15
SysFreeString.OLEAUT32 ref: 00CA0A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 00CA0A38
SysAllocString.OLEAUT32(?), ref: 00CA0A46

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9f53d9dd88ff74723a0c692e8e223bd5219dd8e59a9eb2a79409f8dfcd041d13
Instruction ID: 7504f909bdd18b285f8bfb051aff71504e30b05583344c03f5b9648a7a3e859f
Opcode Fuzzy Hash: 9f53d9dd88ff74723a0c692e8e223bd5219dd8e59a9eb2a79409f8dfcd041d13
Instruction Fuzzy Hash: CA218375200205AFDB10DFB8DCC9EAB77ECEF093A47108125F919CB2A1E670ED419B64

Function 00CCA2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C7D1BA
Part of subcall function 00C7D17C: GetStockObject.GDI32(00000011), ref: 00C7D1CE
Part of subcall function 00C7D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C7D1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00CCA32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00CCA33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00CCA345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00CCA354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00CCA360

Strings

Msctls_Progress32, xrefs: 00CCA2FE

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9383f71603d69b22459ad852874c2b2a5b6c90112a9711b7d21c2e5a51c9e0e0
Instruction ID: fd3a6771bfdf5db6e65a1799bddc647787f2a967b7546486b2eeeb9db240ef42
Opcode Fuzzy Hash: 9383f71603d69b22459ad852874c2b2a5b6c90112a9711b7d21c2e5a51c9e0e0
Instruction Fuzzy Hash: A31190B155021DBEEF115FA0CC85EEB7F6DFF097A8F014114FA08A60A0CA729C21DBA4

Function 00C7CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00C7CCF6
GetWindowRect.USER32(?,?), ref: 00C7CD37
ScreenToClient.USER32(?,?), ref: 00C7CD5F
GetClientRect.USER32(?,?), ref: 00C7CE8C
GetWindowRect.USER32(?,?), ref: 00C7CEA5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: c19afe83e7713190942b0793910fd62c42025893801c9a504cce62eceb36be9b
Instruction ID: f5b4ed24e9f7abc3899b13de892a20197c143ab20ed174d5bc25312c38d28437
Opcode Fuzzy Hash: c19afe83e7713190942b0793910fd62c42025893801c9a504cce62eceb36be9b
Instruction Fuzzy Hash: E8B14B79A0064ADBDF10CFA9C4807EDBBB1FF08350F14D52AED699B250DB30AA50DB64

Function 00CC1BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00CC1C18
Process32FirstW.KERNEL32(00000000,?), ref: 00CC1C26
__wsplitpath.LIBCMT ref: 00CC1C54

Part of subcall function 00C81DFC: __wsplitpath_helper.LIBCMT ref: 00C81E3C

_wcscat.LIBCMT ref: 00CC1C69
Process32NextW.KERNEL32(00000000,?), ref: 00CC1CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00CC1CF1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: dd482387b8f16f38cd70566f2fb26975bbe17a02de232a727fe1e82813fa22d6
Instruction ID: f850aad756f4971141e27028054740b66553d81f790d6631d9e1f1283246fa9e
Opcode Fuzzy Hash: dd482387b8f16f38cd70566f2fb26975bbe17a02de232a727fe1e82813fa22d6
Instruction Fuzzy Hash: D5515DB15043409FD720EF24C885FABB7ECEF88754F04491EF98A97251EB709A05DB92

Function 00CC2FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CC2BB5,?,?), ref: 00CC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CC30AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00CC30EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00CC3112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00CC313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00CC317E
RegCloseKey.ADVAPI32(00000000), ref: 00CC318B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 692c88081bda2f8c18ab2b17836c163f72acb57a1f205fe060ad49468dd4ab89
Instruction ID: 83053009fa400e8224e4b882db8016b04041d7934d8b1da724ef92b92686e7d2
Opcode Fuzzy Hash: 692c88081bda2f8c18ab2b17836c163f72acb57a1f205fe060ad49468dd4ab89
Instruction Fuzzy Hash: 11515732608340AFC714EF64C885E6EBBE9FF89314F04891DF596872A1DB71EA05DB52

Function 00CC84DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00CC8540
GetMenuItemCount.USER32(00000000), ref: 00CC8577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00CC859F
GetMenuItemID.USER32(?,?), ref: 00CC860E
GetSubMenu.USER32(?,?), ref: 00CC861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 00CC866D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 2c538089846fcf13f5ebb4fb5347521de54ae255d3085a6643767a7a1579948a
Instruction ID: b0c96ad2271bfb4e08565020d02efbaee44d5367501cd20ba5504298fb64d0a6
Opcode Fuzzy Hash: 2c538089846fcf13f5ebb4fb5347521de54ae255d3085a6643767a7a1579948a
Instruction Fuzzy Hash: 11518B71A00215AFDF11EFA4C881BAEB7F4EF48310F108469F916BB391CB71AE459B90

Function 00CA4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA4B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CA4B5B
IsMenu.USER32(00000000), ref: 00CA4B7B
CreatePopupMenu.USER32 ref: 00CA4BAF
GetMenuItemCount.USER32(000000FF), ref: 00CA4C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00CA4C3E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 10a311067c1155c610bbbef17c6313c2d83153948a8f5d0b98b262d806bc3fbd
Instruction ID: a803c7a916395d780dab4774399730817c9bb58a71c31da7d3d435504edb60a5
Opcode Fuzzy Hash: 10a311067c1155c610bbbef17c6313c2d83153948a8f5d0b98b262d806bc3fbd
Instruction Fuzzy Hash: 6151B17060124ADFDF28CF64D888BADBBF5BF8632CF144159E4299B291D3B19A44CB61

Function 00CB8DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,00CFDC00), ref: 00CB8E7C
WSAGetLastError.WSOCK32(00000000), ref: 00CB8E89
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00CB8EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 00CB8EC5
_strlen.LIBCMT ref: 00CB8EF7
WSAGetLastError.WSOCK32(00000000), ref: 00CB8F6A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: 36b675e4ed4765da7c185ebda9d8da99bb1b353b91b897b94b8675c6f9cf5c2c
Instruction ID: 202ff42e7e747d875419eb4d921f5146bc0d1ff8ced5beed2e211032e031061a
Opcode Fuzzy Hash: 36b675e4ed4765da7c185ebda9d8da99bb1b353b91b897b94b8675c6f9cf5c2c
Instruction Fuzzy Hash: 39416D71A00204AFCB14EBA4CDD6EEEB7BEAB58314F104659F51A97291DF30EE44DB60

Function 00C7ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

BeginPaint.USER32(?,?,?), ref: 00C7AC2A
GetWindowRect.USER32(?,?), ref: 00C7AC8E
ScreenToClient.USER32(?,?), ref: 00C7ACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00C7ACBC
EndPaint.USER32(?,?,?,?,?), ref: 00C7AD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00CDE673

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 808e8b06cc56f94d2089d1cf5b339f5640bec2d821c6eea5599301bffd142400
Instruction ID: bb210c156d92662f4c9dc40c5098c3b586d010d9420423672c0040c87148008d
Opcode Fuzzy Hash: 808e8b06cc56f94d2089d1cf5b339f5640bec2d821c6eea5599301bffd142400
Instruction Fuzzy Hash: 1F41C471104304AFC721DF24DC84F7E7BA8FB69321F144669F9A98B2A1C7319945DB62

Function 00CCE397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00D21628,00000000,00D21628,00000000,00000000,00D21628,?,00CDDC5D,00000000,?,00000000,00000000,00000000,?,00CDDAD1,00000004), ref: 00CCE40B
EnableWindow.USER32(00000000,00000000), ref: 00CCE42F
ShowWindow.USER32(00D21628,00000000), ref: 00CCE48F
ShowWindow.USER32(00000000,00000004), ref: 00CCE4A1
EnableWindow.USER32(00000000,00000001), ref: 00CCE4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00CCE4E8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: cbd3c05c551f328ca701977dcdc44a109280b49eeef86e6f8f8921e8771d25b2
Instruction ID: 6395dc29cfc2d7317f478b719c4254762b6a25a020dc9ea8aff5a59249d4a4c5
Opcode Fuzzy Hash: cbd3c05c551f328ca701977dcdc44a109280b49eeef86e6f8f8921e8771d25b2
Instruction Fuzzy Hash: 68413035601141EFDB2ACF64C499F947BE1BF0A304F5845A9EA698F2A2C731E941CB51

Function 00CA98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00CA98D1

Part of subcall function 00C7F4EA: std::exception::exception.LIBCMT ref: 00C7F51E
Part of subcall function 00C7F4EA: __CxxThrowException@8.LIBCMT ref: 00C7F533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00CA9908
EnterCriticalSection.KERNEL32(?), ref: 00CA9924
LeaveCriticalSection.KERNEL32(?), ref: 00CA999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00CA99B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00CA99D2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: 65f9c6dbcb1fa8381dbdbdc7b9c2c6e93befe9769e8d7b87cde8ae178eeec945
Instruction ID: b3572cdc7717fbf764910759f1bba29b0fd7bf2c9dfa41139d05ebe7be591bed
Opcode Fuzzy Hash: 65f9c6dbcb1fa8381dbdbdc7b9c2c6e93befe9769e8d7b87cde8ae178eeec945
Instruction Fuzzy Hash: F8316132900205ABDB109FA5DC85EAFB7B8FF45310B1480A9F909AB246D771DE11DBA1

Function 00CB9B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00CB77F4,?,?,00000000,00000001), ref: 00CB9B53

Part of subcall function 00CB6544: GetWindowRect.USER32(?,?), ref: 00CB6557

GetDesktopWindow.USER32 ref: 00CB9B7D
GetWindowRect.USER32(00000000), ref: 00CB9B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00CB9BB6

Part of subcall function 00CA7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CA7AD0

GetCursorPos.USER32(?), ref: 00CB9BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00CB9C44

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 098dafb5c9b304a322e56cce82f821fc6c5c2eabb909f55e825104fbcdb15458
Instruction ID: 560dfb9bcbd947799442f89439f1e1046aeafd50db94ca6cb5e9c35494271b17
Opcode Fuzzy Hash: 098dafb5c9b304a322e56cce82f821fc6c5c2eabb909f55e825104fbcdb15458
Instruction Fuzzy Hash: 9A31C172204356ABC720DF14DC89F9AB7E9FF89314F00092AF695D7191D631EA04CB91

Function 00C9AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00C9AFAE
OpenProcessToken.ADVAPI32(00000000), ref: 00C9AFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00C9AFC4
CloseHandle.KERNEL32(00000004), ref: 00C9AFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C9AFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 00C9B012

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5ca76ddf17f1e5efccd471c0aca30522cee06e0d98eb2566473527aaf4983763
Instruction ID: f95528bdc77b60aa418f7a01ec64f3590716516e8c22caf77a5817b3a27d73e9
Opcode Fuzzy Hash: 5ca76ddf17f1e5efccd471c0aca30522cee06e0d98eb2566473527aaf4983763
Instruction Fuzzy Hash: F7215EB2100249AFDF128F98ED4DFAE7BA9EF44704F144015FA02A6161C3769E61EBA1

Function 00CCEBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00C7AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00C7AFE3
Part of subcall function 00C7AF83: SelectObject.GDI32(?,00000000), ref: 00C7AFF2
Part of subcall function 00C7AF83: BeginPath.GDI32(?), ref: 00C7B009
Part of subcall function 00C7AF83: SelectObject.GDI32(?,00000000), ref: 00C7B033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00CCEC20
LineTo.GDI32(00000000,00000003,?), ref: 00CCEC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00CCEC42
LineTo.GDI32(00000000,00000000,?), ref: 00CCEC52
EndPath.GDI32(00000000), ref: 00CCEC62
StrokePath.GDI32(00000000), ref: 00CCEC72

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: aa6f55990f47d7b2e21cc4f5d4e711eb2bb25d52d191feea158a42623028578f
Instruction ID: 5924b652a2b45c8b734fbeec90a6cebe6048dd7b00c1c9d01166f2c734f7a90e
Opcode Fuzzy Hash: aa6f55990f47d7b2e21cc4f5d4e711eb2bb25d52d191feea158a42623028578f
Instruction Fuzzy Hash: C111F776000189BFEB129F90DD88FEE7F6DEB08361F048112FA198A160D7719E559BA0

Function 00C9E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C9E1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 00C9E1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C9E1D8
ReleaseDC.USER32(00000000,00000000), ref: 00C9E1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00C9E1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 00C9E209

Part of subcall function 00C99AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00C99A05,00000000,00000000,?,00C99DDB), ref: 00C9A53A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: 567da16c08a77b470f34307d9745d7ddd96eedd1de45ca47f57d0e0b09939d43
Instruction ID: 9ecd6840331c32e596a2ab1f53c6f79680aa4feb18f4a9825fda375236d50bc0
Opcode Fuzzy Hash: 567da16c08a77b470f34307d9745d7ddd96eedd1de45ca47f57d0e0b09939d43
Instruction Fuzzy Hash: E60184B5A00754BFEF109FA58C49B5EBFB9EB48351F044066FA05AB291D6719D00CB60

