Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561634
MD5:	2699448f43fe2a97c2cf07bf56fe92f3
SHA1:	672e4bdd08082c99ed7adba3799288c22f50338e
SHA256:	a4ac352fe49d6162961007d64b2ac23413cc5575ea17b61a91f6d808795e994b
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4252 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2699448F43FE2A97C2CF07BF56FE92F3)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+000001E8h]	0_2_00CBE0D8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	0_2_00CEF8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, eax	0_2_00CEF8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	0_2_00CEBCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, eax	0_2_00CEB8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	0_2_00CEB8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+14h]	0_2_00CB98F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	0_2_00CBBC9D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebp	0_2_00CB5C90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebp	0_2_00CB5C90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00CD8CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	0_2_00CEC040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C18BC4BAh	0_2_00CEC040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6DBC3610h	0_2_00CEC040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	0_2_00CEC040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	0_2_00CEB860
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00CD0870
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, eax	0_2_00CBC02B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+14h]	0_2_00CBE970
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	0_2_00CBAD00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	0_2_00CD5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_00CBEA38
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx+00008F12h]	0_2_00CB77D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ebp+ebx*4+00h], ax	0_2_00CB77D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	0_2_00CBE35B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-58FA0F6Ch]	0_2_00CF0F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], bl	0_2_00CBCF05

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE4470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00CE4470

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE4470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00CE4470

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB89A0	0_2_00CB89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB6CC0	0_2_00CB6CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBE0D8	0_2_00CBE0D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB94D0	0_2_00CB94D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEF8D0	0_2_00CEF8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE24E0	0_2_00CE24E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEB8E0	0_2_00CEB8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB98F0	0_2_00CB98F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF0C80	0_2_00CF0C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB5C90	0_2_00CB5C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD8CB0	0_2_00CD8CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB6840	0_2_00CB6840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB4040	0_2_00CB4040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEC040	0_2_00CEC040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD0870	0_2_00CD0870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB542C	0_2_00CB542C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE9030	0_2_00CE9030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE41D0	0_2_00CE41D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB3580	0_2_00CB3580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF1580	0_2_00CF1580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB61A0	0_2_00CB61A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBE970	0_2_00CBE970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD3D70	0_2_00CD3D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBAD00	0_2_00CBAD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC9530	0_2_00CC9530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB5AC9	0_2_00CB5AC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB4AC0	0_2_00CB4AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD5E90	0_2_00CD5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD0650	0_2_00CD0650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB9210	0_2_00CB9210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBB210	0_2_00CBB210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD7E20	0_2_00CD7E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB77D0	0_2_00CB77D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB27D0	0_2_00CB27D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB2B80	0_2_00CB2B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEC780	0_2_00CEC780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD1790	0_2_00CD1790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE87B0	0_2_00CE87B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCFB60	0_2_00CCFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF0F60	0_2_00CF0F60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD8770	0_2_00CD8770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBCF05	0_2_00CBCF05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCDB30	0_2_00CCDB30

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: sus24.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE9030 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,

0_2_00CE9030

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC5057 push eax; iretd	0_2_00CC5058
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC8028 push esp; ret	0_2_00CC802B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC642B push esp; ret	0_2_00CC6438
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC81DA push eax; iretd	0_2_00CC81DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC8100 push esp; iretd	0_2_00CC8102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC811F push esp; iretd	0_2_00CC8135
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC4BB8 push esp; iretd	0_2_00CC4BD4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_0-6212

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CEDF70 LdrInitializeThunk,

0_2_00CEDF70

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	2 System Information Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	2 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561634
Start date and time:	2024-11-24 02:22:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	SUS
Classification:	sus24.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.844134547555611
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	314'368 bytes
MD5:	2699448f43fe2a97c2cf07bf56fe92f3
SHA1:	672e4bdd08082c99ed7adba3799288c22f50338e
SHA256:	a4ac352fe49d6162961007d64b2ac23413cc5575ea17b61a91f6d808795e994b
SHA512:	8cb00120efae52c666235edbc33412cbac8e731fd247340ed76b4ca10602532bbf97bb9b81e8af7d348e65598f4847dc59db761afc470c0ee10f1426a564aa9d
SSDEEP:	6144:uo4HXvnCuQlBHyS0zIrm09/67XQIPwES4J3PjYTMMA:p4HXvA7HyYyK/QCEtJfjYTM
TLSH:	0C649D0ADB3395A1D987547862CEB33F9D341B0153348EE7DBC4DEC66823EE19936A06
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..........................................@.......................................@..................................;.....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4089a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F3C51 [Thu Nov 21 13:57:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	efd5a1321fb3549606827ae52de6c65d