Function 00C87B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00C87B47

Part of subcall function 00C8123A: __initp_misc_winsig.LIBCMT ref: 00C8125E
Part of subcall function 00C8123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00C87F51
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00C87F65
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00C87F78
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00C87F8B
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00C87F9E
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00C87FB1
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00C87FC4
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00C87FD7
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00C87FEA
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00C87FFD
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00C88010
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00C88023
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00C88036
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00C88049
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00C8805C
Part of subcall function 00C8123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00C8806F

__mtinitlocks.LIBCMT ref: 00C87B4C

Part of subcall function 00C87E23: InitializeCriticalSectionAndSpinCount.KERNEL32(00D1AC68,00000FA0,?,?,00C87B51,00C85E77,00D16C70,00000014), ref: 00C87E41

__mtterm.LIBCMT ref: 00C87B55

Part of subcall function 00C87BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00C87B5A,00C85E77,00D16C70,00000014), ref: 00C87D3F
Part of subcall function 00C87BBD: _free.LIBCMT ref: 00C87D46
Part of subcall function 00C87BBD: DeleteCriticalSection.KERNEL32(00D1AC68,?,?,00C87B5A,00C85E77,00D16C70,00000014), ref: 00C87D68

__calloc_crt.LIBCMT ref: 00C87B7A
GetCurrentThreadId.KERNEL32 ref: 00C87BA3

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 7c88d180c1a445ef6c7d20e95476d94c5b4247e4cf95b063c429e6dadba2e129
Instruction ID: 477bc998e833ef69206cb9b5a7320fdcb146a97c48cabe751bba16a699f71c75
Opcode Fuzzy Hash: 7c88d180c1a445ef6c7d20e95476d94c5b4247e4cf95b063c429e6dadba2e129
Instruction Fuzzy Hash: B0F0963211D7512EE62877347C06A5A26C59F0173CB3047A9F874D51D1FF20C94263AD

Function 00C627EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00C6281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00C62825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00C62830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00C6283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00C62843
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C6284B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 1016418db05b7b1d06ba0b3a93b9df01983653a82beee3666e643c1cf9027a11
Instruction ID: 7ad75e7180b886bf098a4dd96421ab53a56f70fcc0ffaf22a5b85db3e4c868d6
Opcode Fuzzy Hash: 1016418db05b7b1d06ba0b3a93b9df01983653a82beee3666e643c1cf9027a11
Instruction Fuzzy Hash: AF0167B0902B5ABDE3008F6A8C85B56FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 00CA9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: bc0001d8aa0f61c5878a6bc39ca3414ce72055bba6d59e63368ce105edab0758
Instruction ID: 9d38b290699fea2f1f023ebc75adc9ebeedfcbaea41b2415e7aebc0b93e568c5
Opcode Fuzzy Hash: bc0001d8aa0f61c5878a6bc39ca3414ce72055bba6d59e63368ce105edab0758
Instruction Fuzzy Hash: 3D01A932202252ABD7151B54ECC9FEF7779FF89706704042AF603DA0A0DB759D00EB51

Function 00CA7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00CA7C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00CA7C1D
GetWindowThreadProcessId.USER32(?,?), ref: 00CA7C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CA7C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CA7C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CA7C4C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 5921cdbcbed06019b2cda2297320d912aa62c0aed84bf3868fd71c099ddd6995
Instruction ID: 58c620ab43ed2e3e205638e8960a741f593eec90508c526688e8d42ecca806d1
Opcode Fuzzy Hash: 5921cdbcbed06019b2cda2297320d912aa62c0aed84bf3868fd71c099ddd6995
Instruction Fuzzy Hash: 26F03A72241198BBE7215B529C4EFEF7F7CEFC6B25F000418FA0299061E7A05A41C6B5

Function 00CA9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00CA9A33
EnterCriticalSection.KERNEL32(?,?,?,?,00CD5DEE,?,?,?,?,?,00C6ED63), ref: 00CA9A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,00CD5DEE,?,?,?,?,?,00C6ED63), ref: 00CA9A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00CD5DEE,?,?,?,?,?,00C6ED63), ref: 00CA9A5E

Part of subcall function 00CA93D1: CloseHandle.KERNEL32(?,?,00CA9A6B,?,?,?,00CD5DEE,?,?,?,?,?,00C6ED63), ref: 00CA93DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 00CA9A71
LeaveCriticalSection.KERNEL32(?,?,?,?,00CD5DEE,?,?,?,?,?,00C6ED63), ref: 00CA9A78

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: aa2fa46faf1043186de8e289b3d6e4c87a1e8f54c16895ad0b30a9e5c3eb2276
Instruction ID: 1891256edd577f4824b6c772de95a7c24522e5b32e9bdd6500adb9d7b6111086
Opcode Fuzzy Hash: aa2fa46faf1043186de8e289b3d6e4c87a1e8f54c16895ad0b30a9e5c3eb2276
Instruction Fuzzy Hash: 4BF05E32141252ABD7111BA4ECC9FAE7739FF85302B140426F603990B0DB759D01EB51

Function 00C61CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00C7F4EA: std::exception::exception.LIBCMT ref: 00C7F51E
Part of subcall function 00C7F4EA: __CxxThrowException@8.LIBCMT ref: 00C7F533

__swprintf.LIBCMT ref: 00C61EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00C61D49

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: eb8132b8ffc9ebba31274719daa190c09ed2c820009907700aa5b8f38609046a
Instruction ID: e2cb37c348c2945de90873da1ba36a87fbeb3a4d631d8af0197b8e404082c712
Opcode Fuzzy Hash: eb8132b8ffc9ebba31274719daa190c09ed2c820009907700aa5b8f38609046a
Instruction Fuzzy Hash: A0914E715042029FCB24EF24C8D5C6EB7E4EF95700F04491EF996972A1DB71EE05EB52

Function 00CBAFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CBB006
CharUpperBuffW.USER32(?,?), ref: 00CBB115
VariantClear.OLEAUT32(?), ref: 00CBB298

Part of subcall function 00CA9DC5: VariantInit.OLEAUT32(00000000), ref: 00CA9E05
Part of subcall function 00CA9DC5: VariantCopy.OLEAUT32(?,?), ref: 00CA9E0E
Part of subcall function 00CA9DC5: VariantClear.OLEAUT32(?), ref: 00CA9E1A

Strings

AUTOIT.ERROR, xrefs: 00CBB11B
Incorrect Parameter format, xrefs: 00CBB03E, 00CBB20B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 569e13a6bdc20312590acb0cde80940e8701340f64c1232e21d1cf96698d94d5
Instruction ID: ab26604580ab6e5dfc0795fa45f5d711ec20349da1d2fcd1e151b43f22d06fbf
Opcode Fuzzy Hash: 569e13a6bdc20312590acb0cde80940e8701340f64c1232e21d1cf96698d94d5
Instruction Fuzzy Hash: C7915A706083019FCB10DF25D4859AABBE8EF89704F04886DF89A9B362DB71ED45DB52

Function 00CA5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7C6F4: _wcscpy.LIBCMT ref: 00C7C717

_memset.LIBCMT ref: 00CA5438
GetMenuItemInfoW.USER32(?), ref: 00CA5467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00CA5513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00CA553D

Strings

0, xrefs: 00CA5430

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 667f1cd5c0dac6417279839d4e588ba55cafcdfe7da84ac75d059240e78cfdbf
Instruction ID: 149f708810ecb0170b248469b786540424d4daec269ba3572b04117a1e733505
Opcode Fuzzy Hash: 667f1cd5c0dac6417279839d4e588ba55cafcdfe7da84ac75d059240e78cfdbf
Instruction Fuzzy Hash: 3A512571A047039BD7149F28C8817ABB7E9AF9B318F04862DF8A5D31A1D760CE44DB52

Function 00CA0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CA027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00CA02B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00CA02C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CA0344

Strings

DllGetClassObject, xrefs: 00CA02B7

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: becb3fb3613e258b3c5720c9c8d08752377300189dd989ad5bd5a65202cbf90f
Instruction ID: 1b2c55e8b293ab6ce1d132b992cc6ddccbb9710fa1910faa5a3702ed4522d719
Opcode Fuzzy Hash: becb3fb3613e258b3c5720c9c8d08752377300189dd989ad5bd5a65202cbf90f
Instruction Fuzzy Hash: D3416DB1601205EFDF05CF54C884BAE7BB9EF46358F2480ADA9099F216D7B1DA44CBA0

Function 00CA5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA5075
GetMenuItemInfoW.USER32 ref: 00CA5091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00CA50D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00D21708,00000000), ref: 00CA5120

Strings

0, xrefs: 00CA506D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: e8e54a6584d73191107a0098bfc9b55bef7c54b3150cee603e859bc21dbfa737
Instruction ID: 44550b3e761c05f57cbf9805e326d6040f99ccfb1927f604bd1e7067a37b61f6
Opcode Fuzzy Hash: e8e54a6584d73191107a0098bfc9b55bef7c54b3150cee603e859bc21dbfa737
Instruction Fuzzy Hash: 4C41D6712057429FD720DF24DC85F6EB7E4AF86328F148A1EF96697291D770E900CB62

Function 00CAE698 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00CAE742
GetLastError.KERNEL32(?,00000000), ref: 00CAE768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00CAE78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00CAE7B9

Strings

p1Wu`KXu, xrefs: 00CAE78D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID: p1Wu`KXu
API String ID: 3321077145-4063981602
Opcode ID: a399356036d94ec4efeacfd0aab26ec114f1af6b1d1f76432ae45724d690360b
Instruction ID: 62200c548eec4cd290344e44c47800778c2158962af8d462ca98e96247df57a6
Opcode Fuzzy Hash: a399356036d94ec4efeacfd0aab26ec114f1af6b1d1f76432ae45724d690360b
Instruction Fuzzy Hash: CB410539600611DFCF21AF15C484A4DBBE5FF5A720B098498E946AB3A2CB34FD409B91

Function 00CC0567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00CC0587

Strings

stdcall, xrefs: 00CC0609
winapi, xrefs: 00CC05F8
none, xrefs: 00CC0662
cdecl, xrefs: 00CC05DE

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 3f8c34d081e9bae79da96c72fd746c17153b9321a2213f3e5317555e47903f1f
Instruction ID: 5f2c8b360aa4594a7f89da142e1988d24a2cd880408e474bc08032dd90f463a1
Opcode Fuzzy Hash: 3f8c34d081e9bae79da96c72fd746c17153b9321a2213f3e5317555e47903f1f
Instruction Fuzzy Hash: 0E319E71500216AFCF10EF58C881AEEB3B8FF55314B108629F876A76D1DB71AA16CB90

Function 00C9B80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00C9B88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00C9B8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 00C9B8D1

Strings

ComboBox, xrefs: 00C9B815
ListBox, xrefs: 00C9B84D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 17d4d9fbc47a04539707d80f56684bf816a6dfab47fd6ea6ef0fca67ebc1d098
Instruction ID: ce48ac6b5930763a76dd37e44dc78256f38532ecd20a85e15376b842023bc57c
Opcode Fuzzy Hash: 17d4d9fbc47a04539707d80f56684bf816a6dfab47fd6ea6ef0fca67ebc1d098
Instruction Fuzzy Hash: 2A210572900208BFDF14ABA4E8CAEFE777CDF49350B104129F066A71E1DB754E0AA764

Function 00CB43E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00CB4401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CB4427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00CB4457
InternetCloseHandle.WININET(00000000), ref: 00CB449E

Part of subcall function 00CB5052: GetLastError.KERNEL32(?,?,00CB43CC,00000000,00000000,00000001), ref: 00CB5067

Strings

, xrefs: 00CB4450

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: e993d256f9441763ad4f2dfbfc3ed67ec9a84845d4cd80471d91cc9a87156d26
Instruction ID: 2a4e18502f2ae57d8af4e82b8362b26dbd4e2f1175aa0c254e14bfbcf613323b
Opcode Fuzzy Hash: e993d256f9441763ad4f2dfbfc3ed67ec9a84845d4cd80471d91cc9a87156d26
Instruction Fuzzy Hash: E021BEB2504208BEE715AF54CCC4FFFBBECEB48748F10801AF10AA6141EA748E05AB71

Function 00CC90E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C7D1BA
Part of subcall function 00C7D17C: GetStockObject.GDI32(00000011), ref: 00C7D1CE
Part of subcall function 00C7D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C7D1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00CC915C
LoadLibraryW.KERNEL32(?), ref: 00CC9163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00CC9178
DestroyWindow.USER32(?), ref: 00CC9180

Strings

SysAnimate32, xrefs: 00CC9137

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 05f3a3cc97c2801096f8c7b8cb5a6059b10f56872a62de1d176ae48dc26257fc
Instruction ID: d88185d1eb516af8c3e2ed46f39d2ed10de229621ca1bc8bdb8eb37425ccb041
Opcode Fuzzy Hash: 05f3a3cc97c2801096f8c7b8cb5a6059b10f56872a62de1d176ae48dc26257fc
Instruction Fuzzy Hash: 7D217771200206BBEF204E64DC8AFFE37ADEB99364F194618F925961A0C7329D52A760

Function 00CA9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00CA9588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CA95B9
GetStdHandle.KERNEL32(0000000C), ref: 00CA95CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00CA9605

Strings

nul, xrefs: 00CA9600

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 2a377c030604d24fc6f046b6c3c628282fc6f947f5e7824a762bfafbe1f7ac8b
Instruction ID: 30f0407154fc5c31614759c8899f158ece7a8f6ed449c74eaaa65800be00ae69
Opcode Fuzzy Hash: 2a377c030604d24fc6f046b6c3c628282fc6f947f5e7824a762bfafbe1f7ac8b
Instruction Fuzzy Hash: D6214F70A00206AFDB219F65DC47A9E77F4EF46728F204A19F9A1DB2E0D770DA40CB10

Function 00CA9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00CA9653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CA9683
GetStdHandle.KERNEL32(000000F6), ref: 00CA9694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00CA96CE

Strings

nul, xrefs: 00CA96C9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 3ac8fea9601cecf3ce650d5069368fb56522f2888aa6f34d6f29253bd76ae796
Instruction ID: f7b4c1e3e6b9c185e491bb6bf2ae8fa683a83686774b2fb80873e21c70a8c6e9
Opcode Fuzzy Hash: 3ac8fea9601cecf3ce650d5069368fb56522f2888aa6f34d6f29253bd76ae796
Instruction Fuzzy Hash: 1C218E716002069BDB249F699C46F9E77A8EF46728F200A18F9B1E72D0DB709941CB11

Function 00CADAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CADB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00CADB5E
__swprintf.LIBCMT ref: 00CADB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,00CFDC00), ref: 00CADBB5

Strings

%lu, xrefs: 00CADB71

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 0644ec1858f5b5d19b1ef40717ed0c2fd40a763e0b3ccbb70824346b93d70502
Instruction ID: 47709765d2bdcdcef74c1b285f367c55bd2af2f3fdd0877a371879bd505795a2
Opcode Fuzzy Hash: 0644ec1858f5b5d19b1ef40717ed0c2fd40a763e0b3ccbb70824346b93d70502
Instruction Fuzzy Hash: FD219535600149AFCB10EFA4DDC5EAEB7B8EF49704B014069F60AEB251DB70EA41DB61

Function 00C9C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00C9C84A
Part of subcall function 00C9C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C9C85D
Part of subcall function 00C9C82D: GetCurrentThreadId.KERNEL32 ref: 00C9C864
Part of subcall function 00C9C82D: AttachThreadInput.USER32(00000000), ref: 00C9C86B

GetFocus.USER32 ref: 00C9CA05

Part of subcall function 00C9C876: GetParent.USER32(?), ref: 00C9C884

GetClassNameW.USER32(?,?,00000100), ref: 00C9CA4E
EnumChildWindows.USER32(?,00C9CAC4), ref: 00C9CA76
__swprintf.LIBCMT ref: 00C9CA90

Strings

%s%d, xrefs: 00C9CA8A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: 4da4face53c6fac7929e9f9bf55abff866bc94ee1b536f263aac8b9be4f50da4
Instruction ID: 260221a845beb114963dc503b16ab31ba0417499f643c8ea5726a908f390ee2c
Opcode Fuzzy Hash: 4da4face53c6fac7929e9f9bf55abff866bc94ee1b536f263aac8b9be4f50da4
Instruction Fuzzy Hash: 41117F716002097BDF11BFA09CC9FA9376CAB44714F00806AFE19AA182CB709A45EB74

Function 00CC1945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00CC19F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00CC1A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00CC1B49
CloseHandle.KERNEL32(?), ref: 00CC1BBF

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: a120ca7b778d7172d8ba2de6b168bd6d14129abd800f273dbc01ef20d6f2f084
Instruction ID: b1dcaf013ae04d60a70acb3e60d1d75321b64148f65b08f489d6f5d69f70c1d8
Opcode Fuzzy Hash: a120ca7b778d7172d8ba2de6b168bd6d14129abd800f273dbc01ef20d6f2f084
Instruction Fuzzy Hash: 348170B0600204ABDF119F65C896FADBBE5EF05720F18C459FD19AF382D7B4AD419B90

Function 00CCE062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00CCE1D5
SendMessageW.USER32(?,000000B0,?,?), ref: 00CCE20D
IsDlgButtonChecked.USER32(?,00000001), ref: 00CCE248
GetWindowLongW.USER32(?,000000EC), ref: 00CCE269
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00CCE281

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$ButtonCheckedLongWindow
String ID:
API String ID: 3188977179-0
Opcode ID: 2a5fbeaf67d0a98587f5ea66d96f12135c1fb3a0d2ba3bc686fa860351ac9eb6
Instruction ID: e5b239bf5d3d8eb494e7e8adf5be4c8b5b13683c092dbb4b452a298ee9d7dd58
Opcode Fuzzy Hash: 2a5fbeaf67d0a98587f5ea66d96f12135c1fb3a0d2ba3bc686fa860351ac9eb6
Instruction Fuzzy Hash: 6661C474A00244AFDB25DF54C894FAE77BAEF5A300F08805DF966973A2C770AE50DB50

Function 00CA1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CA1CB4
VariantClear.OLEAUT32(00000013), ref: 00CA1D26
VariantClear.OLEAUT32(00000000), ref: 00CA1D81
VariantClear.OLEAUT32(?), ref: 00CA1DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00CA1E26

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: ca1ccbc2ac50c25151d8c4a234355afaa5d5e03aa7d8f7e0b65681d000ba2ab8
Instruction ID: f6f63ab2b45e6ecdcdf7135f7d5f66ec8df1802192afe628746b291d3f72c170
Opcode Fuzzy Hash: ca1ccbc2ac50c25151d8c4a234355afaa5d5e03aa7d8f7e0b65681d000ba2ab8
Instruction Fuzzy Hash: F15149B5A0024AAFDB14CF58C884EAAB7B8FF4D314F158559ED59DB340D330EA51CBA0

Function 00CC0688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00CC06EE
GetProcAddress.KERNEL32(00000000,?), ref: 00CC077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00CC079B
GetProcAddress.KERNEL32(00000000,?), ref: 00CC07E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 00CC07FB

Part of subcall function 00C7E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00CAA574,?,?,00000000,00000008), ref: 00C7E675
Part of subcall function 00C7E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00CAA574,?,?,00000000,00000008), ref: 00C7E699

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: c851de2c5a75af2fb5e04c88aa304e21b933f4b0d7e11a0ffdcb158c86b3e3b7
Instruction ID: 13181ca377dc8e2d67948dffb1bf7851811faf8e560991aafd7e8c48cc5b3ff3
Opcode Fuzzy Hash: c851de2c5a75af2fb5e04c88aa304e21b933f4b0d7e11a0ffdcb158c86b3e3b7
Instruction Fuzzy Hash: FA513A75A00209DFCB14EFA8C4D1EADB7B5BF58310B148059EA56AB352DB30EE46DF90

Function 00CC2E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CC2BB5,?,?), ref: 00CC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CC2EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00CC2F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00CC2F75
RegCloseKey.ADVAPI32(?,?), ref: 00CC2FA1
RegCloseKey.ADVAPI32(00000000), ref: 00CC2FAE

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: ab6870365224f1fdfa7d3501281e8c268a5a4ea605a120f4e068d9eb64ac5f4c
Instruction ID: 1d60d2289421ce797601fe90d113a2497ff49b87f9276c54c4c5099ffef98a10
Opcode Fuzzy Hash: ab6870365224f1fdfa7d3501281e8c268a5a4ea605a120f4e068d9eb64ac5f4c
Instruction Fuzzy Hash: ED514871608244AFD714EBA4C881F6AB7F9FF88314F04882DF596972A1DB70EA05DB52

Function 00CCCCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690bf8297bd930f5228b2b8c2d840b3b0473dd26195e0d54aec9f5a1cbde2c6f
Instruction ID: c5c59fb02f6e46044fc18bfd10320bad8bb446b825ceddb9263413c6114b1811
Opcode Fuzzy Hash: 690bf8297bd930f5228b2b8c2d840b3b0473dd26195e0d54aec9f5a1cbde2c6f
Instruction Fuzzy Hash: ED41B439900244AFC720DF68CCC4FA9BB68EB0A310F15416DF96EE72D1C730AE51DA90

Function 00CB1206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00CB12B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00CB12DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00CB131C

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00CB1341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00CB1349

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: b7bdb9722fc2e74b49f7747163cfc7751890f1a73a625b63819c6553c163e6fd
Instruction ID: 75467e5c738ee460f763f46655f8af8d3cb36b3f8b3a4bfb9bea91256d02bbc4
Opcode Fuzzy Hash: b7bdb9722fc2e74b49f7747163cfc7751890f1a73a625b63819c6553c163e6fd
Instruction Fuzzy Hash: 11412A35A00105DFDF11EF64C991AAEBBF9FF08310B1480A9E90AAB362DB31ED41DB50

Function 00C7B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 00C7B64F
ScreenToClient.USER32(00000000,000000FF), ref: 00C7B66C
GetAsyncKeyState.USER32(00000001), ref: 00C7B691
GetAsyncKeyState.USER32(00000002), ref: 00C7B69F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 10da2cc41dc376fcf4523ae03602a50c1c316ec6f68e40a68ac91e72a66adc94
Instruction ID: 46e9518293eb41dada63f04c3cbff9d2fed3e9c5e070f09b14af30ec9d930286
Opcode Fuzzy Hash: 10da2cc41dc376fcf4523ae03602a50c1c316ec6f68e40a68ac91e72a66adc94
Instruction Fuzzy Hash: 27416E75904115BFCF199F65C844BEDBBB4FB05324F20835AF92A96290CB30AE94EF91

Function 00C9B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C9B369
PostMessageW.USER32(?,00000201,00000001), ref: 00C9B413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00C9B41B
PostMessageW.USER32(?,00000202,00000000), ref: 00C9B429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00C9B431

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a47a106704ebdb3ccaa7a88bf28afafaed902bb04c04123bbc1261345e0f67c0
Instruction ID: 91d046e74c9d785cfd8d26bd6474ae03326477cb99a58c70a21d6b934a330f4a
Opcode Fuzzy Hash: a47a106704ebdb3ccaa7a88bf28afafaed902bb04c04123bbc1261345e0f67c0
Instruction Fuzzy Hash: 6831AE71900259EBDF04CFA8EA8DB9E7BB5FB04315F104229F925AA1E1C7B09E54DB90

Function 00C9DBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C9DBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C9DBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C9DC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00C9DC52
_wcsstr.LIBCMT ref: 00C9DC5C

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 511ff2366e7048e59d5fcaef08bf008aba25808d9c5b1c2a32ccaa0a42eaf216
Instruction ID: f575711836a01391e32079c46c83fddb1d5a1b9bc2489e802ad733f99381b4fa
Opcode Fuzzy Hash: 511ff2366e7048e59d5fcaef08bf008aba25808d9c5b1c2a32ccaa0a42eaf216
Instruction Fuzzy Hash: 1121C272204244BBEF159F79DC8DE7F7BACDF45750F108029F80AEA191EAA1D941E2A0

Function 00C9BC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C9BC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C9BCC2
__itow.LIBCMT ref: 00C9BCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C9BD00
__itow.LIBCMT ref: 00C9BD11

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 5cd170928a17efc2f26dcba474e76dc9459cfe32d2c4b14810e8401f60d3ca22
Instruction ID: 3c2d7791f1f335e9c644d857c10b435b2090bb85110f4b45eb667aaf5dcfde48
Opcode Fuzzy Hash: 5cd170928a17efc2f26dcba474e76dc9459cfe32d2c4b14810e8401f60d3ca22
Instruction Fuzzy Hash: A821D8367003187BDF20AE659D8AFEE7BADAF49710F100424F906EB181DB708D4597E1

Function 00CA6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00C650E6: _wcsncpy.LIBCMT ref: 00C650FA

GetFileAttributesW.KERNEL32(?,?,?,?,00CA60C3), ref: 00CA6369
GetLastError.KERNEL32(?,?,?,00CA60C3), ref: 00CA6374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00CA60C3), ref: 00CA6388
_wcsrchr.LIBCMT ref: 00CA63AA

Part of subcall function 00CA6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00CA60C3), ref: 00CA63E0

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 58338a09618ebb855ee1d23c20503fa30355b5b5cf54698694b31c39149a60bf
Instruction ID: 9a7f57f93d2fd79c7698d6c40207eb4f4d5e3499a122d54ad86e0a42780a85ec
Opcode Fuzzy Hash: 58338a09618ebb855ee1d23c20503fa30355b5b5cf54698694b31c39149a60bf
Instruction Fuzzy Hash: 0F213D315062174BDF15AB749C92FEE33ACEF07364F184469F116C70E0EB60DA829A55

Function 00CB8B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00CBA84E

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00CB8BD3
WSAGetLastError.WSOCK32(00000000), ref: 00CB8BE2
connect.WSOCK32(00000000,?,00000010), ref: 00CB8BFE

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 51c115d5192247fa15c7c1e81df23dc31a924e15cf6d58b7066e053b106a2362
Instruction ID: 69efe0f2e669e66eaf11823b5e680cc206724487d35b23aa495a086e795fc852
Opcode Fuzzy Hash: 51c115d5192247fa15c7c1e81df23dc31a924e15cf6d58b7066e053b106a2362
Instruction Fuzzy Hash: 7C21CD712002159FDB10AF68CD85BBE77ADEF48720F048459F916AB3D2CB74AC05CB61