Entrypoint Preview

Instruction
push ebp
push ebx
push edi
push esi
sub esp, 00000234h
call 00007F0158852F26h
test al, al
je 00007F015881F062h
lea eax, dword ptr [esp+2Ch]
push 00000000h
push 00000010h
push eax
push 00000000h
call dword ptr [00443D20h]
call 00007F015884C9B8h
test al, al
je 00007F015881F03Fh
call dword ptr [00443D38h]
mov ebx, eax
call dword ptr [00443D34h]
mov edx, 92A9E86Dh
mov esi, A1396FFBh
mov ecx, ebx
shrd esi, edx, cl
mov dword ptr [esp+14h], eax
shr edx, cl
test bl, 00000020h
je 00007F015881ED66h
mov esi, edx
xor edx, edx
mov eax, esi
xor eax, A1396FFBh
mov dword ptr [esp], eax
mov dword ptr [esp+10h], esi
mov ecx, esi
mov edi, esi
xor ecx, 5EC69004h
mov dword ptr [esp+0Ch], ecx
and ecx, 0C9A8831h
and eax, F36577CEh
or eax, ecx
mov ebp, edx
xor ebp, 92A9E86Dh
mov esi, edx
mov ebx, edx
xor edx, 6D561792h
mov dword ptr [esp+20h], edx
and edx, B02F9AF5h
mov ecx, ebp
mov dword ptr [esp+1Ch], ebp
and ecx, 4FD0650Ah
or ecx, edx
xor edi, 01004349h
xor eax, 095ACB78h
and edi, 05C04349h
or edi, eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x43bcd	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x3e34	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x43d18	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x408a9	0x40a00	8a46d6ae9b5b01b1dd90720ae7d64007	False	0.5540906068665378	data	6.7016028228100835	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0x20a7	0x2200	24a8f09a7e46ddc621819240dcf1e29d	False	0.4619715073529412	data	6.51463268349717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x45000	0x1008c	0x5a00	90ce7b6f17ea05d1c477c34c603dec62	False	0.5654079861111111	data	6.6085821044949355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x56000	0x4	0x200	ccfa490aa10bd5cdb00c372c749d720e	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x3e34	0x4000	dff6c95eed4f601e4410770cdd6d5904	False	0.4940185546875	data	6.427756711499859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
SHELL32.dll	SHEmptyRecycleBinW, SHGetFileInfoW, SHGetSpecialFolderPathW
KERNEL32.dll	CopyFileW, ExitProcess, GetCommandLineW, GetCurrentProcessId, GetCurrentThreadId, GetLogicalDrives, GetSystemDirectoryW, GlobalLock, GlobalUnlock
USER32.dll	CloseClipboard, GetClipboardData, GetDC, GetForegroundWindow, GetSystemMetrics, GetWindowLongW, OpenClipboard, ReleaseDC
GDI32.dll	BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, CreateDIBSection, DeleteDC, DeleteObject, GetCurrentObject, GetDIBits, GetObjectW, GetPixel, SelectObject, StretchBlt
ole32.dll	CoCreateInstance, CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, CoUninitialize
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear, VariantInit

Target ID:	0
Start time:	20:22:56
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcb0000
File size:	314'368 bytes
MD5 hash:	2699448F43FE2A97C2CF07BF56FE92F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	71.1%
Total number of Nodes:	225
Total number of Limit Nodes:	15

Executed Functions

Function 00CB89A0 Relevance: 7.7, APIs: 5, Instructions: 242
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00CB89C2
GetCurrentThreadId.KERNEL32 ref: 00CB89D5
GetCurrentProcessId.KERNEL32 ref: 00CB89DD
GetForegroundWindow.USER32 ref: 00CB8BD2
ExitProcess.KERNEL32 ref: 00CB8CB5

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 359d6d40205048e01980a1c311d19e7ebc4771d9b262e89572fc583ab9453551
Instruction ID: d8ca448c5b12c7e9ac2802e1430eadf24a0ab469cd5eb71f6b717fcb718b4834
Opcode Fuzzy Hash: 359d6d40205048e01980a1c311d19e7ebc4771d9b262e89572fc583ab9453551
Instruction Fuzzy Hash: F971F673B547044BC708DFBADC9236AFAD6ABC8710F09D43DA899D7390EA78DC058685

Function 00CEDF70 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00CEBA46,?,00000010,00000005,00000000,?,00000000,?,?,00CC9158,?,?,00CC19B4), ref: 00CEDF9E

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Non-executed Functions

Function 00CE9030 Relevance: 30.4, APIs: 10, Strings: 7, Instructions: 621
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00CF3678,00000000,00000001,00CF3668,00000000), ref: 00CE9137
SysAllocString.OLEAUT32(13C511C2), ref: 00CE91B6
CoSetProxyBlanket.OLE32(0000FDFC,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00CE91FC
SysAllocString.OLEAUT32(13C511C2), ref: 00CE9265
SysAllocString.OLEAUT32(13C511C2), ref: 00CE930E
VariantInit.OLEAUT32(?), ref: 00CE9384

Strings

=3, xrefs: 00CE915D
C, xrefs: 00CE90E6
Lgfe, xrefs: 00CE9212
IK, xrefs: 00CE93A2
\, xrefs: 00CE90F1
E!q#, xrefs: 00CE90D3, 00CE90DD, 00CE96A7
E!q#, xrefs: 00CE9688, 00CE9199, 00CE91B1, 00CE9230

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: =3$C$E!q#$E!q#$Lgfe$\$IK
API String ID: 65563702-4011188741
Opcode ID: efa1b2e2de4769d926661d6ee31c7803253bafd51d6777dee2eeec961efd90ea
Instruction ID: d4df9219ff2152a8f4e7a6664389f42e7b66af2028b942506782f137111c824d
Opcode Fuzzy Hash: efa1b2e2de4769d926661d6ee31c7803253bafd51d6777dee2eeec961efd90ea
Instruction Fuzzy Hash: 9A2241B1508380ABE324CF21CC45B6BBBAAEF85354F148A1CF5959B2D1D774DA05CB92

Function 00CD3D70 Relevance: 24.3, Strings: 19, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g, xrefs: 00CD420D
n, xrefs: 00CD3F8D
!@, xrefs: 00CD3DA3
e, xrefs: 00CD3E04
f, xrefs: 00CD4458
`, xrefs: 00CD3E1C
, xrefs: 00CD4182
e, xrefs: 00CD4450
g, xrefs: 00CD4460
`, xrefs: 00CD4212
:, xrefs: 00CD3F97
;, xrefs: 00CD3F92
9, xrefs: 00CD3F9C
g, xrefs: 00CD3E14
`, xrefs: 00CD4468
e, xrefs: 00CD4203
f, xrefs: 00CD4208
f, xrefs: 00CD3E0C
,, xrefs: 00CD42B7

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: $!@$,$9$:$;$`$`$`$e$e$e$f$f$f$g$g$g$n
API String ID: 0-1524723224
Opcode ID: 6cd92a185c6350022b9980838ff75742bbc4fd67034ab84ac86756baef9f11d6
Instruction ID: 96b48a56f05923a48f37751ce6723988a1f9854c1e009ffc20d6bb34c7eee996
Opcode Fuzzy Hash: 6cd92a185c6350022b9980838ff75742bbc4fd67034ab84ac86756baef9f11d6
Instruction Fuzzy Hash: F3228BB150C3808FD3298F28C4943AFBBE1AB95314F18496EE6D987392D7768985CB53