Function 00CB8420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00CB8441
GetForegroundWindow.USER32 ref: 00CB8458
GetDC.USER32(00000000), ref: 00CB8494
GetPixel.GDI32(00000000,?,00000003), ref: 00CB84A0
ReleaseDC.USER32(00000000,00000003), ref: 00CB84DB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: e026765941a28e071f224b09946bf044f670b983b8f9ee0b0d83d68b3e9d6b24
Instruction ID: 02caf5912df726855338a0a4cbd417cbf992240295df537003ae09eda16abbf1
Opcode Fuzzy Hash: e026765941a28e071f224b09946bf044f670b983b8f9ee0b0d83d68b3e9d6b24
Instruction Fuzzy Hash: 81219676A00204AFD710DFA4CD95B9EB7F9EF48301F048879F85A9B252DB70AD44DB50

Function 00C7AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00C7AFE3
SelectObject.GDI32(?,00000000), ref: 00C7AFF2
BeginPath.GDI32(?), ref: 00C7B009
SelectObject.GDI32(?,00000000), ref: 00C7B033

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 9f5a6752b4a5a6ef87276da256b04cd9759299eb7b5b509c28265eb7f78e27f0
Instruction ID: 8d0278cde1e36676c3d19b40fe41a8a85a8e7021a033f2640b9f74926259812c
Opcode Fuzzy Hash: 9f5a6752b4a5a6ef87276da256b04cd9759299eb7b5b509c28265eb7f78e27f0
Instruction Fuzzy Hash: DA2174B4800349EFDB21DF55EC84BAE7B69BB30366F14C21AE439D62A0D3704942DFA1

Function 00C8217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00C821A9
CreateThread.KERNEL32(?,?,00C822DF,00000000,?,?), ref: 00C821ED
GetLastError.KERNEL32 ref: 00C821F7
_free.LIBCMT ref: 00C82200
__dosmaperr.LIBCMT ref: 00C8220B

Part of subcall function 00C87C0E: __getptd_noexit.LIBCMT ref: 00C87C0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 2cac5accb17ca320a95398c5a8a2396d397ebeae8c015874d6415540a0061be8
Instruction ID: 04c8efdc045b88e820272b912cbfb8310232153e8bec0f3412b46d814c5fcbf7
Opcode Fuzzy Hash: 2cac5accb17ca320a95398c5a8a2396d397ebeae8c015874d6415540a0061be8
Instruction Fuzzy Hash: 7F112B33104346AFDB11BF65DC49DAF37A8EF00778B200129F92486191EB31D911A7A8

Function 00C9ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00C9ABD7
GetLastError.KERNEL32(?,00C9A69F,?,?,?), ref: 00C9ABE1
GetProcessHeap.KERNEL32(00000008,?,?,00C9A69F,?,?,?), ref: 00C9ABF0
HeapAlloc.KERNEL32(00000000,?,00C9A69F,?,?,?), ref: 00C9ABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00C9AC0E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 06ca3d7d93d807520f8b85ea942852da31eff9a5ad5c10bcfec15fd67ceb3bb0
Instruction ID: 57e7b424d25db3629d08506926094ef30d5eee6f4b2028e3127a155c6c176858
Opcode Fuzzy Hash: 06ca3d7d93d807520f8b85ea942852da31eff9a5ad5c10bcfec15fd67ceb3bb0
Instruction Fuzzy Hash: AA011D71200244BFDF104FA5DC8CE6B3BADEF897557100429F556DB260D6729E40CBA1

Function 00C99ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00C99ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 00C99AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 00C99B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00C99B15
CLSIDFromString.OLE32(?,?), ref: 00C99B21

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 1042f98e7f62d4b3288f8dd9f15bf71dbabfb0fba946ad4dbed96390e2baaea8
Instruction ID: 961561aef40ef4f6eecc0cf00b8bc789b563f16715d0261ae33ab3edde71f601
Opcode Fuzzy Hash: 1042f98e7f62d4b3288f8dd9f15bf71dbabfb0fba946ad4dbed96390e2baaea8
Instruction Fuzzy Hash: 5E014F76600215BFDB214F58ED88B9E7BFDEB44752F144028F90AD6260D775DE409BA0

Function 00CA7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CA7A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CA7A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CA7A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CA7A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CA7AD0

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 1070c27d5a8b3812a6b2e0f7d7470f3b20b18a2d40f0d138fc20da1050c9c921
Instruction ID: 3ad2fa5e788f8c9b10beb2089b1334ad1e02d831dae58074dee9c01ece0fc5f6
Opcode Fuzzy Hash: 1070c27d5a8b3812a6b2e0f7d7470f3b20b18a2d40f0d138fc20da1050c9c921
Instruction Fuzzy Hash: 28014C32D0461AEBCF00AFE5DC99BEDBB78FF09715F000595E502B6250DB309A51D7A1

Function 00C9AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C9AADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C9AAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C9AAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C9AAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C9AB10

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8da8dc5065d8f57522581fa8688441dbc45af455c5958f44aff92b5432057185
Instruction ID: 66beb5b090f1bbc9188c9ca3b78ad2e6ac24d171ac92078b4e4533002c9142a9
Opcode Fuzzy Hash: 8da8dc5065d8f57522581fa8688441dbc45af455c5958f44aff92b5432057185
Instruction Fuzzy Hash: 27F04F712003486FEB111FA4ECC8F6B3B6DFF45754F000029F952CB190CA609A018AA1

Function 00C9AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C9AA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C9AA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C9AA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C9AA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C9AAAF

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c5c4f1e3b6cd3f521082a792f6379ca56cb40eadbbd6fbae7f5362ad0523969b
Instruction ID: 137cadddd02fa15391d20357e1248a388727685f44436bc59b47143c50b11541
Opcode Fuzzy Hash: c5c4f1e3b6cd3f521082a792f6379ca56cb40eadbbd6fbae7f5362ad0523969b
Instruction Fuzzy Hash: 74F04971200344AFEB115FA5AC8DFAB3BACFF4A754F040429F952CB1A0DA609D41DAA1

Function 00C9EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00C9EC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C9ECAB
MessageBeep.USER32(00000000), ref: 00C9ECC3
KillTimer.USER32(?,0000040A), ref: 00C9ECDF
EndDialog.USER32(?,00000001), ref: 00C9ECF9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 64858118d6ce49ce9f9dbfea7f7e5069f52df62cf8571fd9f346ae2ee623250e
Instruction ID: bf4f60ea6b2eb3274694fc47db378ad6447e960b2cd7167bd52e49595792c67e
Opcode Fuzzy Hash: 64858118d6ce49ce9f9dbfea7f7e5069f52df62cf8571fd9f346ae2ee623250e
Instruction Fuzzy Hash: EB018170500744ABEF349F50DE8EB9A77B8FB10705F000959B593A54E1DBF0AA94CB41

Function 00C7B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00C7B0BA
StrokeAndFillPath.GDI32(?,?,00CDE680,00000000,?,?,?), ref: 00C7B0D6
SelectObject.GDI32(?,00000000), ref: 00C7B0E9
DeleteObject.GDI32 ref: 00C7B0FC
StrokePath.GDI32(?), ref: 00C7B117

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 33f745b5b4f981e9e6c0aafa95accbb7da11e417e266ff78d71f8e3f5e29e228
Instruction ID: 36a9dfff56952f152e7058ff061c6dde1e8b23837098bbc44bd25e5ec1509312
Opcode Fuzzy Hash: 33f745b5b4f981e9e6c0aafa95accbb7da11e417e266ff78d71f8e3f5e29e228
Instruction Fuzzy Hash: 90F0B678000288AFDB219F65EC49B5D3B65B720362F18C315E43A891F0C7318956DF60

Function 00CAF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CAF2DA
CoCreateInstance.OLE32(00CEDA7C,00000000,00000001,00CED8EC,?), ref: 00CAF2F2
CoUninitialize.OLE32 ref: 00CAF555

Strings

.lnk, xrefs: 00CAF28B, 00CAF290, 00CAF29E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 53d59eba9aad0c9c850374b3c708888ba0f306cff13c5aebe60acb7a0b6dd1db
Instruction ID: 569e1b49a2634eae123ee49c1311c54bf86053d724e05e2af9ec77b0c00f04c4
Opcode Fuzzy Hash: 53d59eba9aad0c9c850374b3c708888ba0f306cff13c5aebe60acb7a0b6dd1db
Instruction Fuzzy Hash: 81A11B71104201AFD310EFA4C882EAFB7ECEF98714F00891DF59997192DB71EA49DB92

Function 00CAE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C6660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C653B1,?,?,00C661FF,?,00000000,00000001,00000000), ref: 00C6662F

CoInitialize.OLE32(00000000), ref: 00CAE85D
CoCreateInstance.OLE32(00CEDA7C,00000000,00000001,00CED8EC,?), ref: 00CAE876
CoUninitialize.OLE32 ref: 00CAE893

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

Strings

.lnk, xrefs: 00CAE83B, 00CAE84D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 4db2422b5fbe251740e452d1bf817cb18f91dfdba060e7b38579d99ea0004464
Instruction ID: 92d09560060ba1b75a3d18f655dcab70cb0ef1ce48c4d953f60378bd8c613bde
Opcode Fuzzy Hash: 4db2422b5fbe251740e452d1bf817cb18f91dfdba060e7b38579d99ea0004464
Instruction Fuzzy Hash: 85A147756043029FCB10DF24C48496EBBE5FF89324F148958F9AA9B3A1CB31ED45CB91

Function 00C8325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00C832ED

Part of subcall function 00C8E0D0: __87except.LIBCMT ref: 00C8E10B

Strings

pow, xrefs: 00C832C5, 00C832E2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 47d55a0e354285df68fa1355f787b8ec03f7aa4df2e3a76ba812c68b832f82ff
Instruction ID: 43f7067cc10d8e694979afc679c1b1aea6b4d35f48dca91090c179009d15ad99
Opcode Fuzzy Hash: 47d55a0e354285df68fa1355f787b8ec03f7aa4df2e3a76ba812c68b832f82ff
Instruction Fuzzy Hash: 93516A71A0924196CB117718CD0537E2B949B40B1CF349D68F4E6822FADF748F85EB4E

Function 00CA4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00CFDC50,?,0000000F,0000000C,00000016,00CFDC50,?), ref: 00CA4645

Part of subcall function 00C6936C: __swprintf.LIBCMT ref: 00C693AB
Part of subcall function 00C6936C: __itow.LIBCMT ref: 00C693DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 00CA46C5

Strings

REMOVE, xrefs: 00CA4676
THIS, xrefs: 00CA4703

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 851fd83afd8ed19886c86f7c158fce4c16c26e96d1cf34b67cfd0701f4fd5f85
Instruction ID: 6f0ac513d79a2598dcff2fa7106f67a4dd4be03a8016ab96d0d5966d5f97827a
Opcode Fuzzy Hash: 851fd83afd8ed19886c86f7c158fce4c16c26e96d1cf34b67cfd0701f4fd5f85
Instruction Fuzzy Hash: 41417234A0024A9FCF15DF54C881AADB7B5FF8A308F148069E916EB3A2DB74DD45DB50

Function 00C9C189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C9BC08,?,?,00000034,00000800,?,00000034), ref: 00CA4335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00C9C1D3

Part of subcall function 00CA42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C9BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00CA4300

Part of subcall function 00CA422F: GetWindowThreadProcessId.USER32(?,?), ref: 00CA425A
Part of subcall function 00CA422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C9BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00CA426A
Part of subcall function 00CA422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C9BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00CA4280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C9C240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C9C28D

Strings

@, xrefs: 00C9C2A5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 4271af44e5f5a44fba654656273731d7bdf4803665869f34b1816220e5b3575a
Instruction ID: 179406f634c924f3862e081197d3eaa7e6ca6efae0767cf97d4f2d2a4a5b92f0
Opcode Fuzzy Hash: 4271af44e5f5a44fba654656273731d7bdf4803665869f34b1816220e5b3575a
Instruction Fuzzy Hash: D6415772900219AFDF10DFA4CD85BEEB7B8AF4A300F004195FA56B7181DA71AF45DB61

Function 00CCA63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00CFDC00,00000000,?,?,?,?), ref: 00CCA6D8
GetWindowLongW.USER32 ref: 00CCA6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00CCA705

Strings

SysTreeView32, xrefs: 00CCA6AA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: b9e78f8022b6903f65048a09290b68f8f8a87e7c64531beb14f70690a1e54334
Instruction ID: 478cb4ea397fe4aeeb9065f7357f9428cd23021c7086e07c1d0398dbcbe448ea
Opcode Fuzzy Hash: b9e78f8022b6903f65048a09290b68f8f8a87e7c64531beb14f70690a1e54334
Instruction Fuzzy Hash: 22318D31600609AFDB218E38CC49FEA77A9FB49328F244729F976932E0C770E9519B51

Function 00CCA0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00CCA15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00CCA172
SendMessageW.USER32(?,00001002,00000000,?), ref: 00CCA196

Strings

SysMonthCal32, xrefs: 00CCA129

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 3c7d2282c68e8816778b2cb72bdfc7544233d0d6887b86f1fc5ba7ec73c5245a
Instruction ID: 77b7b57f5826972b1c091a4163a45ec71eb029b618148e93403e715bbc4db7d6
Opcode Fuzzy Hash: 3c7d2282c68e8816778b2cb72bdfc7544233d0d6887b86f1fc5ba7ec73c5245a
Instruction Fuzzy Hash: 07219F32510218ABDF118FA4CC86FEE3B79EF48724F150218FA56AB1D0D6B5AC55DBA0

Function 00CCA88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00CCA941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00CCA94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00CCA956

Strings

msctls_updown32, xrefs: 00CCA8BB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 74d2b8371e0f92bbc84c4d511f8faca5db26c1fc693218e191c29086f8040e5c
Instruction ID: 18f4ef16a1cb0a5f5029b43321b9e5005838b772cea6e715413167c04bc15416
Opcode Fuzzy Hash: 74d2b8371e0f92bbc84c4d511f8faca5db26c1fc693218e191c29086f8040e5c
Instruction Fuzzy Hash: 762192B5600209AFDB10DF64DCC6E6B37ADEF5A3A8B050159FA159B3A1CB30EC11DB61

Function 00CC99A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00CC9A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00CC9A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00CC9A65

Strings

Listbox, xrefs: 00CC99FD

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 339a94fedad1e7660a6d3a5845b2f5b30fe567a04b7516e15767296b6221cc12
Instruction ID: 5f3c06d909f6651009834ac9d941bf2eb6f174a06aa698cbd517653744fd4887
Opcode Fuzzy Hash: 339a94fedad1e7660a6d3a5845b2f5b30fe567a04b7516e15767296b6221cc12
Instruction Fuzzy Hash: B621B032610118BFDB218F54CC89FBF3BAAEF89760F018128F9599B1A0C6719D5197A0

Function 00CCA409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00CCA46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00CCA482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00CCA48F

Strings

msctls_trackbar32, xrefs: 00CCA444

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 4c20303ac8cbf8ca66487c49e8eb1c33c561941e42b0a830dab85f4c991e04e5
Instruction ID: eeafba079f8aa1b520301eb44e76d6b2757ff9674b7138ead4a81199154c2d5a
Opcode Fuzzy Hash: 4c20303ac8cbf8ca66487c49e8eb1c33c561941e42b0a830dab85f4c991e04e5
Instruction Fuzzy Hash: 8911A371240208BEEF249F75CC49FAB3B6DEF89B68F01411CFA55A6091D6B2E851DB24

Function 00C82287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00C82350,?), ref: 00C822A1
GetProcAddress.KERNEL32(00000000), ref: 00C822A8

Strings

combase.dll, xrefs: 00C8229C
RoInitialize, xrefs: 00C82290

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: e00bec5dd0c32b79b6d38093ec86ba40c60d8d06a2f101a9d9c55ffbf08e0e19
Instruction ID: 81445da3ea2fc549659e72c6f53e0fd3effe4517d8e443b4e69a6f814606af0a
Opcode Fuzzy Hash: e00bec5dd0c32b79b6d38093ec86ba40c60d8d06a2f101a9d9c55ffbf08e0e19
Instruction Fuzzy Hash: 10E04F70A90741ABDB216F75ED8EB583A68B714716F004034F113D52E1CBB44592DF28

Function 00C8235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00C82276), ref: 00C82376
GetProcAddress.KERNEL32(00000000), ref: 00C8237D

Strings

combase.dll, xrefs: 00C82371
RoUninitialize, xrefs: 00C82365

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 357e71a7b0e653eb27a9d67a44231af4902839ef3f82fb35b81d15ffff3c0d8e
Instruction ID: 5acb6016112758cb591ad116736f1bd1d183b03a77211309d04561618aeff409
Opcode Fuzzy Hash: 357e71a7b0e653eb27a9d67a44231af4902839ef3f82fb35b81d15ffff3c0d8e
Instruction Fuzzy Hash: 15E0EC70545340EFDB326F61ED0EB083E68B724706F114424F10AD62BACBB85522DB39

Function 00CDAC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00CDAC60
__swprintf.LIBCMT ref: 00CDAC94

Strings

WIN_XPe, xrefs: 00CDACD3
%.3d, xrefs: 00CDAC6E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 6a984b0ef233a7a938228e4b4bc8924935a01b361f6f21ec365ba6e6ff953368
Instruction ID: 0152e672261b55487730450a643b87f298ab965892df7b7c2ad36f0cbbe8d06b
Opcode Fuzzy Hash: 6a984b0ef233a7a938228e4b4bc8924935a01b361f6f21ec365ba6e6ff953368
Instruction Fuzzy Hash: 8FE012B1814658EBCB10A751DD45DFA73BCAB48751F1400D3FB07A2200EA369BC4AB26

Function 00C642F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00C642EC,?,00C642AA,?), ref: 00C64304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00C64316

Strings

kernel32.dll, xrefs: 00C642FF
Wow64RevertWow64FsRedirection, xrefs: 00C64310

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 6e11f067b3f9da2be82077a861a7196b7071e4fe185dee2da70363a69605cef5
Instruction ID: 2e5834ff1998b9bcfcc3af7725c94264eeae5a87c49f5258fbbc475c8d8b469c
Opcode Fuzzy Hash: 6e11f067b3f9da2be82077a861a7196b7071e4fe185dee2da70363a69605cef5
Instruction Fuzzy Hash: ACD0A770400712EFC7344F20F88C78976E4EB04311B00442DF452D3270DBB0C8C48B20

Function 00CC2205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CC21FB,?,00CC23EF), ref: 00CC2213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00CC2225

Strings

GetProcessId, xrefs: 00CC221F
kernel32.dll, xrefs: 00CC220E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: 7b7a3e2cff819837469881483a504e733cacfbc0b66b7c67db99ba8185cfccff
Instruction ID: 8709d1abb80a62082a1db29efe3e9dbaf359865c63a8050043ab8612dc5c4329
Opcode Fuzzy Hash: 7b7a3e2cff819837469881483a504e733cacfbc0b66b7c67db99ba8185cfccff
Instruction Fuzzy Hash: 3ED0A774400712AFD7214F30F848B8976E5EB04730B00442DE852E2150DB71D8C48760

Function 00C6434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00C641BB,00C64341,?,00C6422F,?,00C641BB,?,?,?,?,00C639FE,?,00000001), ref: 00C64359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00C6436B

Strings

Wow64DisableWow64FsRedirection, xrefs: 00C64365
kernel32.dll, xrefs: 00C64354

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 81addabd043cd53c3e48c23d7537d76e144586b5fd9a13b056bf570b9902e2a9
Instruction ID: 827d203e4156f5a9a59b4834a371a2769f63ea0f77dd9f0477e9577270b3a2bc
Opcode Fuzzy Hash: 81addabd043cd53c3e48c23d7537d76e144586b5fd9a13b056bf570b9902e2a9
Instruction Fuzzy Hash: 35D0A730400712AFC7344F30F88878976E4AB10725B00442DE492D2260DBB0D8C4CB20

Function 00CA0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00CA052F,?,00CA06D7), ref: 00CA0572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00CA0584

Strings

oleaut32.dll, xrefs: 00CA056D
UnRegisterTypeLibForUser, xrefs: 00CA057E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 8ea58b882b5c48559617f01df1681aaa1e31ff3c929e1fb247d5e8b5fd4f690d
Instruction ID: 35bdc26b84f2aa405eee5fc6a938835d743ea3eb59e31a9f2f0bfcb0db660e10
Opcode Fuzzy Hash: 8ea58b882b5c48559617f01df1681aaa1e31ff3c929e1fb247d5e8b5fd4f690d
Instruction Fuzzy Hash: 3ED05E30804312AEC7205F21A848B9A77E4AF05314F20841DE85292150DA70C5C88F20

Function 00CA0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,00CA051D,?,00CA05FE), ref: 00CA0547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00CA0559

Strings

RegisterTypeLibForUser, xrefs: 00CA0553
oleaut32.dll, xrefs: 00CA0542

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: 549a562eaddf2d5ad296c22432cddfd3b49a607423febb13d068bc2870da9b30
Instruction ID: 7ac5141501d5e9245f70e436ce50087fba9a3b898ca2e80b27dc3ace34e3a197
Opcode Fuzzy Hash: 549a562eaddf2d5ad296c22432cddfd3b49a607423febb13d068bc2870da9b30
Instruction Fuzzy Hash: 31D0A730804713AFCB208F21FC487D9B6E4AF01315F24C41DE457D2150DA70C9C48B20

Function 00CBECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CBECBE,?,00CBEBBB), ref: 00CBECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00CBECE8

Strings

GetSystemWow64DirectoryW, xrefs: 00CBECE2
kernel32.dll, xrefs: 00CBECD1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: a251b937d9a282476f29ee5b26b108c20d0634bb6facaba895174bc9360bf285
Instruction ID: d8a5e6927affebd84a77256be588313440e5f4b9d855444aba15ae5032a17fc6
Opcode Fuzzy Hash: a251b937d9a282476f29ee5b26b108c20d0634bb6facaba895174bc9360bf285
Instruction Fuzzy Hash: D1D09E74500723AEDB205F65E8887DA7AE4AF04751F109419B85692151DEB4D8C89660

Function 00CBBADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00CBBAD3,00000001,00CBB6EE,?,00CFDC00), ref: 00CBBAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00CBBAFD

Strings

GetModuleHandleExW, xrefs: 00CBBAF7
kernel32.dll, xrefs: 00CBBAE6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 0840140bc95cfaaf7814a5d4b7404277e7005b1cbe11a2aa01f162a47126d8f9
Instruction ID: 3d35e8e595db6779fc9d3eec168973a86c0b094b762c1b18be30e392fe1a3dbf
Opcode Fuzzy Hash: 0840140bc95cfaaf7814a5d4b7404277e7005b1cbe11a2aa01f162a47126d8f9
Instruction Fuzzy Hash: 22D0C774904712AFD7305F65F888BD976E8AB04751F10441DE857D2154DFB4DCC4C764

Function 00CC3BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00CC3BD1,?,00CC3E06), ref: 00CC3BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00CC3BFB

Strings

RegDeleteKeyExW, xrefs: 00CC3BF5
advapi32.dll, xrefs: 00CC3BE4

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: eb73e9a03ba5bbd692f502c74b0c6569494da682e69b9a0165d515e97b99004e
Instruction ID: 46df647c2f6a9e5e3efb5ac73c4818dab15da5f3633dc71853372ec25464d6ec
Opcode Fuzzy Hash: eb73e9a03ba5bbd692f502c74b0c6569494da682e69b9a0165d515e97b99004e
Instruction Fuzzy Hash: C5D0A770400792AFC7205F60F848BCFBAF4AB01328B10841DE456E2150DAB8C5C48F20

Function 00C99B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275be1ca98de14a3d17cb7dc221cb5732c30ddd7c6261ea64c867e55c909baa6
Instruction ID: 6a92dc2bca095b3e197cad8df3d9798829d708415b7a06a868beb3d492121e62
Opcode Fuzzy Hash: 275be1ca98de14a3d17cb7dc221cb5732c30ddd7c6261ea64c867e55c909baa6
Instruction Fuzzy Hash: E0C13D75A0021AEFDF14DF98C888AAEB7B5FF48700F10459CE916AB251D731DE81DB90

Function 00CBAA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CBAAB4
CoUninitialize.OLE32 ref: 00CBAABF

Part of subcall function 00CA0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CA027B

VariantInit.OLEAUT32(?), ref: 00CBAACA
VariantClear.OLEAUT32(?), ref: 00CBAD9D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 44f3cba740db80357f79d1e473b2f1aa6a5843a6466a0386e2af51e439b773ca
Instruction ID: 4b4df24b5664c9f7ff167d7a45b39ef114ef53173d3d420f9931638092d2340f
Opcode Fuzzy Hash: 44f3cba740db80357f79d1e473b2f1aa6a5843a6466a0386e2af51e439b773ca
Instruction Fuzzy Hash: 03A137356047019FDB10EF25C491B5AB7E9FF88720F148459FA9A9B3A2CB30ED44DB86

Function 00C991CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C991DD
SysAllocString.OLEAUT32(?), ref: 00C99286
VariantCopy.OLEAUT32 ref: 00C992B5
VariantClear.OLEAUT32(?), ref: 00C992DC

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 0b91c199f7f087e98d41c69aa95296c119a74059f9409fec6048925c258abbe3
Instruction ID: 268450bec53c54bf010c4206a990d7b0442d9fd74d05f8e33939c14ef385b826
Opcode Fuzzy Hash: 0b91c199f7f087e98d41c69aa95296c119a74059f9409fec6048925c258abbe3
Instruction Fuzzy Hash: 13518030600706ABDF249FAE94D9A2EB3A9FF55310F24C81FE55BCB2E1DB7098809705

Function 00CCC4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01536878,?), ref: 00CCC544
ScreenToClient.USER32(?,00000002), ref: 00CCC574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00CCC5DA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 2934c5bafa765843cba71711a975e8a98445b35021563c5bd265988c192224a8
Instruction ID: 7804818766f9177a95797fb0aed89109ae03d56aa7609caf9a5f9aa59994da24
Opcode Fuzzy Hash: 2934c5bafa765843cba71711a975e8a98445b35021563c5bd265988c192224a8
Instruction Fuzzy Hash: DB512C75900209EFCF20DF68C9C0EAE7BB6EB55324F148659F9699B290D730EE41DB90