Function 00CE4470 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 111
clipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenClipboard.USER32 ref: 00CE4480
GetWindowLongW.USER32 ref: 00CE44A5
GetClipboardData.USER32 ref: 00CE44B5
GlobalLock.KERNEL32 ref: 00CE44D4
GlobalUnlock.KERNEL32 ref: 00CE45D2
CloseClipboard.USER32 ref: 00CE45DB

Strings

], xrefs: 00CE4566
G, xrefs: 00CE4543
F, xrefs: 00CE4539
<, xrefs: 00CE454D
c, xrefs: 00CE4525

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: <$F$G$]$c
API String ID: 2832541153-1818401840
Opcode ID: d92e83f781ef11759ab670f41bb1d6bce3e3c8c3a529b9aefc8b32ce75ba0c4f
Instruction ID: 5af543fbd750e9a47a1458bc0c11a15d3380860f3433b7bd6ee5165334b65f00
Opcode Fuzzy Hash: d92e83f781ef11759ab670f41bb1d6bce3e3c8c3a529b9aefc8b32ce75ba0c4f
Instruction Fuzzy Hash: F1418D7140D7C18FD301AF7A948836EBFE0AB92324F044E2DE4D986292C6798649DB93

Function 00CB94D0 Relevance: 17.9, Strings: 14, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BDZF, xrefs: 00CB9628
=86o, xrefs: 00CB9688
u{{h, xrefs: 00CB95F0
_CYG, xrefs: 00CB9638
mmi., xrefs: 00CB9608
ZS, xrefs: 00CB9533
N, xrefs: 00CB96A1
RHL9, xrefs: 00CB958E
txfF, xrefs: 00CB9610
f)2s, xrefs: 00CB9600
8, xrefs: 00CB9838
p8Bb, xrefs: 00CB95E8
n[, xrefs: 00CB9630
SD]z, xrefs: 00CB9640

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: n[$8$=86o$BDZF$N$RHL9$SD]z$ZS$_CYG$f)2s$mmi.$p8Bb$txfF$u{{h
API String ID: 0-1787199350
Opcode ID: 4f528f0c90cc623b71a293a4037b626f3364ba5f16f27244a2274f38ff2d6f74
Instruction ID: 9930601ac79cf38fc9a39c169a24e2847aad8b0b506e6fe804658472bfcb6789
Opcode Fuzzy Hash: 4f528f0c90cc623b71a293a4037b626f3364ba5f16f27244a2274f38ff2d6f74
Instruction Fuzzy Hash: 83B1D37010C3918FD3158F2980607ABBFE1EF97344F1849ACE5E59B392D739890ACB92

Function 00CBCF05 Relevance: 15.6, Strings: 12, Instructions: 574
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<KuM, xrefs: 00CBD58F
gy, xrefs: 00CBD608
c]e, xrefs: 00CBD5FD
S7HI, xrefs: 00CBD584
0C%E, xrefs: 00CBD5A5
y?O1, xrefs: 00CBD32D, 00CBD33F
N3F5, xrefs: 00CBD579
(), xrefs: 00CBD716
;[*], xrefs: 00CBD5BB
7W"i, xrefs: 00CBD5DC
+S7U, xrefs: 00CBD5D1
,_"Q, xrefs: 00CBD5C6

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: ()$+S7U$,_"Q$0C%E$7W"i$;[*]$<KuM$N3F5$S7HI$y?O1$c]e$gy
API String ID: 0-3422605938
Opcode ID: 89a698f223cfcdc77f53b5ad67671f102f0398a35f5e53c2d7e6a46a13a1dc27
Instruction ID: e07bb0ec0c637db7a16ff0690833c7007f090fb01a5b867134712806e16aacb0
Opcode Fuzzy Hash: 89a698f223cfcdc77f53b5ad67671f102f0398a35f5e53c2d7e6a46a13a1dc27
Instruction Fuzzy Hash: 6812FEB15483C18ED3358F25D495BEFBBE1ABD2304F18896CC4DA5B256D7710A0ACB93

Function 00CB98F0 Relevance: 10.4, Strings: 8, Instructions: 428
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{}, xrefs: 00CB9CBD
fhnf, xrefs: 00CB9BE4, 00CB99B7, 00CB99E0
chs,, xrefs: 00CB9B51
su, xrefs: 00CB9CCD
Ohs,, xrefs: 00CB9B2A
xy, xrefs: 00CB9E03
DG, xrefs: 00CB9D35
fhnf, xrefs: 00CB9C10

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: DG$Ohs,$chs,$fhnf$fhnf$xy$su${}
API String ID: 0-2124332573
Opcode ID: 0c5ffe4c961a319cc9e9ebb4cb9618b367a19347897b73002b4014efa07dfa42
Instruction ID: dd76ed3fc54396a69717adfc79b93c17d0ecd5840afc1101526b2569b31b8a3b
Opcode Fuzzy Hash: 0c5ffe4c961a319cc9e9ebb4cb9618b367a19347897b73002b4014efa07dfa42
Instruction Fuzzy Hash: BBE15C72A483504BD328CF35C8513ABBBE6EBD1314F198A2DE5E58B395D738C905CB42

Function 00CCDB30 Relevance: 9.0, Strings: 7, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lw, xrefs: 00CCDBF2
5[Y, xrefs: 00CCDCD6
8, xrefs: 00CCDD13
_], xrefs: 00CCDB47
CN, xrefs: 00CCDBEA
}~, xrefs: 00CCDBFA
SRQ, xrefs: 00CCDB4F