Function 00C9C410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C9C462
__itow.LIBCMT ref: 00C9C49C

Part of subcall function 00C9C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00C9C753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00C9C505
__itow.LIBCMT ref: 00C9C55A

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: ecae1b4b0aa21afe460ff837648e2f73a1be50a82d75b3471107ac1108b779ed
Instruction ID: ddcd01c3b443ce46a52b1da6bf66c1092e89792f7baba3847548b97b31ea1967
Opcode Fuzzy Hash: ecae1b4b0aa21afe460ff837648e2f73a1be50a82d75b3471107ac1108b779ed
Instruction Fuzzy Hash: F941A471A00208AFDF21EF54C8D6BFE7BB9AF49700F000019FA15A7281DB709B45DBA1

Function 00CA390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00CA3966
SetKeyboardState.USER32(00000080,?,00000001), ref: 00CA3982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00CA39EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00CA3A4D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 7c849633d0f0f26d8129730e130a77c672b6aa2734f005591d0cc5c88e5efb4a
Instruction ID: 034209289799a6639ddc529101f1e9df8f232a6d096d68eb0d6db4a211a9dc7a
Opcode Fuzzy Hash: 7c849633d0f0f26d8129730e130a77c672b6aa2734f005591d0cc5c88e5efb4a
Instruction Fuzzy Hash: E1414A70E04299AEEF208B75C8267FEBBB99B47319F04010AF4D1561C1C7B58F85E761

Function 00CCB544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00CCB5D1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: b55791b793791a4a6a78f9dcdd2d295e72735f34ee5cd4c6e4c5a551d2b86744
Instruction ID: 8286e286a1c0665211f1b340b76107c9c8ced38646372549e0873863ee8f0b22
Opcode Fuzzy Hash: b55791b793791a4a6a78f9dcdd2d295e72735f34ee5cd4c6e4c5a551d2b86744
Instruction Fuzzy Hash: D731E074601208FFEF288F99CC8BFAC7765AB15310F508519FA22D62E1C730EE409B52

Function 00CCD7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00CCD807
GetWindowRect.USER32(?,?), ref: 00CCD87D
PtInRect.USER32(?,?,00CCED5A), ref: 00CCD88D
MessageBeep.USER32(00000000), ref: 00CCD8FE

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 4716cd9202f93a4e5d782eb0911c90b30b19b0d2d8d0d7763260d1ed49ecbfda
Instruction ID: e9fc5a12f4089003546c56e591ed705e551675f28116d077ce828be36977912a
Opcode Fuzzy Hash: 4716cd9202f93a4e5d782eb0911c90b30b19b0d2d8d0d7763260d1ed49ecbfda
Instruction Fuzzy Hash: EF417B74A00219DFCB21DF59D884FAD7BB5BB98311F1881B9E416DB2A0D730E946CB90

Function 00CA3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 00CA3AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00CA3AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00CA3B34
SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 00CA3B92

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9c97ce3f4f4da91d5c2c6c6ded1167a9ef965d85d0f93106c04d5ac2fca725ac
Instruction ID: 575ded16bad9d496e3b9b86e63b816f5e9c59c02ccc4586f7b868f231816d329
Opcode Fuzzy Hash: 9c97ce3f4f4da91d5c2c6c6ded1167a9ef965d85d0f93106c04d5ac2fca725ac
Instruction Fuzzy Hash: 5A314B709002DAAFEF248BA498297FE7BA69B47318F04011AF492971D1C7748F85D775

Function 00C94004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00C94038
__isleadbyte_l.LIBCMT ref: 00C94066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00C94094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00C940CA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: a3825953c9f67bd3abe71e432da86350cd537b7748eabbb5fbcd71655857dd55
Instruction ID: ea664bb04001bee16df08bd91c1ea864452a8550146f36a068d92d88f5feabc7
Opcode Fuzzy Hash: a3825953c9f67bd3abe71e432da86350cd537b7748eabbb5fbcd71655857dd55
Instruction Fuzzy Hash: 2531EF30600246EFDF299F75C848FBB7BA5FF41320F159029EA658B0A0E731D992DB90

Function 00CC7CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00CC7CB9

Part of subcall function 00CA5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CA5F6F
Part of subcall function 00CA5F55: GetCurrentThreadId.KERNEL32 ref: 00CA5F76
Part of subcall function 00CA5F55: AttachThreadInput.USER32(00000000,?,00CA781F), ref: 00CA5F7D

GetCaretPos.USER32(?), ref: 00CC7CCA
ClientToScreen.USER32(00000000,?), ref: 00CC7D03
GetForegroundWindow.USER32 ref: 00CC7D09

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: c7042fee0cf891114fca49970eccd823db2bcd0959047db2d3262862ed2db41e
Instruction ID: 633705119d2b2b1f8d178fe4a6f52195b2aade3e26e82899903674d9ce65ed4e
Opcode Fuzzy Hash: c7042fee0cf891114fca49970eccd823db2bcd0959047db2d3262862ed2db41e
Instruction Fuzzy Hash: D3312F72900109AFDB11EFA5DC859EFBBFDEF54314B10846AE819E7211DA319E059FA0

Function 00CCF1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

GetCursorPos.USER32(?), ref: 00CCF211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00CDE4C0,?,?,?,?,?), ref: 00CCF226
GetCursorPos.USER32(?), ref: 00CCF270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00CDE4C0,?,?,?), ref: 00CCF2A6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 60c64a720951a470c162dbb8bb467e98f3ab084e9639efaff9a52e6109a3a7ec
Instruction ID: acf1d7e4bc9994ef13391681c0522d10b73029451586bff4d94d24dde2f98576
Opcode Fuzzy Hash: 60c64a720951a470c162dbb8bb467e98f3ab084e9639efaff9a52e6109a3a7ec
Instruction Fuzzy Hash: 50217E39501118AFCB258F94D898FFE7BB6EB09720F04806DF9158B2A1D3309E52DB60

Function 00CB431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00CB4358

Part of subcall function 00CB43E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00CB4401
Part of subcall function 00CB43E2: InternetCloseHandle.WININET(00000000), ref: 00CB449E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 2c65161f25902df4b3c900a8796a0703d0767768397e8b49ecf20db5d1a4e2f1
Instruction ID: 2eb6268f9d51dafc9c455b9ded9e595ac75e923de875b66af740ed196595b757
Opcode Fuzzy Hash: 2c65161f25902df4b3c900a8796a0703d0767768397e8b49ecf20db5d1a4e2f1
Instruction Fuzzy Hash: 1D21D435204701BFDB199F609C40FFBB7E9FF44710F08401AFA1696562D771D960A790

Function 00CB8A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00CB8AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00CB8AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 00CB8AFF
WSAGetLastError.WSOCK32(00000000), ref: 00CB8B16

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 65d879448053d104d939131f4d9931f43bcca21e9d7757ceb665f86db62f30b0
Instruction ID: c37cdfa990e63a5ec6998572f4e93007cf1093c91859b2c8933d564a2280be48
Opcode Fuzzy Hash: 65d879448053d104d939131f4d9931f43bcca21e9d7757ceb665f86db62f30b0
Instruction Fuzzy Hash: 01218471A001249FD7219F69CC85B9E7BECEF4A310F008169F84ADB250DB74DA45CB90

Function 00CC8A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00CC8AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00CC8AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00CC8ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00CC8ADC

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 9e0bc66ff53d03390d0990759af2d7b85b962baff83b43fd77a2748474395361
Instruction ID: 4404c1e8a2d2d8f7eabce2abd8f36773998e02d16a6a9b892660ff000a44a339
Opcode Fuzzy Hash: 9e0bc66ff53d03390d0990759af2d7b85b962baff83b43fd77a2748474395361
Instruction Fuzzy Hash: EA11BE31305511AFE715AB18CC85FBE7799AF85320F148119F826CB2E2CB70AD059794

Function 00CA0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00CA0ABB,?,?,?,00CA187A,00000000,000000EF,00000119,?,?), ref: 00CA1E77
Part of subcall function 00CA1E68: lstrcpyW.KERNEL32(00000000,?,?,00CA0ABB,?,?,?,00CA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00CA1E9D
Part of subcall function 00CA1E68: lstrcmpiW.KERNEL32(00000000,?,00CA0ABB,?,?,?,00CA187A,00000000,000000EF,00000119,?,?), ref: 00CA1ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00CA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00CA0AD4
lstrcpyW.KERNEL32(00000000,?,?,00CA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00CA0AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,00CA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00CA0B2E

Strings

cdecl, xrefs: 00CA0B25

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: cb422e936b0066431499d7a47f43cbafe036e612ab3b4cbe7a6f236babcc94e3
Instruction ID: af785505b307737c2c9f3022bd8626c28898bae759ce7687295bc96fb314a6b5
Opcode Fuzzy Hash: cb422e936b0066431499d7a47f43cbafe036e612ab3b4cbe7a6f236babcc94e3
Instruction Fuzzy Hash: F511D636100346AFDB259F24DC45E7E77A8FF46354F90406AF806CB250EB719951D7A1

Function 00C92F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C92FB5

Part of subcall function 00C8395C: __FF_MSGBANNER.LIBCMT ref: 00C83973
Part of subcall function 00C8395C: __NMSG_WRITE.LIBCMT ref: 00C8397A
Part of subcall function 00C8395C: RtlAllocateHeap.NTDLL(01510000,00000000,00000001,00000001,00000000,?,?,00C7F507,?,0000000E), ref: 00C8399F

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 05d5e461fb07bbd9624fe9245f891dd9d5394cc0827c35627a0e6eb22dfb9a58
Instruction ID: 2fceb125cbc9cd9fd0ed755ff5b0c071a7760c219d5e62fcc0c146f6bc23387b
Opcode Fuzzy Hash: 05d5e461fb07bbd9624fe9245f891dd9d5394cc0827c35627a0e6eb22dfb9a58
Instruction Fuzzy Hash: 6A110A32408251ABCF313FB0AC4C7693BA8AF10364F244925F859DB161DB34CA40EB94

Function 00CA058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00CA05AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00CA05C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00CA05DD
FreeLibrary.KERNEL32(?), ref: 00CA0632

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: e62c33b301e884e2b5a35644a6ee8f0802d048be0b13281ff667ab0d534b8159
Instruction ID: c8cfea899ea9409d39b79009a253b43cdbcd188ee7887669344990f6a9bd6ea3
Opcode Fuzzy Hash: e62c33b301e884e2b5a35644a6ee8f0802d048be0b13281ff667ab0d534b8159
Instruction Fuzzy Hash: 9621BE7190020AEFDB208F91DD88BDABBB8EF4138CF20846DF91696050D771EA94DF50

Function 00CA6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00CA6733
_memset.LIBCMT ref: 00CA6754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00CA67A6
CloseHandle.KERNEL32(00000000), ref: 00CA67AF

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: d86d068513cd66ca81053337c64c1c698dc7ad81e9bca97e97db99e428e3f116
Instruction ID: 3c9cfc5e304c79e030af00b5e87278fe6b34dc7ee24d22a4b716092a3be5a030
Opcode Fuzzy Hash: d86d068513cd66ca81053337c64c1c698dc7ad81e9bca97e97db99e428e3f116
Instruction Fuzzy Hash: 53110A719012287AE72057A5AC4DFAFBABCEF45724F10419AF505E71D0D2704F808B64

Function 00C9B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C9AA79
Part of subcall function 00C9AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C9AA83
Part of subcall function 00C9AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C9AA92
Part of subcall function 00C9AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C9AA99
Part of subcall function 00C9AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C9AAAF

GetLengthSid.ADVAPI32(?,00000000,00C9ADE4,?,?), ref: 00C9B21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00C9B227
HeapAlloc.KERNEL32(00000000), ref: 00C9B22E
CopySid.ADVAPI32(?,00000000,?), ref: 00C9B247

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: f82a271fe2a488d2b91c98177497c79e1dc8046664044a5d7f4acee69312394e
Instruction ID: e7fe86a1b8d774e7295f8270a3ace680ef7c4c1ce1639abae4ce3bf4bd94dbe8
Opcode Fuzzy Hash: f82a271fe2a488d2b91c98177497c79e1dc8046664044a5d7f4acee69312394e
Instruction Fuzzy Hash: 2711BC71A00605FFCF149F98EE88BAEB7A9EF84314B24802DE9529B210D771EE44DB10

Function 00C9B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C9B498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C9B4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C9B4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C9B4DB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7d597b76d3b10319257f3d07e8926b271948bec26d18e2a6537eeee6ab814562
Instruction ID: f2d3b9d2729a669d29868d7cced6a44d6336c432b4c787dfa198fd4ac6ba2105
Opcode Fuzzy Hash: 7d597b76d3b10319257f3d07e8926b271948bec26d18e2a6537eeee6ab814562
Instruction Fuzzy Hash: D711367A900218BFDF11DBA9C985E9DBBB8FB08700F204091E604A7290D771AE10EB94

Function 00C7B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00C7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00C7B35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00C7B5A5
GetClientRect.USER32(?,?), ref: 00CDE69A
GetCursorPos.USER32(?), ref: 00CDE6A4
ScreenToClient.USER32(?,?), ref: 00CDE6AF