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: 5[Y$8$CN$Lw$}~$SRQ$_]
API String ID: 0-3274379026
Opcode ID: 05133a7a6455b0eb0ed43e64cfdf721678e01155e917667bb399a6cbeb525aeb
Instruction ID: c6a51c7df4f15e116a7ee285fa3132fd58534a91125df90de36bd68c8ea45c44
Opcode Fuzzy Hash: 05133a7a6455b0eb0ed43e64cfdf721678e01155e917667bb399a6cbeb525aeb
Instruction Fuzzy Hash: 845157729183518BD324CF25C8906ABB7F2FFD2345F18995CE8D28B255EB748A06C792

Function 00CBE35B Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 00CBE370

Strings

Zb, xrefs: 00CBE59F
U\, xrefs: 00CBE5AA
r, xrefs: 00CBE385
Lk, xrefs: 00CBE749, 00CBE750

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: Uninitialize
String ID: Lk$U\$Zb$r
API String ID: 3861434553-3997483426
Opcode ID: fabf7ec9695a98ffa76373be1fc9702898f61fae2a8b782e18b86a5689aefb1a
Instruction ID: ff3c3d0bffcd380fbd912a4586a1a18b975d9ddfc04cf72f4a36a1113c7a6dfa
Opcode Fuzzy Hash: fabf7ec9695a98ffa76373be1fc9702898f61fae2a8b782e18b86a5689aefb1a
Instruction Fuzzy Hash: 30A19CB010C3D18AD7758F25C4947EFBBE1AB93304F18895CD0EA5B296DB39460ACB57

Function 00CB9210 Relevance: 6.5, Strings: 5, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7514, xrefs: 00CB92DC
57, xrefs: 00CB9229
84*6, xrefs: 00CB92FC
N, xrefs: 00CB9230
)=+4, xrefs: 00CB92E4

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: )=+4$57$7514$84*6$N
API String ID: 0-4020838272
Opcode ID: be85e90a30f89c364b58cec467ad0dcda84538ec37489d1a8be0575a1ed0ed84
Instruction ID: 25186fff323860ee4dab73599446bb6772957c55a41d11864ed725e7d70a7927
Opcode Fuzzy Hash: be85e90a30f89c364b58cec467ad0dcda84538ec37489d1a8be0575a1ed0ed84
Instruction Fuzzy Hash: 2071A46110C3C58BD315CB2984A07BBFFE1DFA3305F18499DE5E64B282D7798A0ACB52

Function 00CD0870 Relevance: 5.9, Strings: 4, Instructions: 861
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=79, xrefs: 00CD0C2E
+2/?, xrefs: 00CD0C19
BBSH, xrefs: 00CD0C90
GZE^, xrefs: 00CD0C7C

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: +2/?$=79$BBSH$GZE^
API String ID: 0-3392023846
Opcode ID: 59c65316c1ab6c104c55dcceab9da6800eb461a5c4ca2fbdad97a96dc421bb1b
Instruction ID: 0a98901e55cde6f8c1c2a66b3dbd8d8f3241ab039692ee2b954cace6beabaddc
Opcode Fuzzy Hash: 59c65316c1ab6c104c55dcceab9da6800eb461a5c4ca2fbdad97a96dc421bb1b
Instruction Fuzzy Hash: D9521170504B418FC735CF39C890766BBE2BF56314F288A6EC5E68BB92C735A906CB51

Function 00CBB210 Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

_o]a, xrefs: 00CBB482
=>?, xrefs: 00CBB69F
H{D}, xrefs: 00CBB4A0
TgXy, xrefs: 00CBB496

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: H{D}$TgXy$_o]a$=>?
API String ID: 0-2004217480
Opcode ID: 653f9358cdb5e19fb2f681079eaffefe53ebfc3c7e6f4bf44c35b551e2896d6c
Instruction ID: a969868adb468cee216ba880bb2b00d0aa0fad9b9ccf52e93a8ee746e5bcf791
Opcode Fuzzy Hash: 653f9358cdb5e19fb2f681079eaffefe53ebfc3c7e6f4bf44c35b551e2896d6c
Instruction Fuzzy Hash: 061269B1110B01CFD3248F26D8957ABBBF5FB49314F148A1DD6AB8BAA0CB74A405CF41

Function 00CD7E20 Relevance: 5.5, Strings: 4, Instructions: 461COMMON

Download Yara Rule

Strings

=:;8, xrefs: 00CD8194
kp, xrefs: 00CD7F67
a{, xrefs: 00CD7F51
=:;8, xrefs: 00CD83E6

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: =:;8$=:;8$a{$kp
API String ID: 0-2717198472
Opcode ID: 931cd233ab3ef1e846eaccef72d0eb9caf2254515e00c62c75d63f08c24d09d1
Instruction ID: 785929ac6d9885f30e94ea89ad7db5d78eb3ecab0dc6becaf72d22d1dae7b4cc
Opcode Fuzzy Hash: 931cd233ab3ef1e846eaccef72d0eb9caf2254515e00c62c75d63f08c24d09d1
Instruction Fuzzy Hash: 5BE1BBB5518341DFE320DF64D88176FBBE1FB85304F14892DE6998B2A1EB749909CB83

Function 00CBAD00 Relevance: 5.4, Strings: 4, Instructions: 424COMMON

Download Yara Rule

Strings

IK, xrefs: 00CBADA1
lPLN, xrefs: 00CBAD12
@A, xrefs: 00CBAEE0
svfZ, xrefs: 00CBAD62

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: @A$lPLN$svfZ$IK
API String ID: 0-1806543684
Opcode ID: e7323e18667e14f450812d9dc03c321f5c824c035142b4597a94feb2b1aba82b
Instruction ID: d3d418bcb54d8a6290501a980fb89e69e2f7c86243bdea80a9ca3524ba4d9a9e
Opcode Fuzzy Hash: e7323e18667e14f450812d9dc03c321f5c824c035142b4597a94feb2b1aba82b
Instruction Fuzzy Hash: E2C1297164C3849FD324CE6994A13AFBBE2EBD2700F18C92CE4E54B345D7B58D099B82

Function 00CB4040 Relevance: 4.2, Strings: 3, Instructions: 428COMMON

Download Yara Rule

Strings

), xrefs: 00CB40C6
IEND, xrefs: 00CB44AC
), xrefs: 00CB40BC

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 627258113f7bfeefa5d1505cbc8a6a4d56565198cc96d4da4431c30baae4d66e
Instruction ID: 3776a22b8f574be6d2a5193b4224981002df2c630aba9b308d1b6da162dbd6a7
Opcode Fuzzy Hash: 627258113f7bfeefa5d1505cbc8a6a4d56565198cc96d4da4431c30baae4d66e
Instruction Fuzzy Hash: 9DF1E0B1A087019BE318DF28D8517AABBE4FF94304F04462DF9A5973D2D774E914CB82

Function 00CD5E90 Relevance: 4.0, Strings: 3, Instructions: 295COMMON

Download Yara Rule

Strings

KP, xrefs: 00CD5EEA
VD, xrefs: 00CD5EE3
@J, xrefs: 00CD5EF1

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: @J$KP$VD
API String ID: 0-3841663987
Opcode ID: c09578a5eb5d3cc33107a5620079a360f5145b4d94150843df15156dd8318093
Instruction ID: 3449f2ec092fc366f644d12e05b9243779bab61b55e056e455a363169a5ef357
Opcode Fuzzy Hash: c09578a5eb5d3cc33107a5620079a360f5145b4d94150843df15156dd8318093
Instruction Fuzzy Hash: A5915276704B01AFE720CF68CC81BABBBB1FB81310F14462DE5959B781D374A816DB92

Function 00CBC02B Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

A_, xrefs: 00CBC181
IG, xrefs: 00CBC171
PQ, xrefs: 00CBC1A1

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: PQ$A_$IG
API String ID: 0-2179527320
Opcode ID: b80cc1f78a97b1631bf9de0c87da50606f75708d77a10a718b19d73415ad3b45
Instruction ID: d09b83468f925b800d125f8c6707caaa17e1440417c1df9a89b9f50bf6aea7df
Opcode Fuzzy Hash: b80cc1f78a97b1631bf9de0c87da50606f75708d77a10a718b19d73415ad3b45
Instruction Fuzzy Hash: 02419AB400C341CAC7048F25D8927ABB7F0FF96758F249A0DE0D59B695E7348A46CB4A

Function 00CEF8D0 Relevance: 3.3, Strings: 2, Instructions: 813COMMON

Download Yara Rule

Strings

jC, xrefs: 00CEFAB7
cC, xrefs: 00CEFA5E

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: cC$jC
API String ID: 0-2055910567
Opcode ID: b49886c8b1d892723b167275282a2b28a969046d126e7ea5db6d5aaa1291a160
Instruction ID: d4eb60d6b9e5fd3e81888fed2200773c2cd7078e1732c85498cd6d136a0c4570
Opcode Fuzzy Hash: b49886c8b1d892723b167275282a2b28a969046d126e7ea5db6d5aaa1291a160
Instruction Fuzzy Hash: 5D42F372A04255CFCB08CF69D8917BEB7F2FB89310F1A857DC95AA7391C674A902CB41

Function 00CEC040 Relevance: 3.1, Strings: 2, Instructions: 624COMMON

Download Yara Rule

Strings

, xrefs: 00CEC167, 00CEC17A
f, xrefs: 00CEC271

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: f$
API String ID: 2994545307-508322865
Opcode ID: b857407b6ebc5f20df7d136dbbd1377769aea2dd0698989dbe84b79f35764e0c
Instruction ID: 74d27acc0a6bd09c50208e8d1639ee349bb915072354a24c539b68712dee58ff
Opcode Fuzzy Hash: b857407b6ebc5f20df7d136dbbd1377769aea2dd0698989dbe84b79f35764e0c
Instruction Fuzzy Hash: 9812E4716083819FD715CF2AC8D0B6FBBE6ABC5314F148A2CE5A5872A2D731DD42CB52

Function 00CE24E0 Relevance: 2.8, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00CE25D2
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00CE2591

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-2492670020
Opcode ID: 4094852eabda9ccd56a1ce8ad1bfa6096ae3faf578684f0cf2534abb839659f4
Instruction ID: ba31b312d80c06f5dc1986e0331819f9eb158f111dff40a257a44b6ee5887a5b
Opcode Fuzzy Hash: 4094852eabda9ccd56a1ce8ad1bfa6096ae3faf578684f0cf2534abb839659f4
Instruction Fuzzy Hash: 0F815B33A096D18BCB188E3E8C513BD7BAA5F97330B2D83A9E8B19B3D5C5248D058351

Function 00CB5AC9 Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

8, xrefs: 00CB55BC
0, xrefs: 00CB55C4

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 4525f227ffaad21c2521d2fe3220cce1c6465349f824312f9ecb5e5cf1eb2e4c
Instruction ID: 0e9d9816f5b88bed3044d31b03526bb332687604fa5de8a25a8ca829fd01d912
Opcode Fuzzy Hash: 4525f227ffaad21c2521d2fe3220cce1c6465349f824312f9ecb5e5cf1eb2e4c
Instruction Fuzzy Hash: DCA10175608780DFD320CF28D840B9EBBE1AB99304F18895CEAD8973A2C775D959CF52

Function 00CB542C Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

8, xrefs: 00CB55BC
0, xrefs: 00CB55C4

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 41fbaa10439091d67b3e1e160a129ae13d7834c64b47ce85765cf4a49f7479b8
Instruction ID: b8eef45e853e6aa8a0425be8042385b501a04b18b3019b1f47bc3922c0e1ce70
Opcode Fuzzy Hash: 41fbaa10439091d67b3e1e160a129ae13d7834c64b47ce85765cf4a49f7479b8
Instruction Fuzzy Hash: C6A11175608780DFD320CF28D84079EBBE1AB99304F18895CEAD897362C775E959CF52

Function 00CBE970 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

efg`, xrefs: 00CBE990
efg`, xrefs: 00CBE8E0

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: efg`$efg`
API String ID: 0-3010568471
Opcode ID: 8038c7e583396ea82603e11b1419c763961c4defa0476602c3805ffd7566efde
Instruction ID: 4c109d6565a0ae521ee5e2c05c2ec7470de8b55ee7cc0eff437b5cae360178a9
Opcode Fuzzy Hash: 8038c7e583396ea82603e11b1419c763961c4defa0476602c3805ffd7566efde
Instruction Fuzzy Hash: 5C31A132A083608BD328DFA1D5917EFB792ABE4700F5A442CD98667255CE309E0AC7D7

Function 00CD8CB0 Relevance: 1.7, Strings: 1, Instructions: 490COMMON

Download Yara Rule

Strings

st@, xrefs: 00CD91A4, 00CD91E4, 00CD9206, 00CD920A

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: st@
API String ID: 0-3741395493
Opcode ID: c02ab4afe7054808bb4cf317c17957bfadbaf3929f8afebf5470bb2c0a3c9879
Instruction ID: da1e685b1c02b7fe7f99590c9f61ed0fe2beee5cb7c4d8c22aeedef6ab503977
Opcode Fuzzy Hash: c02ab4afe7054808bb4cf317c17957bfadbaf3929f8afebf5470bb2c0a3c9879
Instruction Fuzzy Hash: 16F124B550C3818FD3049F28D89136BBBE2EF96304F18886EE5D587382D775D90ACB92

Function 00CD8770 Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

=:;8, xrefs: 00CD87FC

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: =:;8
API String ID: 2994545307-508151936
Opcode ID: 61eb13e94b3d3b4a6754df62a8976efb05071a90b1637a278b080685f2faf161
Instruction ID: edd0bcc181c1924c9d3af78ab3721da0133b665628466e99efbe691be75f2e07
Opcode Fuzzy Hash: 61eb13e94b3d3b4a6754df62a8976efb05071a90b1637a278b080685f2faf161
Instruction Fuzzy Hash: 80D19C72A583118BD714CA28CC9237BB792EBC4304F19857FDAC64B381DE749D0AD392

Function 00CC9530 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

efg`, xrefs: 00CC98E5

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: efg`
API String ID: 0-115929991
Opcode ID: 72bdcb27bcec3a419b61f51fe7261b8967396e7ac22ff2a2b57d0d210158cb13
Instruction ID: 1b5b8313edcab02e3cb2d7ac5e3ce013d4b127284e4e2785432417da8ae62d3b
Opcode Fuzzy Hash: 72bdcb27bcec3a419b61f51fe7261b8967396e7ac22ff2a2b57d0d210158cb13
Instruction Fuzzy Hash: 14C124B1900215CBCB24DF68DC92BBF77B4FF46310F18456CE956A7291E734AA01CBA2

Function 00CF0F60 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00CF0FBA

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: 833b65e8d2d117163f71f02d3947b8ee437e491333b4fdba3c483aa6736660a8
Instruction ID: f5cba2f404dc3cafacd05596023f924d07ce735222cd201791e25f5a6d64206e
Opcode Fuzzy Hash: 833b65e8d2d117163f71f02d3947b8ee437e491333b4fdba3c483aa6736660a8
Instruction Fuzzy Hash: 4181BC35208346CBC718DF58D490A3EB3E2EF99710F19852CEA929B365DB31ED51CB82

Function 00CB61A0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00CB62D6

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 8b04fab32ec0b8383da590e4bd15150657e1dcf751765b097a457d664c512576
Instruction ID: 4c18135e682ef025b399783ada42f1cadfd3085314dc5be78a37250c31591755
Opcode Fuzzy Hash: 8b04fab32ec0b8383da590e4bd15150657e1dcf751765b097a457d664c512576
Instruction Fuzzy Hash: D3B147712083819FD325CF58C89065BFBE0AFA9704F444E2DE5D997382D635EA18CBA7

Function 00CEBCE0 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5|iL, xrefs: 00CEBED0

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: c97e2e8c9bdc1f7a7d4ebfa3b0a9f2d3eab909246b2ee8ab9cdc675040d937e7
Instruction ID: 3277488e6ae4e66f17fd99cae04b3918fbce281da93eba71da9e6eeadb184e1e
Opcode Fuzzy Hash: c97e2e8c9bdc1f7a7d4ebfa3b0a9f2d3eab909246b2ee8ab9cdc675040d937e7
Instruction Fuzzy Hash: 93711636A043518BC7148F6A8C806BBB7A6EBC5320F19866CE9A59B265C771DD02CBC1

Function 00CBE0D8 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

efg`, xrefs: 00CBE100

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: efg`
API String ID: 2994545307-115929991
Opcode ID: d3a4721029b40ca6fe9b74fbe5be38620c2db53202ff4d739480bf91aad2758d
Instruction ID: ef5bbc16ee604f57ef75c2a71f2875c13b1a1e98456f836eeedcb444f5a0d252
Opcode Fuzzy Hash: d3a4721029b40ca6fe9b74fbe5be38620c2db53202ff4d739480bf91aad2758d
Instruction Fuzzy Hash: 4D5119B6A043905BD720EB649C827EF7397AFD1704F194428E94A67343DF306A06D797

Function 00CBEA38 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

D, xrefs: 00CBEC76

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 2377fa130e94e8406ddb6d9c95d9b122c75f22cc0cd5442caf6715b763960e1e
Instruction ID: 0ba455245f158f22ab1b84e0402f15a79e41a6230c46c5d197f4a87adb87f36a
Opcode Fuzzy Hash: 2377fa130e94e8406ddb6d9c95d9b122c75f22cc0cd5442caf6715b763960e1e
Instruction Fuzzy Hash: 3A510FB05493808BE7208F16C86179BBBF1FF91B44F20980CE6E91B294D7B59949CF87

Function 00CB77D0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e56e85d3793a0f4e761ff8f8362607d8bf849bd197acd1c0af18c6b7dbfe6d
Instruction ID: 5eb8dff597e1e5cb6647032eb1fac0fde866ec294a2dbff232cbf59453029991
Opcode Fuzzy Hash: a9e56e85d3793a0f4e761ff8f8362607d8bf849bd197acd1c0af18c6b7dbfe6d
Instruction Fuzzy Hash: 0842B03160C3118BC725DF28E8806ABB3E2FFD4314F298A2DDD9697285E735E955CB42

Function 00CB6CC0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87077ba6d2d0475c05e70b774cf8b206c6ca067cc980fc4b81c01845bafe9802
Instruction ID: 23f279343b18339d14b2c67e869463af5263db90360a805539ddf2b0537ce515
Opcode Fuzzy Hash: 87077ba6d2d0475c05e70b774cf8b206c6ca067cc980fc4b81c01845bafe9802
Instruction Fuzzy Hash: 4D52B87090CB848FEB35CB24C4947E7BBE1EB91314F144A2ED9EB46B82C279E985C751

Function 00CB4AC0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2215c5b6e610e46ebdf7cc3882cb364c95c12844832332ae156e5012956aae
Instruction ID: 64cb7c333c8f413b1f45fe35f173b6c1c78b49d2e68719d339698b3809b513d7
Opcode Fuzzy Hash: be2215c5b6e610e46ebdf7cc3882cb364c95c12844832332ae156e5012956aae
Instruction Fuzzy Hash: CC426775608701DFD708CF28D8547AEBBE1BF88355F15892CEA898B2A1D375DA84CF42

Function 00CB2B80 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c713861763f7de1c9171861cbf41b7712ac8369d1b7e10534bb9cf98851507a2
Instruction ID: dee1f4a5e5d5ca2637d3cf0172717d005ea801c24cbfd743d3ba47986aeb509a
Opcode Fuzzy Hash: c713861763f7de1c9171861cbf41b7712ac8369d1b7e10534bb9cf98851507a2
Instruction Fuzzy Hash: 2752C3315083858FCB15CF29C4906EEBBE1BF88314F198A6DE8A95B351D774EA49CB81

Function 00CB3580 Relevance: .6, Instructions: 631COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0253092a049d0bd227e7d9d0d8bca94e80a516cc93ecf0b48d42c878ec5af8bd
Instruction ID: a364a76183d9120b004c78286dc434f3572194423e35a84defd59b6b9e466e07
Opcode Fuzzy Hash: 0253092a049d0bd227e7d9d0d8bca94e80a516cc93ecf0b48d42c878ec5af8bd
Instruction Fuzzy Hash: F8425771914B508FC328CF29C5905AABBF2BF85710B644A2ED6A787F90D736FA45CB10

Function 00CB5C90 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc2aaee6a2bf8c89908747eb49029a1ddb5242c082c8c6e80028db4d1ac29b3
Instruction ID: 3177272591a924db158f83512cf867cef639eb08737f9e7f6de18743b41e0068
Opcode Fuzzy Hash: 2bc2aaee6a2bf8c89908747eb49029a1ddb5242c082c8c6e80028db4d1ac29b3
Instruction Fuzzy Hash: F9F17A712087418FC728DF29C881AABFBE6EF94300F44492DE4D687791E635E949CB96

Function 00CB6840 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e445ca3b438742181d2dbf2e8c100afcf3d334dfe90873b41fa4f189d33e65
Instruction ID: 49667035f1709fc8d39ef1dfbb690791de051d284de711237b7f5e4283d99d3c
Opcode Fuzzy Hash: 86e445ca3b438742181d2dbf2e8c100afcf3d334dfe90873b41fa4f189d33e65
Instruction Fuzzy Hash: 8FC17CB2A083418FC364CF68C89679BB7E1BF85318F08492DD5EAC7341E778A545CB45

Function 00CE87B0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c1cd1c24942864f61038c670a18ec149961f2724bb5df823d71df188c2c547
Instruction ID: ebf30c988b3e2b247222ed6e12af507e8f80d329c04a78c019344d7d2ebf6152
Opcode Fuzzy Hash: c2c1cd1c24942864f61038c670a18ec149961f2724bb5df823d71df188c2c547
Instruction Fuzzy Hash: ECB13A72D087D18FDB11CA7DC8843597FA26B97220F1DC3D5D9A5AB3DAC635480AC3A2

Function 00CF1580 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6ed118e5a77dce122bb0b0c7ac0ddef196341c4a99a603aa323fa3b7a247f5dc
Instruction ID: 8b7f0a1cda1490d61b5ccd496da41c88fa452a3c0bab83e71221bd41a76c8435
Opcode Fuzzy Hash: 6ed118e5a77dce122bb0b0c7ac0ddef196341c4a99a603aa323fa3b7a247f5dc
Instruction Fuzzy Hash: 9781E072618349CFD718DE68D850B3BB7E2EB88310F09883CEA96D7291E675DD45C782

Function 00CEC780 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc4211ff3559cfbc8cdfa33303a04b21ffa8fe43044cf814f80c683d3ac2f88
Instruction ID: 2eef70ba31898f0899d2c8fa979512ac5412d5c5fb0dae687e0d4a1908c3b51a
Opcode Fuzzy Hash: 0bc4211ff3559cfbc8cdfa33303a04b21ffa8fe43044cf814f80c683d3ac2f88
Instruction Fuzzy Hash: 98A1F07160C3958FC325CF2AC4D062ABBE1AFD6314F19867DE8E58B392D6349C42DB52

Function 00CCFB60 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c47d16c7d378559025f40638a6f90930b769156416e9ac1c7d8ec9a6c8f2c7e
Instruction ID: f425126bd6685271ec8fdad82457900c9734b501c08ed3f3ead7bdef097f19b4
Opcode Fuzzy Hash: 6c47d16c7d378559025f40638a6f90930b769156416e9ac1c7d8ec9a6c8f2c7e
Instruction Fuzzy Hash: 01912B32A042614FC726CE28C85076ABAD2AB95324F19C27DE8B99B392D775CD47D3C1

Function 00CF0C80 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f5e665ec8d5ce7dda5a91868b30095f468c4e2b76004e2535c6fe046e0c8f254
Instruction ID: 1165e555de8436d1b7e0969250ea6e33cb3997267fa9176093ca777d5eb721f9
Opcode Fuzzy Hash: f5e665ec8d5ce7dda5a91868b30095f468c4e2b76004e2535c6fe046e0c8f254
Instruction Fuzzy Hash: 5A7115356083499BC7249B58D85073FB7E2FFD4B10F25892CE6968B266DB309D51C743

Function 00CE41D0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70b9f60f90b1f353b0c60180b0437cc54205e933d2b634fe6853cf2c2805366
Instruction ID: a40448d29dbd3b5ffc954c9a871374d74859500768ef20a7c7906c2e0dd65415
Opcode Fuzzy Hash: f70b9f60f90b1f353b0c60180b0437cc54205e933d2b634fe6853cf2c2805366
Instruction Fuzzy Hash: A9714773B599E1478B1C897E4C123B9AA874BD633072EC37AED75DB3E1CA298D014281

Function 00CEB8E0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f19232df1342be0dbef954f29c4e00f149811527a0a6544f44d7c307de10a56b
Instruction ID: 6c9d839481f7a6d168eaca669ede625b8aa47f2afecc88fe36e1f72d8e0feaa6
Opcode Fuzzy Hash: f19232df1342be0dbef954f29c4e00f149811527a0a6544f44d7c307de10a56b
Instruction Fuzzy Hash: 56515972A083918BD7209F2A984073BF7A2EBD5720F29C63CD9E527355D7319C02C781

Function 00CD0650 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed8f67092e89eb2cb90eb16dd4f5cbf88de72be6dd4522690a4b1a00d021746
Instruction ID: a77ac1c143fef09c7050ced5da3342e92a427c03515d07b0b85af4af820197f8
Opcode Fuzzy Hash: 7ed8f67092e89eb2cb90eb16dd4f5cbf88de72be6dd4522690a4b1a00d021746
Instruction Fuzzy Hash: 8E511537A1AAD04BC724897D4C513B96A531BE6330F3F436BDEB48B3E1C9668D069391

Function 00CD1790 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d71a2ab21a209fe4fa0d21d3c69897773f54ae1daf79b92753de11f8130901c
Instruction ID: 87f0583f4e560cdfa1184ddd6d47c286d4f5113a099fc46673fb098a136ed6a2
Opcode Fuzzy Hash: 7d71a2ab21a209fe4fa0d21d3c69897773f54ae1daf79b92753de11f8130901c
Instruction Fuzzy Hash: 77411A31A19344AFD3549FA8AC82B6F77E8EB86314F04443DFA45C3291D634D805C753

Function 00CB27D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b68c0be7b154fe79e2177f25ab66589bfcfdeaf826efb6b91ee2637d79c3b9f
Instruction ID: 92b459b4b15a51806aa3f0e86bbf6d3a1d2e4e3a741fb81b88388efdf5fc950d
Opcode Fuzzy Hash: 3b68c0be7b154fe79e2177f25ab66589bfcfdeaf826efb6b91ee2637d79c3b9f
Instruction Fuzzy Hash: A511E737B2666147E750CE7ADCD47ABA352EFC9310B1A0134EE51D7282CA23E901D151

Function 00CBBC9D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f209bcb63f892bf3070a128ed04b5786f363b78e6d2eedd94f4afc9b9da2a18
Instruction ID: c290ffc82c2d118ee43dd6c3a1684d12175f29adf5e04924efc261210c99ffff
Opcode Fuzzy Hash: 7f209bcb63f892bf3070a128ed04b5786f363b78e6d2eedd94f4afc9b9da2a18
Instruction Fuzzy Hash: B3F0A7716183815BD7188B24D89577FBBB1EB87614F10551CE3C2D3292DB61DC06CB0A

Function 00CEB860 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2477820186.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2477758961.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2477935690.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478001411.0000000000CF5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2478065929.0000000000D07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03dd6b0bb1a37c61295684181ce547ed2896c248a43bfb0371c0d6901a280340
Instruction ID: f6adda30584dcaa771a544a9904754bed5cca7a00dec7d234f603032f8937696
Opcode Fuzzy Hash: 03dd6b0bb1a37c61295684181ce547ed2896c248a43bfb0371c0d6901a280340
Instruction Fuzzy Hash: FDB09250A042087F04249D0A8C45F7BB6BED2CB694F106008A408A32548660EC0486FA

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: file.exePID: 4252, Parent PID: 4056

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 4252, Parent PID: 4056COMMON

Execution Graph

Graph

Executed Functions

Function 00CB89A0 Relevance: 7.7, APIs: 5, Instructions: 242threadCOMMON

Control-flow Graph

Function 00CEDF70 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Control-flow Graph

Non-executed Functions

Function 00CE9030 Relevance: 30.4, APIs: 10, Strings: 7, Instructions: 621memorycomCOMMON

Control-flow Graph

Windows Analysis Report
file.exe

Function 00CB89A0 Relevance: 7.7, APIs: 5, Instructions: 242
threadCOMMON

Function 00CEDF70 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00CE9030 Relevance: 30.4, APIs: 10, Strings: 7, Instructions: 621
memorycomCOMMON

Function 00CD3D70 Relevance: 24.3, Strings: 19, Instructions: 515
COMMON

Function 00CE4470 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 111
clipboardCOMMON

Function 00CB94D0 Relevance: 17.9, Strings: 14, Instructions: 385
COMMON

Function 00CBCF05 Relevance: 15.6, Strings: 12, Instructions: 574
COMMON

Function 00CB98F0 Relevance: 10.4, Strings: 8, Instructions: 428
COMMON

Function 00CCDB30 Relevance: 9.0, Strings: 7, Instructions: 235
COMMON

Function 00CBE35B Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294
COMMON

Function 00CB9210 Relevance: 6.5, Strings: 5, Instructions: 269
COMMON

Function 00CD0870 Relevance: 5.9, Strings: 4, Instructions: 861
COMMON