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 9bde7ae31ea1fa33d34adde69566fa66ddd8d703089896cb5042b879f03dd75c
Instruction ID: 8862468ec6a6554be250fb50d3eb30e8d0f747c38faca628a51007ea9b40e7db
Opcode Fuzzy Hash: 9bde7ae31ea1fa33d34adde69566fa66ddd8d703089896cb5042b879f03dd75c
Instruction Fuzzy Hash: 94114871900129BFCB10EF94DC85AFE7BB8EB08305F004455F916EB240D730AE82DBA1

Function 00CA732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CA7352
MessageBoxW.USER32(?,?,?,?), ref: 00CA7385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00CA739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00CA73A2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: c21a111a7296f5bfcea91d3680cf0c2002f61869c9c23eef486e18633a6899ea
Instruction ID: ef902044bc9be7e0c868db857957b88921b983fb20d526882ece531c3efde57f
Opcode Fuzzy Hash: c21a111a7296f5bfcea91d3680cf0c2002f61869c9c23eef486e18633a6899ea
Instruction Fuzzy Hash: 41110472A04245EFCB019BA8DC49B9E7BADAF46324F144315F921E33A1D6B48E0097B4

Function 00C7D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C7D1BA
GetStockObject.GDI32(00000011), ref: 00C7D1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 00C7D1D8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 1e7b568030d484b409009344119597273e6d736dbf394f9cf843929bf59d9e3a
Instruction ID: 57191fd8e4828e57b9702d77a33fca1f81b5966f4eb0685ff13a37631e548609
Opcode Fuzzy Hash: 1e7b568030d484b409009344119597273e6d736dbf394f9cf843929bf59d9e3a
Instruction Fuzzy Hash: 4F118B72101649BFEF124F909C90EEEBB6DFF18365F448102FA1A56150C7319D61ABA0

Function 00C94DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00C94E16

Part of subcall function 00C954F5: __fltout2.LIBCMT ref: 00C9551E

__cftog_l.LIBCMT ref: 00C94E3C
__cftoe_l.LIBCMT ref: 00C94E6E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 84b39af4939d12c024a4858d79d3872d448d8699fed1b34c17ab245fa6126710
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 9F01483200014EBBCF1B5E84DC19CEE7F22BB18754B598455FE2859031D336CAB2AB81

Function 00C87452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C87A0D: __getptd_noexit.LIBCMT ref: 00C87A0E

__lock.LIBCMT ref: 00C8748F
InterlockedDecrement.KERNEL32(?), ref: 00C874AC
_free.LIBCMT ref: 00C874BF
InterlockedIncrement.KERNEL32(015231E0), ref: 00C874D7

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: b9c558774851fc095d12d672fc8629267d3c3764799ba029100613986be03d71
Instruction ID: c376e0ed15d5309959391ab7f5d4688b1699e90c054c3f58dd1d72cde5de00ab
Opcode Fuzzy Hash: b9c558774851fc095d12d672fc8629267d3c3764799ba029100613986be03d71
Instruction Fuzzy Hash: 15019B3290A721ABC711BF64950579DBB607F44728F254205F834A7790DB34DA41DFDE

Function 00C87A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00C87AD8

Part of subcall function 00C87CF4: __mtinitlocknum.LIBCMT ref: 00C87D06
Part of subcall function 00C87CF4: EnterCriticalSection.KERNEL32(00000000,?,00C87ADD,0000000D), ref: 00C87D1F

InterlockedIncrement.KERNEL32(?), ref: 00C87AE5
__lock.LIBCMT ref: 00C87AF9
___addlocaleref.LIBCMT ref: 00C87B17

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: 66d875e56767a2ba734228595c44b2ba9a7f183f51a54644dd32fd7eeabffd55
Instruction ID: c3ac21dc6ddd99c9ef8060e171c3966045a1d9122366204502f47e6a17f5ea3e
Opcode Fuzzy Hash: 66d875e56767a2ba734228595c44b2ba9a7f183f51a54644dd32fd7eeabffd55
Instruction Fuzzy Hash: 6E018071405B00EFD721EF79D90675AB7F0EF40329F20890EE49A976A0DBB0A684DB19

Function 00CCE32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CCE33D
_memset.LIBCMT ref: 00CCE34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00D23D00,00D23D44), ref: 00CCE37B
CloseHandle.KERNEL32 ref: 00CCE38D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 72fc29ee38373caee526315ee5ce79a1f6487216f268992200e97d3810641a59
Instruction ID: ea71f90729c1fb3e50d081fa1f3a0733ba8327c4a5cacfc35533f5f88c22a3c6
Opcode Fuzzy Hash: 72fc29ee38373caee526315ee5ce79a1f6487216f268992200e97d3810641a59
Instruction Fuzzy Hash: EEF089F1640354BEE3102760AC45F777E5CD714754F004421FF05DA2A2D3795E0157B8

Function 00CCEA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00C7AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00C7AFE3
Part of subcall function 00C7AF83: SelectObject.GDI32(?,00000000), ref: 00C7AFF2
Part of subcall function 00C7AF83: BeginPath.GDI32(?), ref: 00C7B009
Part of subcall function 00C7AF83: SelectObject.GDI32(?,00000000), ref: 00C7B033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00CCEA8E
LineTo.GDI32(00000000,?,?), ref: 00CCEA9B
EndPath.GDI32(00000000), ref: 00CCEAAB
StrokePath.GDI32(00000000), ref: 00CCEAB9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 3ae3dbe1145362b2e6bd105488c1ef62e34018b3154223407e168f385f505870
Instruction ID: acd4920bbed1118db15279cc2b047471ff598cab3ab19bc229682e52c8a595a5
Opcode Fuzzy Hash: 3ae3dbe1145362b2e6bd105488c1ef62e34018b3154223407e168f385f505870
Instruction Fuzzy Hash: 52F08231005299BBDB22AF94ED0EFCE3F19AF1A321F088101FE22691E1C7755652DBA5

Function 00C9C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00C9C84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C9C85D
GetCurrentThreadId.KERNEL32 ref: 00C9C864
AttachThreadInput.USER32(00000000), ref: 00C9C86B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 131ed999fffa6d727fad4ef4d0317621d2c5f5a00358dc3f19e37d075400ec78
Instruction ID: 77fb1bb5dd0783d4a35348c2f0472aac8cfc70ed2a3804d436618b98979e2890
Opcode Fuzzy Hash: 131ed999fffa6d727fad4ef4d0317621d2c5f5a00358dc3f19e37d075400ec78
Instruction Fuzzy Hash: C2E039711412A8BADB201BA2DC8DFDF7F1CEF067A1F008421B60A884A0C6B1C581CBE0

Function 00C9B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00C9B0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,00C9AC9D), ref: 00C9B0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00C9AC9D), ref: 00C9B0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,00C9AC9D), ref: 00C9B0F1

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: ed8271d7d029a1223a6de2bb597f4d5a80f5415b4c044d3637063ad7f1fd170a
Instruction ID: 7c5240c02c4f5069d520d41ee09fb7e151310108af41bb1ac7c1c3c045d79cd7
Opcode Fuzzy Hash: ed8271d7d029a1223a6de2bb597f4d5a80f5415b4c044d3637063ad7f1fd170a
Instruction Fuzzy Hash: 65E08672601251ABDB201FB1AE4DB4F3BA8EF55792F018828F242DE050DB348901C761

Function 00C7B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00C7B496
SetTextColor.GDI32(?,000000FF), ref: 00C7B4A0
SetBkMode.GDI32(?,00000001), ref: 00C7B4B5
GetStockObject.GDI32(00000005), ref: 00C7B4BD
GetWindowDC.USER32(?,00000000), ref: 00CDDE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00CDDE38
GetPixel.GDI32(00000000,?,00000000), ref: 00CDDE51
GetPixel.GDI32(00000000,00000000,?), ref: 00CDDE6A
GetPixel.GDI32(00000000,?,?), ref: 00CDDE8A
ReleaseDC.USER32(?,00000000), ref: 00CDDE95

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 051c6ea1c515a4353d1aa413ad30a27511ccfd0a2b19af0553e5eb9a4cf7ead2
Instruction ID: 0094b21d2b53df7de4c9d9f6b71aacab25bd00bfb4b629be4b13a8b3715a61b9
Opcode Fuzzy Hash: 051c6ea1c515a4353d1aa413ad30a27511ccfd0a2b19af0553e5eb9a4cf7ead2
Instruction Fuzzy Hash: 9BE0ED31500280AADF215F64AC89BDC3B11AB52336F14C666F7BB5C0E1C7B28A81DB11

Function 00C9B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C9B2DF
UnloadUserProfile.USERENV(?,?), ref: 00C9B2EB
CloseHandle.KERNEL32(?), ref: 00C9B2F4
CloseHandle.KERNEL32(?), ref: 00C9B2FC

Part of subcall function 00C9AB24: GetProcessHeap.KERNEL32(00000000,?,00C9A848), ref: 00C9AB2B
Part of subcall function 00C9AB24: HeapFree.KERNEL32(00000000), ref: 00C9AB32

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 68251934a385bc41feef22575efbf8e323223d0597a6e6bd098f5bc94ef1bf04
Instruction ID: 2f201d3f10e93de1905f0adce920f1e851f26a6dcf961c4f1bb9b11e6a55fbd3
Opcode Fuzzy Hash: 68251934a385bc41feef22575efbf8e323223d0597a6e6bd098f5bc94ef1bf04
Instruction Fuzzy Hash: 5BE0EC3A104445BFCB012FA5EC48A5DFFB6FF983213108221F62685575CB33A871EB91

Function 00CDB29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CDB29A
GetDC.USER32(00000000), ref: 00CDB2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CDB2C3
ReleaseDC.USER32 ref: 00CDB2E2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 396778cde470d8f452e996eaca79878f1f99b87ccfb0f2317836fed8082f2839
Instruction ID: b2b4b2d561d7cd88287f3dbe0facfe44bf0a76e6cc91c46dc225891867a06d73
Opcode Fuzzy Hash: 396778cde470d8f452e996eaca79878f1f99b87ccfb0f2317836fed8082f2839
Instruction Fuzzy Hash: 87E012B2100244EFEB015F708888B6E7BA8EB4C350F12C80AF95F8B210CA7598409B40

Function 00CDB2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CDB2AE
GetDC.USER32(00000000), ref: 00CDB2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CDB2C3
ReleaseDC.USER32 ref: 00CDB2E2

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1375487d7e95add476275fa20e154958465c7509939eabc210ce07c1f5566856
Instruction ID: 0bbbb01e040835a76cfce7790edc2a4c16574d676c1036f73236fccbe6f67fca
Opcode Fuzzy Hash: 1375487d7e95add476275fa20e154958465c7509939eabc210ce07c1f5566856
Instruction Fuzzy Hash: EBE046B1500240EFEB015F70C88876D7BA8EB4C350F11C809F95F8B210CB7A98008B00

Function 00C9DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00C9DEAA

Strings

Container, xrefs: 00C9DE29
AutoIt3GUI, xrefs: 00C9DE22

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: ab5cdcad4b8d30ee6e6c6ff0b0a83e4651971084147545a8d66227452437b90b
Instruction ID: b97e1de52c90eb9f4f554345718b348e27fdbc3a2a05411ec7a464b40e0d4d17
Opcode Fuzzy Hash: ab5cdcad4b8d30ee6e6c6ff0b0a83e4651971084147545a8d66227452437b90b
Instruction Fuzzy Hash: B3915674600701AFDB14CF64C889B6ABBF9BF49710F20846DF85ADB691DB71E981CB60

Function 00C7BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00C7BCDA
GlobalMemoryStatusEx.KERNEL32 ref: 00C7BCF3

Strings

@, xrefs: 00C7BCE8

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: c97c85968843dc7e72f511c10b4f2085bd656adfe401e08abe3f02a738ef6b93
Instruction ID: 73bb0bc93e010b0ee5f6b8060bf315dee0ae1ab3b7d47d3ce3bc0c2458537f62
Opcode Fuzzy Hash: c97c85968843dc7e72f511c10b4f2085bd656adfe401e08abe3f02a738ef6b93
Instruction Fuzzy Hash: 57513971408744ABE320AF14DC86BAFBBE8FF94354F41884DF1C8411A6DF7185A9D762

Function 00CAC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00C644ED: __fread_nolock.LIBCMT ref: 00C6450B

_wcscmp.LIBCMT ref: 00CAC65D
_wcscmp.LIBCMT ref: 00CAC670

Strings

FILE, xrefs: 00CAC5A5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 947cdc744c08912be226677b55807ac5f15397dc8c15cd71f5c1bb229c5587d3
Instruction ID: 97159470f8ac20ab4e66c8fa8c1503fc15e958c69bb35754de22b7eb837c25f4
Opcode Fuzzy Hash: 947cdc744c08912be226677b55807ac5f15397dc8c15cd71f5c1bb229c5587d3
Instruction Fuzzy Hash: 6A41D876A0020ABBDF21EAA4DC82FEF77B99F89714F004069F615E7181DA709A05DB61

Function 00CCA76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00CCA85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00CCA86F

Strings

', xrefs: 00CCA7C3

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a421cffe1597d8b6b50393ae088b231c06255fd8e758d5b3c38acf2fbb9a7789
Instruction ID: 49ddeae30f12d752d7ff3553c9010f7b8b2cc269e9a299dd0c2f6e3ecbedcc26
Opcode Fuzzy Hash: a421cffe1597d8b6b50393ae088b231c06255fd8e758d5b3c38acf2fbb9a7789
Instruction Fuzzy Hash: 6741D474E013099FDB14CF69D885FDA7BB9FB08304F14416AE915AB381D770A942CFA1

Function 00CB5180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CB5190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00CB51C6

Strings

|, xrefs: 00CB51B5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 9bc8bc9ef67392babe19f5a66afc9a771b3c186b928bbc2a9ffde3732f2ff023
Instruction ID: 48de2bb594eeee44eb02d68900e17ca200dbfd32f4051a4ba4a8c22335929f4e
Opcode Fuzzy Hash: 9bc8bc9ef67392babe19f5a66afc9a771b3c186b928bbc2a9ffde3732f2ff023
Instruction Fuzzy Hash: 96313771C01119AFCF11EFA4CC85AEEBFB9FF18700F104019F815A6166EB35AA46DBA0

Function 00CC975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00CC980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00CC984A

Strings

static, xrefs: 00CC97AA

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 6d9f368befe86adbf9fc44cbef18a16ebe23226f1b4950ee9d027fbc9e19cede
Instruction ID: 3cf4f82335f708e2171e383223274d82ec49b70f2b5696a5c511b5990b0a473d
Opcode Fuzzy Hash: 6d9f368befe86adbf9fc44cbef18a16ebe23226f1b4950ee9d027fbc9e19cede
Instruction Fuzzy Hash: 13316671110604AAEB109F68CC85FBB73B9FF99764F00861DF9AAC7190CA31AD81DB60

Function 00CA5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA51C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00CA5201

Strings

0, xrefs: 00CA51BF

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 0d000eaf9329f824188cc23b1b7176ef43b64a5ebb8e090cab6cdef5cef1e3fe
Instruction ID: e4eaf169d37fcc2a725524fac43a9bc8746b4139666ecaf535f2a7f8e840dc03
Opcode Fuzzy Hash: 0d000eaf9329f824188cc23b1b7176ef43b64a5ebb8e090cab6cdef5cef1e3fe
Instruction Fuzzy Hash: C4313671600706DBEB24CF89D884BAEBBF4EF42358F148129E9A1E61A0D7749B44CB10

Function 00CB658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00CB6608

Strings

AUTOITCALLVARIABLE%d, xrefs: 00CB65FA
, $, xrefs: 00CB6648

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: 2c6d6672e53b784e57493100b5c6cfde8f183ab85aaf448d591c3d22479a6048
Instruction ID: a714dcb8afea28e427b0b5d6aa279b65840836eaebf8aac8661e0ee2bbc9016b
Opcode Fuzzy Hash: 2c6d6672e53b784e57493100b5c6cfde8f183ab85aaf448d591c3d22479a6048
Instruction Fuzzy Hash: 86218D71A00218BFCF20EFA4D8C2EEE77B4AF45740F100469F505AB181DB74EA59DBA5

Function 00CC93CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00CC945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00CC9467

Strings

Combobox, xrefs: 00CC9429

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: a771714303074321fe50c41395fe3ba539d388c31c1eb80b44fdefc3b572c3eb
Instruction ID: cce16ba8baf6aacfc49403c8b442d0d1618ebf17048cf6acd54f0ecac95ec501
Opcode Fuzzy Hash: a771714303074321fe50c41395fe3ba539d388c31c1eb80b44fdefc3b572c3eb
Instruction Fuzzy Hash: 8F11B2713002086FEF25DF54DC84FBB376EEB583A4F104129F929972A0D6319D52DB60

Function 00CC98FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00C7D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C7D1BA
Part of subcall function 00C7D17C: GetStockObject.GDI32(00000011), ref: 00C7D1CE
Part of subcall function 00C7D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C7D1D8

GetWindowRect.USER32(00000000,?), ref: 00CC9968
GetSysColor.USER32(00000012), ref: 00CC9982

Strings

static, xrefs: 00CC9945

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 615c570a301666780e42df621def925ee4de60842ef1cd9d63cd51585c0169b6
Instruction ID: 841d0bd92cce2f62f7f0ca5ba0deae1d4c4adb603e3870800e2a1a90c4078232
Opcode Fuzzy Hash: 615c570a301666780e42df621def925ee4de60842ef1cd9d63cd51585c0169b6
Instruction Fuzzy Hash: CF111472520209AFDB04DFB8C849EEE7BA8EB08354F01462CF95AE2250E635E851DB60

Function 00CC9617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00CC9699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00CC96A8

Strings

edit, xrefs: 00CC967D

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 0fb63f77dcf3bf0b7b70de5424bfdfb2d0fec8a2ebf5cc3a2e60de96c47fdafb
Instruction ID: d3069143a904fb4194eae09cb41a5ed070f0e1f989c96d275fce752a240b1aea
Opcode Fuzzy Hash: 0fb63f77dcf3bf0b7b70de5424bfdfb2d0fec8a2ebf5cc3a2e60de96c47fdafb
Instruction Fuzzy Hash: CC116A71500208ABEB519FA4DC88FEB3B6AEB15378F504718F975971E0C731DC51A760

Function 00CA5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA52D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00CA52F4

Strings

0, xrefs: 00CA52CE

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: c5af7fc0e1db5404146844488cfb3a42fc912db85bc4b9ec3a434264c59d4c72
Instruction ID: 12547d4d37df9d0c0fe978c9d71740382ebbfa0f76c64059d2679b76b3c70dce
Opcode Fuzzy Hash: c5af7fc0e1db5404146844488cfb3a42fc912db85bc4b9ec3a434264c59d4c72
Instruction Fuzzy Hash: EB112675D02B16EBDF20DB99D844B9D77B8AB57358F058121E911E72A0D3B0EE05C7A0

Function 00CB4D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00CB4DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00CB4E1E

Strings

<local>, xrefs: 00CB4DE6

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 115de26771301f4030e5181856d47fabbdb9e00a153f04dcb3545a71d8e2f6e6
Instruction ID: 2823b7a8fba9e2f94360ec3b5f8d68efdfa87acbf4c3cf855ad8f4557b585072
Opcode Fuzzy Hash: 115de26771301f4030e5181856d47fabbdb9e00a153f04dcb3545a71d8e2f6e6
Instruction Fuzzy Hash: 3911A070509261BBDB298F62C8C9FFBFAA8FF06755F10822AF52556141D3709A40C6F0

Function 00CBA82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00CBA84E
htons.WSOCK32(00000000,?,00000000), ref: 00CBA88B

Strings

255.255.255.255, xrefs: 00CBA866

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 147658ceb994b812aee8ec2e4e50cf149ed7ac8059ae3cd772e718788a469cd6
Instruction ID: 6f4b88e38b2dee8cb903a30aa1b272cb25f8d16a031fc131534722b288940502
Opcode Fuzzy Hash: 147658ceb994b812aee8ec2e4e50cf149ed7ac8059ae3cd772e718788a469cd6
Instruction Fuzzy Hash: 6E01F575200305ABCB209F68D886FEDB364EF45314F10842AF5669B7D1D772E901D756

Function 00C9B781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00C9B7EF

Strings

ComboBox, xrefs: 00C9B78B
ListBox, xrefs: 00C9B7B9

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 88081caebfa97eb958994436c015cdd3d6c081b713e560dceb057369a5a1d906
Instruction ID: 41a359a86827021f64ea9f2810233b407e6e5cd85beee088341bf12f8277221e
Opcode Fuzzy Hash: 88081caebfa97eb958994436c015cdd3d6c081b713e560dceb057369a5a1d906
Instruction Fuzzy Hash: 4601F1B1600114BBCF04EBA4DC869FE3369AF45310B00061CF4B2672D2EB715D1897A0

Function 00C9B67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 00C9B6EB

Strings

ComboBox, xrefs: 00C9B687
ListBox, xrefs: 00C9B6B5

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 090555b2f44ea8854327d70d96d54477519c29597d0eded9eeeafe72956dedd5
Instruction ID: 624ad0848d7d379c1232c91ad94bde66641fb2a5ff4133f65705ce53576f0399
Opcode Fuzzy Hash: 090555b2f44ea8854327d70d96d54477519c29597d0eded9eeeafe72956dedd5
Instruction Fuzzy Hash: 85018FB1641108BBCF18EBA4DA96BFE73A89F05344B100019B552B3181DB956E28A7B5

Function 00C9B700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 00C9B76C

Strings

ComboBox, xrefs: 00C9B70A
ListBox, xrefs: 00C9B738

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: b1ee905d06a5e74e155f4b9e5f329c497700db4c0e63c9c28dfd4255b4bce625
Instruction ID: 434341ae5150de79880e6aff9ece3bfcab176960fb262059aa133c6480fa2f7a
Opcode Fuzzy Hash: b1ee905d06a5e74e155f4b9e5f329c497700db4c0e63c9c28dfd4255b4bce625
Instruction Fuzzy Hash: 1B01D1B1640104BBCF10EBA4EA86FFF73AC9F05344F100119B442B3192DB655F19A7B5

Function 00CA7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CA7762
_wcscmp.LIBCMT ref: 00CA7774

Strings

#32770, xrefs: 00CA776E

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: ffe6524d8aa073c18f1220515e5d821e67019876192ec59670a48c6db1487280
Instruction ID: 258aca56f7ad5bf7e0d9fb6f593f742ca573966d1ee0c996d770718c803045b6
Opcode Fuzzy Hash: ffe6524d8aa073c18f1220515e5d821e67019876192ec59670a48c6db1487280
Instruction Fuzzy Hash: 91E022336043242BDB20EBA5AC09F8BFBACAB51764F000016F915D3041D670A74187E0

Function 00C9A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00C9A63F

Part of subcall function 00C813F1: _doexit.LIBCMT ref: 00C813FB

Strings

AutoIt, xrefs: 00C9A633
Error allocating memory., xrefs: 00C9A638

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 82898af30076a0733fa9d8118d76929745befbde1568e04b4750bf0fe21ffa6f
Instruction ID: cb566328f0099ef800f873b251975e9c791a9efe7151b17a142ebcd84d77a70f
Opcode Fuzzy Hash: 82898af30076a0733fa9d8118d76929745befbde1568e04b4750bf0fe21ffa6f
Instruction Fuzzy Hash: 8AD02B313C031833C21136E87C0BFD8364C8B04B51F040025BF0C991D24DD3878012EA

Function 00CDAE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00CDACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00CDAEBD

Strings

WIN_XPe, xrefs: 00CDACD3

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 89f5cee1d643e1d9fe1f88be1d02cf1e2bd1a60cec35c0bf0818802ef8062bfd
Instruction ID: eea1158561a8d11ed3f28cb2c186fa2028563cbaa14b820c051965ff8d31322a
Opcode Fuzzy Hash: 89f5cee1d643e1d9fe1f88be1d02cf1e2bd1a60cec35c0bf0818802ef8062bfd
Instruction Fuzzy Hash: ACE06D70C10249EFCB11DBA9D984AECB7B8AB88301F108082E213B6260CB314A84DF22

Function 00CC86CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00CC86E2
PostMessageW.USER32(00000000), ref: 00CC86E9

Part of subcall function 00CA7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CA7AD0

Strings

Shell_TrayWnd, xrefs: 00CC86DB

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 64004e6327e21e2c2feeead26378465f873e132f3a3cb93fca87594657bc2369
Instruction ID: 6d56190a1c6bb76951cdb006a22179e07d78fe8eb29ee0961ef2c687b71e805c
Opcode Fuzzy Hash: 64004e6327e21e2c2feeead26378465f873e132f3a3cb93fca87594657bc2369
Instruction Fuzzy Hash: 8DD012713C53547BF664A770AC4BFCA7A18AB05B11F110915B746EE1D0C9F0ED40C764

Function 00CC8698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00CC86A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00CC86B5

Part of subcall function 00CA7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CA7AD0

Strings

Shell_TrayWnd, xrefs: 00CC869B

Memory Dump Source

Source File: 00000000.00000002.1448103772.0000000000C61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C60000, based on PE: true

Associated: 00000000.00000002.1448088693.0000000000C60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448151229.0000000000D0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448194258.0000000000D1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448211289.0000000000D57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_New_Order_Inquiry.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4c0e370d189c38b61a981b5354f399dc5fca4581ca5a79e8e428a9a8d3b7ec7c
Instruction ID: a34192313c998766646b5841c0009e0d031194cc528d02ea1f0df5bf82bad147
Opcode Fuzzy Hash: 4c0e370d189c38b61a981b5354f399dc5fca4581ca5a79e8e428a9a8d3b7ec7c
Instruction Fuzzy Hash: C0D01271385354BBF664A770AC4BFCA7A18AB04B11F110915B74AAE1D0C9F0ED40C764

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New_Order_Inquiry.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Sheitan

C:\Users\user\AppData\Local\Temp\aut2F3.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
New_Order_Inquiry.exe

Function 00C8B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00C63D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Function 00C7DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 00C6406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00CAFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Function 00CABFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316
fileCOMMON

Function 00C63F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00C63742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00C63E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 00C8ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Function 0174E228 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00C649FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 00C636B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 0174DFE8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148
fileCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre