Edit tour

Windows Analysis Report
HkppfZO2WW.exe

Overview

General Information

Sample name:	HkppfZO2WW.exe renamed because original name is a hash value
Original sample name:	c23e31e962885184e343d7f402561853515a44256a20e78f74e5e597090b4f41.exe
Analysis ID:	1562123
MD5:	e8c247a498e6c947ac8fe25cb0374140
SHA1:	2d40b90c9f9920e7890acbbadbc9fea85ce508c6
SHA256:	c23e31e962885184e343d7f402561853515a44256a20e78f74e5e597090b4f41
Tags:	exeTRADETRUSTLLCuser-JAMESWT_MHT
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

PE / OLE file has an invalid certificate

Potential time zone aware malware

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

HkppfZO2WW.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\HkppfZO2WW.exe" -install MD5: E8C247A498E6C947AC8FE25CB0374140)

javaw.exe (PID: 7292 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" -install MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

HkppfZO2WW.exe (PID: 7588 cmdline: "C:\Users\user\Desktop\HkppfZO2WW.exe" /install MD5: E8C247A498E6C947AC8FE25CB0374140)

javaw.exe (PID: 7600 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /install MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

HkppfZO2WW.exe (PID: 7648 cmdline: "C:\Users\user\Desktop\HkppfZO2WW.exe" /load MD5: E8C247A498E6C947AC8FE25CB0374140)

javaw.exe (PID: 7664 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /load MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: HkppfZO2WW.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: HkppfZO2WW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH

Source: javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-codeSigning-ECC-384-R2.cer0
Source: javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-codeSigning-ECC-384-R2.crl0
Source: javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl0
Source: javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	String found in binary or memory: http://ocsps.ssl.com0P
Source: javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt0
Source: javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 0_2_004030C0	0_2_004030C0
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 0_2_004013B0	0_2_004013B0
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 0_2_004013E9	0_2_004013E9
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 4_2_004030C0	4_2_004030C0
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 4_2_004013B0	4_2_004013B0
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 4_2_004013E9	4_2_004013E9
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 6_2_004030C0	6_2_004030C0
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 6_2_004013B0	6_2_004013B0
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 6_2_004013E9	6_2_004013E9

Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: String function: 00404DF0 appears 36 times
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: String function: 00404D40 appears 45 times

Source: HkppfZO2WW.exe

Static PE information: invalid certificate

Source: HkppfZO2WW.exe, 00000000.00000000.2163550546.0000000000410000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEXP Soundboard_05.exe> vs HkppfZO2WW.exe
Source: HkppfZO2WW.exe, 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEXP Soundboard_05.exe> vs HkppfZO2WW.exe
Source: HkppfZO2WW.exe, 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEXP Soundboard_05.exe> vs HkppfZO2WW.exe
Source: HkppfZO2WW.exe, 00000004.00000000.2188658719.0000000000410000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEXP Soundboard_05.exe> vs HkppfZO2WW.exe
Source: HkppfZO2WW.exe, 00000006.00000000.2210752213.0000000000410000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEXP Soundboard_05.exe> vs HkppfZO2WW.exe
Source: HkppfZO2WW.exe, 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEXP Soundboard_05.exe> vs HkppfZO2WW.exe
Source: HkppfZO2WW.exe	Binary or memory string: OriginalFilenameEXP Soundboard_05.exe> vs HkppfZO2WW.exe

Source: HkppfZO2WW.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: clean4.winEXE@9/0@0/0

Source: C:\Users\user\Desktop\HkppfZO2WW.exe

Code function: 0_2_00401BF0 GetLastError,MessageBoxA,ShellExecuteA,printf,fclose,FormatMessageA,strcat,printf,LocalFree,fprintf,fprintf,MessageBoxA,

0_2_00401BF0

Source: C:\Users\user\Desktop\HkppfZO2WW.exe

Code function: 0_2_00401E10 FindResourceExA,LoadResource,LockResource,SetLastError,

0_2_00401E10

Source: HkppfZO2WW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HkppfZO2WW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HkppfZO2WW.exe	String found in binary or memory: exp/soundboard/loader.mp3
Source: HkppfZO2WW.exe	String found in binary or memory: exp/soundboard/loader.mp3PK

Source: unknown	Process created: C:\Users\user\Desktop\HkppfZO2WW.exe "C:\Users\user\Desktop\HkppfZO2WW.exe" -install
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" -install
Source: unknown	Process created: C:\Users\user\Desktop\HkppfZO2WW.exe "C:\Users\user\Desktop\HkppfZO2WW.exe" /install
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /install
Source: unknown	Process created: C:\Users\user\Desktop\HkppfZO2WW.exe "C:\Users\user\Desktop\HkppfZO2WW.exe" /load
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /load
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" -install	Jump to behavior
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /install	Jump to behavior
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /load	Jump to behavior

Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\HkppfZO2WW.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Automated click: OK
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Automated click: OK
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Automated click: OK

Source: HkppfZO2WW.exe

Static file information: File size 9142400 > 1048576

Source: HkppfZO2WW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH

Source: C:\Users\user\Desktop\HkppfZO2WW.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 0_2_00401150 SetUnhandledExceptionFilter,__getmainargs,_iob,_iob,_setmode,_iob,_iob,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,	0_2_00401150
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 4_2_00401150 SetUnhandledExceptionFilter,__getmainargs,_iob,_iob,_setmode,_iob,_iob,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,	4_2_00401150
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Code function: 6_2_00401150 SetUnhandledExceptionFilter,__getmainargs,_iob,_iob,_setmode,_iob,_iob,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,	6_2_00401150

Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" -install	Jump to behavior
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /install	Jump to behavior
Source: C:\Users\user\Desktop\HkppfZO2WW.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /load	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HkppfZO2WW.exe	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ocsps.ssl.com0P	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://cert.ssl.com/SSLcom-SubCA-EV-codeSigning-ECC-384-R2.cer0	javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	false		high
http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt0	javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	false		high
http://ocsps.ssl.com0	javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	false		high
http://crls.ssl.com/ssl.com-EVecc-RootCA.crl0	javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	false		high
http://crls.ssl.com/SSLcom-SubCA-EV-codeSigning-ECC-384-R2.crl0	javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	false		high
https://www.ssl.com/repository0	javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	false		high
http://ocsps.ssl.com0P	javaw.exe, 00000005.00000003.2191270030.0000000001145000.00000004.00000020.00020000.00000000.sdmp, HkppfZO2WW.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562123
Start date and time:	2024-11-25 08:35:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Cmdline fuzzy
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HkppfZO2WW.exe renamed because original name is a hash value
Original Sample Name:	c23e31e962885184e343d7f402561853515a44256a20e78f74e5e597090b4f41.exe
Detection:	CLEAN
Classification:	clean4.winEXE@9/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 45 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
VT rate limit hit for: HkppfZO2WW.exe

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.969453019984369
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HkppfZO2WW.exe
File size:	9'142'400 bytes
MD5:	e8c247a498e6c947ac8fe25cb0374140
SHA1:	2d40b90c9f9920e7890acbbadbc9fea85ce508c6
SHA256:	c23e31e962885184e343d7f402561853515a44256a20e78f74e5e597090b4f41
SHA512:	999204796dcb777a16e321d8dc41406415713242c53000571772894090fb72cb1c954e9e001626f4eb2b634ac1bc3bf62acc8db95afaf9b7ef5f77325b7dac19
SSDEEP:	196608:s8+UuEJJls3EMUhdkzkgUvnzVr92NQ6C5HUHGGp+9:v+h3EJPkbUvZr92GGGGM
TLSH:	1D963382B691CE02D4195630D8F2C6F3A238FC4AFD508197AB5C3E073C78665B6B99F1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?\|T.................@...................P....@..................................D....@... ............................

File Icon


Icon Hash:	0c4f9c9c05110f0c

Static PE Info

General

Entrypoint:	0x401290
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH
Time Stamp:	0x547C3F9E [Mon Dec 1 10:14:54 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5c015bd7e84af79e092e9447b444a0b6

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA ECC R2, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	18/11/2024 04:47:36 18/11/2025 04:47:36
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=UA, OID.2.5.4.15=Private Organization, CN=TRADE TRUST LLC, SERIALNUMBER=37058412, O=TRADE TRUST LLC, L=Dnipro, C=UA
Version:	3
Thumbprint MD5:	534B9DBCF3BB2DFA2DAD06DA0709841E
Thumbprint SHA-1:	FEA61825376A364886B5236EFCB3EDD1B23E9441
Thumbprint SHA-256:	BD193172C9C4775190F1C906FF5B47D9FB1A342DB35AC211A1A4AC8A9B07B914
Serial:	4C46DCF5B0C4357F05806830DBA932FD

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 08h
mov dword ptr [esp], 00000002h
call dword ptr [0041028Ch]
call 00007F19351C7D7Dh
nop
lea esi, dword ptr [esi+00000000h]
push ebp
mov ecx, dword ptr [004102C4h]
mov ebp, esp
pop ebp
jmp ecx
lea esi, dword ptr [esi+00h]
push ebp
mov ecx, dword ptr [004102B0h]
mov ebp, esp
pop ebp
jmp ecx
nop
nop
nop
nop
push ebp
mov edx, 00000080h
mov ebp, esp
push edi
xor eax, eax
lea edi, dword ptr [ebp-00000118h]
push esi
push ebx
sub esp, 0000011Ch
mov dword ptr [esp+08h], edx
mov dword ptr [esp+04h], eax
mov dword ptr [esp], edi
call 00007F19351CB914h
mov dword ptr [esp+04h], edi
mov dword ptr [esp], 00000018h
call 00007F19351C89DCh
test eax, eax
je 00007F19351C7F52h
mov dword ptr [esp], 00000000h
xor ecx, ecx
xor ebx, ebx
mov dword ptr [esp+04h], ebx
xor esi, esi
mov dword ptr [esp+0Ch], ecx
mov dword ptr [esp+08h], esi
call 00007F19351CBA6Eh
sub esp, 10h
test eax, eax
mov ebx, eax
je 00007F19351C7F27h
lea esi, dword ptr [ebp-00000098h]
mov esi, esi
mov dword ptr [esp+04h], esi
mov eax, 0000007Fh
mov dword ptr [esp+08h], eax
mov dword ptr [esp], ebx
call 00007F19351CBA50h
sub esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10000	0xa94	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x5ad80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8b76d0	0x9b0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x101fc	0x184	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3fa8	0x4000	ae3284f8efb52ca846c6bfe6f40e797e	False	0.509765625	data	6.099324153185884	IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x5000	0xc0	0x200	435ad75db0c8ae66ccdb872533bc122e	False	0.07421875	data	0.3263946603346658	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x6000	0x410	0x600	f91a923d85c802d81b0a5f6cea028392	False	0.3802083333333333	data	4.414030430476667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x7000	0x8cb0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10000	0xa94	0xc00	31cec3fb8d8e0dfb2ee22273a813e49e	False	0.3636067708333333	data	4.476948124709663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11000	0x5ad80	0x5ae00	6eab6cc60db09bcc9ee329ddf6405765	False	0.2977535032668501	data	4.9786374970558285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x113a0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144	0.22518640707755125
RT_ICON	0x533c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.43468295279782326
RT_ICON	0x63bf0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.5722130373169579
RT_ICON	0x67e18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.6268672199170124
RT_ICON	0x6a3c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.7218574108818011
RT_ICON	0x6b468	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.8670212765957447
RT_RCDATA	0x6b8d0	0x6	data	2.3333333333333335
RT_RCDATA	0x6b8d8	0x5	ASCII text, with no line terminators	2.6
RT_RCDATA	0x6b8e0	0x2	data	5.0
RT_RCDATA	0x6b8e4	0x3	ASCII text, with no line terminators	3.6666666666666665
RT_RCDATA	0x6b8e8	0x19	ASCII text, with no line terminators	1.32
RT_RCDATA	0x6b904	0x32	data	1.16
RT_RCDATA	0x6b938	0x73	ASCII text, with no line terminators	0.8695652173913043
RT_RCDATA	0x6b9ac	0x35	ASCII text, with no line terminators	1.1320754716981132
RT_RCDATA	0x6b9e4	0x68	data	0.875
RT_GROUP_ICON	0x6ba4c	0x5a	data	0.7666666666666667
RT_VERSION	0x6baa8	0x2d8	data	0.4739010989010989

Imports

DLL	Import
ADVAPI32.DLL	RegCloseKey, RegEnumKeyExA, RegOpenKeyExA, RegQueryValueExA
KERNEL32.dll	CloseHandle, CreateMutexA, CreateProcessA, ExitProcess, FindResourceExA, FormatMessageA, GetCommandLineA, GetCurrentDirectoryA, GetCurrentProcess, GetEnvironmentVariableA, GetExitCodeProcess, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GlobalMemoryStatusEx, LoadResource, LocalFree, LockResource, SetEnvironmentVariableA, SetLastError, SetUnhandledExceptionFilter, WaitForSingleObject
msvcrt.dll	__getmainargs, __p__environ, __p__fmode, __set_app_type, _cexit, _chdir, _close, _findclose, _findfirst, _findnext, _iob, _itoa, _onexit, _open, _read, _setmode, _stat, atexit, atoi, fclose, fopen, fprintf, fwrite, memset, printf, signal, strcat, strchr, strcmp, strcpy, strlen, strncat, strncpy, strpbrk, strrchr, strstr, strtok
SHELL32.DLL	ShellExecuteA
USER32.dll	CreateWindowExA, DispatchMessageA, EnumWindows, FindWindowExA, GetMessageA, GetSystemMetrics, GetWindowLongA, GetWindowRect, GetWindowTextA, GetWindowThreadProcessId, KillTimer, LoadImageA, MessageBoxA, PostQuitMessage, SendMessageA, SetForegroundWindow, SetTimer, SetWindowPos, ShowWindow, TranslateMessage, UpdateWindow

Target ID:	0
Start time:	02:36:43
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\HkppfZO2WW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HkppfZO2WW.exe" -install
Imagebase:	0x400000
File size:	9'142'400 bytes
MD5 hash:	E8C247A498E6C947AC8FE25CB0374140
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:36:43
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" -install
Imagebase:	0xed0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:36:45
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\HkppfZO2WW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HkppfZO2WW.exe" /install
Imagebase:	0x400000
File size:	9'142'400 bytes
MD5 hash:	E8C247A498E6C947AC8FE25CB0374140
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:36:45
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /install
Imagebase:	0xed0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:36:47
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\HkppfZO2WW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HkppfZO2WW.exe" /load
Imagebase:	0x400000
File size:	9'142'400 bytes
MD5 hash:	E8C247A498E6C947AC8FE25CB0374140
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:36:47
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\user\Desktop\HkppfZO2WW.exe" /load
Imagebase:	0xed0000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.7%
Total number of Nodes:	739
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004030C0 Relevance: 302.4, APIs: 119, Strings: 53, Instructions: 1411stringfilelibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004030EE
GetModuleHandleA.KERNEL32(?,004013C7), ref: 004030FA
memset.MSVCRT ref: 00403143
GetModuleFileNameA.KERNEL32(004013C7), ref: 00403159
strrchr.MSVCRT ref: 00403175
strstr.MSVCRT ref: 00403198
memset.MSVCRT ref: 004031C2
strncpy.MSVCRT ref: 004031DE
strlen.MSVCRT ref: 004031E6
fopen.MSVCRT ref: 00403212
fprintf.MSVCRT ref: 00403240
GetModuleHandleA.KERNEL32 ref: 0040324C
GetProcAddress.KERNEL32 ref: 00403260
GetCurrentProcess.KERNEL32 ref: 0040326E
fprintf.MSVCRT ref: 004032B1

Strings

1.7.0, xrefs: 004033ED, 00403A20
Check launcher:%s %s, xrefs: 0040366D, 004038C1
p@, xrefs: 00404654
Launcher args:%s, xrefs: 0040408C
Args length:%d/32768 chars, xrefs: 004040D8
An error occurred while starting the application., xrefs: 004032E7, 0040340A, 004038EB, 004039DD, 004039EB, 00403A29, 00403A3E, 00403A7D
p@, xrefs: 00403FAE
bin\javaw.exe, xrefs: 00404254, 00404273, 004042A7
true, xrefs: 00403727, 00403EEA
p@, xrefs: 004041A5
p@, xrefs: 004040A8
(n/a), xrefs: 0040365E, 004038B8
th ", xrefs: 00404359
-jar, xrefs: 00403F7A
p@, xrefs: 0040459F
C:\Users\user\Desktop, xrefs: 0040337C
(OK), xrefs: 00403657, 004038B1
Working dir:%s, xrefs: 004037C8
Bc@, xrefs: 00403524
--l4j-, xrefs: 004044EB
ini, xrefs: 00403C8F
Add classpath:%s, xrefs: 004043AE
p@, xrefs: 00403F3D
p@, xrefs: 0040453F
nch4, xrefs: 004031BA
" :%s, xrefs: 004044C5
bin\java.exe, xrefs: 004039A8, 00403B66, 004041FD
:, xrefs: 0040361F
-jar, xrefs: 00404127
p@, xrefs: 00404087
p@, xrefs: 00404688
p@, xrefs: 0040444B
CmdLine:%s %s, xrefs: 00403230
-Xmx, xrefs: 00403B99
-Xms, xrefs: 00403B7C
sspa, xrefs: 00404349
p@, xrefs: 00403FFD
``@, xrefs: 004031F2
j.lo, xrefs: 004031F7
-cla, xrefs: 00404341
--l4j-debug, xrefs: 00403189
\, xrefs: 00403616
Bc@, xrefs: 00403538
yes, xrefs: 00403293
l4j., xrefs: 00403CB4
Bundled JRE:%s, xrefs: 00403958
WOW64:%s, xrefs: 004032A5
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 00403431, 00403630, 0040363E, 00403882, 00403898, 0040390E, 0040391E, 00403943, 0040396E, 00403B45, 00403B6F, 00404064, 004041C7, 00404286
IsWow64Process, xrefs: 00403254
Launcher:%s, xrefs: 00404069
p@, xrefs: 00404312
~`@, xrefs: 0040329C
Set var:%s = %s, xrefs: 004035B2

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Modulememset$Handlefprintf$AddressCurrentFileNameProcProcessfopenstrlenstrncpystrrchrstrstr
String ID: CmdLine:%s %s$ " :%s$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$(OK)$(n/a)$--l4j-$--l4j-debug$-Xms$-Xmx$-cla$-jar$-jar$1.7.0$:$Add classpath:%s$An error occurred while starting the application.$Args length:%d/32768 chars$Bc@$Bc@$Bundled JRE:%s$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$C:\Users\user\Desktop$Check launcher:%s %s$IsWow64Process$Launcher args:%s$Launcher:%s$Set var:%s = %s$WOW64:%s$Working dir:%s$\$``@$bin\java.exe$bin\javaw.exe$ini$j.lo$l4j.$nch4$sspa$th "$true$yes$~`@
API String ID: 2968499522-3589992203
Opcode ID: 1f20b5c9895d9af463517c6fa9c024e1b337b39d992afbb1f21ae2ed438d1340
Instruction ID: 0e89a22367f5d3f2eae708a14e8bb05f6e03d73e7b0ab72636a6b4786490bd8a
Opcode Fuzzy Hash: 1f20b5c9895d9af463517c6fa9c024e1b337b39d992afbb1f21ae2ed438d1340
Instruction Fuzzy Hash: CAD251B19087048BD714AF25C54026ABBE5EFC4304F05C9BFE5C8A7391DB7C9989DB8A

Function 004013B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 332
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004030C0: memset.MSVCRT ref: 004030EE
Part of subcall function 004030C0: GetModuleHandleA.KERNEL32(?,004013C7), ref: 004030FA

strstr.MSVCRT ref: 0040142A
CreateWindowExA.USER32 ref: 004014A7
strstr.MSVCRT ref: 0040150F
LoadImageA.USER32 ref: 0040155E

Part of subcall function 00401BF0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401BF6
Part of subcall function 00401BF0: MessageBoxA.USER32 ref: 00401C32
Part of subcall function 00401BF0: ShellExecuteA.SHELL32 ref: 00401C7E

memset.MSVCRT ref: 004017E1
ShowWindow.USER32 ref: 00401808
SetForegroundWindow.USER32 ref: 00401813

Strings

Exit code:%d, xrefs: 00401754
--l4j-no-splash-err, xrefs: 00401506
--l4j-dont-wait, xrefs: 00401421
STATIC, xrefs: 00401487
--l4j-no-splash, xrefs: 00401719

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Window$memsetstrstr$CreateErrorExecuteForegroundHandleImageLastLoadMessageModuleShellShow
String ID: --l4j-dont-wait$--l4j-no-splash$--l4j-no-splash-err$Exit code:%d$STATIC
API String ID: 1172715904-121186343
Opcode ID: b7e873c6563f926a30741e0d117d4a65a1acbb56b3432b0c167deef810c33fa7
Instruction ID: 22f332a72cef92a8da5d6acb595563ebd0f99b3e0e1198dea9edd092bcf45b6f
Opcode Fuzzy Hash: b7e873c6563f926a30741e0d117d4a65a1acbb56b3432b0c167deef810c33fa7
Instruction Fuzzy Hash: 6FD101B19083018BD714FF2AD54131EBAE5BFC4344F01C93FE989A73A1DB7899459B8A

Function 004013E9 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 205
stringwindowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401EC0: FindResourceExA.KERNEL32 ref: 00401EFB
Part of subcall function 00401EC0: LoadResource.KERNEL32 ref: 00401F14
Part of subcall function 00401EC0: LockResource.KERNEL32 ref: 00401F23

strstr.MSVCRT ref: 0040142A
CreateWindowExA.USER32 ref: 004014A7
strstr.MSVCRT ref: 0040150F
LoadImageA.USER32 ref: 0040155E
SendMessageA.USER32 ref: 0040158F
GetWindowRect.USER32 ref: 004015A4
GetSystemMetrics.USER32 ref: 004015B3
GetSystemMetrics.USER32 ref: 004015DC
SetWindowPos.USER32 ref: 0040162B
ShowWindow.USER32 ref: 00401643
UpdateWindow.USER32 ref: 00401654
SetTimer.USER32 ref: 0040167F

Part of subcall function 004047A0: memset.MSVCRT ref: 004047DE
Part of subcall function 004047A0: strcat.MSVCRT ref: 0040480B
Part of subcall function 004047A0: strlen.MSVCRT ref: 00404813
Part of subcall function 004047A0: strcat.MSVCRT ref: 0040482F
Part of subcall function 004047A0: CreateProcessA.KERNEL32 ref: 00404875

GetMessageA.USER32 ref: 004016EC
strstr.MSVCRT ref: 00401722

Strings

--l4j-no-splash-err, xrefs: 00401506
--l4j-dont-wait, xrefs: 00401421
STATIC, xrefs: 00401487

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Window$Resourcestrstr$CreateLoadMessageMetricsSystemstrcat$FindImageLockProcessRectSendShowTimerUpdatememsetstrlen
String ID: --l4j-dont-wait$--l4j-no-splash-err$STATIC
API String ID: 4182365790-3920415740
Opcode ID: d398302fcecea8767c2f4d14e06c24a15f3e1a15badd60b91015d221b8449cc4
Instruction ID: ee7b831562b9b24d1f16b922444e8b63d9d8e08211f115b699755232a1a447d7
Opcode Fuzzy Hash: d398302fcecea8767c2f4d14e06c24a15f3e1a15badd60b91015d221b8449cc4
Instruction Fuzzy Hash: 338103B1A083018FD714EF7AD94131EBBE1BFC4344F05893EE988A7391DB7899458B86

Function 00401150 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
__getmainargs.MSVCRT ref: 0040119A
_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 3549981cb67ff38a295ae9781b7f217a27204a441156aad90a8880d90c2b952a
Instruction ID: fab3366932fbaa3ebb4d58be2606cf2eda9a25db2a2b1f6ef0ea82b631d7fdb2
Opcode Fuzzy Hash: 3549981cb67ff38a295ae9781b7f217a27204a441156aad90a8880d90c2b952a
Instruction Fuzzy Hash: 11211DB49043049FC304EF65E58151E7BF1BF88354F408A7EE694A77A5D778A880CF9A

Function 00401E10 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
LoadResource.KERNEL32 ref: 00401E55
LockResource.KERNEL32 ref: 00401E64
SetLastError.KERNEL32 ref: 00401E9D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID:
API String ID: 1074440638-0
Opcode ID: 5656401f9e567967a8485652ef1563bf0e9ef1944012dd97e3ad28967893910f
Instruction ID: f588b214a1d680624203c40b2ff752b88374fd5a224907c8dedae4407861157b
Opcode Fuzzy Hash: 5656401f9e567967a8485652ef1563bf0e9ef1944012dd97e3ad28967893910f
Instruction Fuzzy Hash: E4114FB16047019ADB00AB39C54175BBBE1BB84344F01853AED85A7391D638E905CBD6

Function 0040311C Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 184stringfilelibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403143
GetModuleFileNameA.KERNEL32(004013C7), ref: 00403159
strrchr.MSVCRT ref: 00403175
strstr.MSVCRT ref: 00403198
memset.MSVCRT ref: 004031C2
strncpy.MSVCRT ref: 004031DE
strlen.MSVCRT ref: 004031E6
fopen.MSVCRT ref: 00403212
fprintf.MSVCRT ref: 00403240
GetModuleHandleA.KERNEL32 ref: 0040324C
GetProcAddress.KERNEL32 ref: 00403260
GetCurrentProcess.KERNEL32 ref: 0040326E
fprintf.MSVCRT ref: 004032B1
CreateMutexA.KERNEL32 ref: 00403353
GetLastError.KERNEL32 ref: 0040335B
memset.MSVCRT ref: 00403388
GetCurrentDirectoryA.KERNEL32 ref: 00403398
strcpy.MSVCRT ref: 0040344E
strlen.MSVCRT ref: 00403456
memset.MSVCRT ref: 0040347F
GetEnvironmentVariableA.KERNEL32 ref: 00403498
strlen.MSVCRT ref: 004034A5
strlen.MSVCRT ref: 004034BB
strcat.MSVCRT ref: 004034D4
SetEnvironmentVariableA.KERNEL32 ref: 004034E4
memset.MSVCRT ref: 0040350C
SetEnvironmentVariableA.KERNEL32 ref: 00403541
strtok.MSVCRT ref: 00403554
strchr.MSVCRT ref: 00403575
fprintf.MSVCRT ref: 004035C2
memset.MSVCRT ref: 004035E4
strcpy.MSVCRT ref: 00403637
FindResourceExA.KERNEL32 ref: 0040382E
LoadResource.KERNEL32 ref: 0040384B
LockResource.KERNEL32 ref: 0040385A
atoi.MSVCRT ref: 00403879
fprintf.MSVCRT ref: 004038D7

Part of subcall function 00401E10: FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
Part of subcall function 00401E10: LoadResource.KERNEL32 ref: 00401E55
Part of subcall function 00401E10: LockResource.KERNEL32 ref: 00401E64

Strings

1.7.0, xrefs: 004033ED
nch4, xrefs: 004031BA
--l4j-debug, xrefs: 00403189
WOW64:%s, xrefs: 004032A5
C:\Users\user\Desktop, xrefs: 0040337C
IsWow64Process, xrefs: 00403254
``@, xrefs: 004031F2
An error occurred while starting the application., xrefs: 004032E7, 0040340A
CmdLine:%s %s, xrefs: 00403230
~`@, xrefs: 0040329C
yes, xrefs: 00403293
j.lo, xrefs: 004031F7

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resourcememset$fprintfstrlen$EnvironmentVariable$CurrentFindLoadLockModulestrcpy$AddressCreateDirectoryErrorFileHandleLastMutexNameProcProcessatoifopenstrcatstrchrstrncpystrrchrstrstrstrtok
String ID: CmdLine:%s %s$--l4j-debug$1.7.0$An error occurred while starting the application.$C:\Users\user\Desktop$IsWow64Process$WOW64:%s$``@$j.lo$nch4$yes$~`@
API String ID: 276419104-4214590570
Opcode ID: 2a3f9d9becd6b63c6195d3f3105f1d5613062485fea006847c855bd2f4b45a57
Instruction ID: f0a9dd12e9f155100ecc80547f8524881e04b64e39f325f861530ddbe7d78783
Opcode Fuzzy Hash: 2a3f9d9becd6b63c6195d3f3105f1d5613062485fea006847c855bd2f4b45a57
Instruction Fuzzy Hash: CE811CB09087009BD714AF25C58025EBAE5FFC4744F01C87FE9C8AB391DB7899859F8A

Function 00402280 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 107
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004022C9
RegEnumKeyExA.ADVAPI32 ref: 0040232F
strcmp.MSVCRT ref: 0040234B
strcmp.MSVCRT ref: 0040236D
strcpy.MSVCRT ref: 00402385
strcpy.MSVCRT ref: 00402398
strlen.MSVCRT ref: 004023A4
strcat.MSVCRT ref: 004023C9
fprintf.MSVCRT ref: 004023FC
fprintf.MSVCRT ref: 0040241D

Strings

1.7.0, xrefs: 00402342
1.8.0_381, xrefs: 00402364, 0040237E
Ignore:%s\%s, xrefs: 0040240D
Match:%s, xrefs: 004023EF
SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381, xrefs: 0040238A, 0040239D, 004023C2, 004023EA

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: fprintfstrcmpstrcpy$Enummemsetstrcatstrlen
String ID: 1.7.0$1.8.0_381$Ignore:%s\%s$Match:%s$SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381
API String ID: 2366812193-779923612
Opcode ID: feb0feb41c432621510d2774921ed4ae6fb30bd5dcd4c6b6128fc8dc5ae5dabe
Instruction ID: 9ab0c8db1ba71b2b6d2ba768174804a11d38db5b54a87c79ea0cb8f479a381c0
Opcode Fuzzy Hash: feb0feb41c432621510d2774921ed4ae6fb30bd5dcd4c6b6128fc8dc5ae5dabe
Instruction Fuzzy Hash: AC411DF0A093049FD754AF69C58065ABBE4FF88314F41C87FEA88A7381D77889459F4A

Function 004047A0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 106
stringprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004047DE
strcat.MSVCRT ref: 0040480B
strlen.MSVCRT ref: 00404813
strcat.MSVCRT ref: 0040482F
CreateProcessA.KERNEL32 ref: 00404875
WaitForSingleObject.KERNEL32(?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048B2
GetExitCodeProcess.KERNEL32 ref: 004048CD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048E8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048F9
fclose.MSVCRT ref: 0040490D

Strings

p@, xrefs: 0040481E
Exit code:%d, xrefs: 00404920
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004047CD
D, xrefs: 00404804

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseHandleProcessstrcat$CodeCreateExitObjectSingleWaitfclosememsetstrlen
String ID: p@$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$D$Exit code:%d
API String ID: 1835003254-3076985505
Opcode ID: 3242635cd407cc207b4e9632af2587f9fe911d2d8e26333d3a4061cd7df8f18c
Instruction ID: 5caefe9559b27fe27b5d30c0e67c063fa4c1d1b371c170d15aebd52dad6435f1
Opcode Fuzzy Hash: 3242635cd407cc207b4e9632af2587f9fe911d2d8e26333d3a4061cd7df8f18c
Instruction Fuzzy Hash: BB411FB19087048FD710EF69D58111EBBE1BFC4314F01C93EE988A7391DB389959CB9A

Function 00402640 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jre, xrefs: 00402841
JavaHome, xrefs: 004027D6
SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381, xrefs: 00402783

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseOpen$fprintffwrite
String ID: JavaHome$SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381$jre
API String ID: 2632948728-210039947
Opcode ID: 9364065cee4006aa1e248f2a8bc137236dbc144057ed49c4486b6edb3bc99a87
Instruction ID: 13784bda21131abe29e605e60e8874ea15ce2e043269139803be6fc73a734c89
Opcode Fuzzy Hash: 9364065cee4006aa1e248f2a8bc137236dbc144057ed49c4486b6edb3bc99a87
Instruction Fuzzy Hash: F9516CB59083158BD714AF25C64425ABBE0FF80304F41C97FE9883B3C2C7BD99458B8A

Function 00402430 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 102
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00402715), ref: 00402485
fprintf.MSVCRT ref: 004024B5
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00402715), ref: 004024EE
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00402715), ref: 0040251F
fwrite.MSVCRT ref: 0040255E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00402715), ref: 00402581
fprintf.MSVCRT ref: 004025A6

Strings

64-bit search:%s..., xrefs: 004024A6
32-bit search:%s..., xrefs: 0040259A

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseOpenfprintf$fwrite
String ID: 32-bit search:%s...$64-bit search:%s...
API String ID: 2131660067-1681012534
Opcode ID: c9c749f2187168bffb8da3167b872fe2273aff8a064b781ea05361dbc82f9642
Instruction ID: db78835e4e37dc56512bf58087c2aef207271a2ad5982ab85f3d843889212adc
Opcode Fuzzy Hash: c9c749f2187168bffb8da3167b872fe2273aff8a064b781ea05361dbc82f9642
Instruction Fuzzy Hash: 6741FBB09083159BC700EF65D68525EFBF4FF88304F11887EE888A7391D778E9458B46

Function 0040124A Relevance: 10.5, APIs: 7, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241
_setmode.MSVCRT ref: 00401256

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExitProcess__p__environ__p__fmode_cexit
String ID:
API String ID: 2747451157-0
Opcode ID: 612ea18759bad0b7cbd0a5ec3d2df94d679dbe7011e7526947487d00c96e5d27
Instruction ID: d94ddfb0904ed1d1b1fcd9f17775da174976b76cb98335a262b590a7c617f90a
Opcode Fuzzy Hash: 612ea18759bad0b7cbd0a5ec3d2df94d679dbe7011e7526947487d00c96e5d27
Instruction Fuzzy Hash: CF11E8B4604700DFC304EF65E5C541A77B1BFC8314B108A7EE694A77A6CB78A880CB89

Function 00404940 Relevance: 4.6, APIs: 3, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00404959
GetStartupInfoA.KERNEL32 ref: 00404966
GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: caeae535246a066ec4027968bdff7b90be6b14e88b81f7980858a74c74548f5b
Instruction ID: a5db5900d75afb6c5168a722f043656c093b3c7bcdd2ff3413d71d09629adc29
Opcode Fuzzy Hash: caeae535246a066ec4027968bdff7b90be6b14e88b81f7980858a74c74548f5b
Instruction Fuzzy Hash: E2214CF67047054BDB14A67694E23ABBBD77FC0344F89813AC781322C3E23C5A91565A

Function 004049CC Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 640ac14f03c0242051221d45c1bfb32813a6530bddfb4f1dd95e636b1bdeabfb
Instruction ID: 5d636c514429e280118d9dbd7938b1e1d94385514683ffc3c512b9d4b85b8e02
Opcode Fuzzy Hash: 640ac14f03c0242051221d45c1bfb32813a6530bddfb4f1dd95e636b1bdeabfb
Instruction Fuzzy Hash: E5F0F4F1A087054BDB149B39919139BBBE2AF80344F44C43EDA86332C2E23C59918E06

Function 004049FE Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: be7efde4b0b02bdb2840ff36021931a74c2a51f0cb252b5f7cb9762ef76da80f
Instruction ID: 25b03b7247f52adc190129cc9a2441f77ae864ffa51203875fe0df8adb52ff07
Opcode Fuzzy Hash: be7efde4b0b02bdb2840ff36021931a74c2a51f0cb252b5f7cb9762ef76da80f
Instruction Fuzzy Hash: 91F0A0B2A083544ADB04AF7AC18136EFFE1AF84398F44C46DDA84226D2D27C85408F56

Function 00401290 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0040129D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119A
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D5
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FB
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401200
Part of subcall function 00401150: __p__environ.MSVCRT ref: 00401215
Part of subcall function 00401150: _cexit.MSVCRT ref: 00401239
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode__set_app_type_cexit
String ID:
API String ID: 250851222-0
Opcode ID: 07d231db7de6fe80658fabe20cc0a2b477427057892decb2133d087f286a5da2
Instruction ID: ee6e0f434122d3ee92d33c208706bcb836196eff62b72ac1d1d53b2e3b1dd9b5
Opcode Fuzzy Hash: 07d231db7de6fe80658fabe20cc0a2b477427057892decb2133d087f286a5da2
Instruction Fuzzy Hash: D8C09B3444521497C3103BB5DC0E359BBE86B05301F51443DD5C567261D7743C454796

Non-executed Functions

Function 00401BF0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 134windowstringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401BF6
MessageBoxA.USER32 ref: 00401C32
ShellExecuteA.SHELL32 ref: 00401C7E
printf.MSVCRT ref: 00401CAA
fclose.MSVCRT ref: 00401CB4
FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401CED
strcat.MSVCRT ref: 00401D63
printf.MSVCRT ref: 00401D8B
LocalFree.KERNEL32 ref: 00401D96

Strings

Error:%s, xrefs: 00401DA6
open, xrefs: 00401C6D
Open URL:%s, xrefs: 00401DC8
An error occurred while starting the application., xrefs: 00401C25, 00401C98, 00401D03, 00401D42, 00401D58, 00401D79, 00401DF1

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Messageprintf$ErrorExecuteFormatFreeLastLocalShellfclosestrcat
String ID: An error occurred while starting the application.$Error:%s$Open URL:%s$open
API String ID: 519069059-3584283646
Opcode ID: d50ecb3a0fe696158464c957faeb54865f91f7cff6ca1c14cdd2f225c6ce74fd
Instruction ID: 5a562d4ed0a2dbc2a1e4330f613c05cbce52b9a6d063ec7aa8dcb6c58c2de855
Opcode Fuzzy Hash: d50ecb3a0fe696158464c957faeb54865f91f7cff6ca1c14cdd2f225c6ce74fd
Instruction Fuzzy Hash: 04511AB0A087009BD358EF69D55121BBAE1EFC4304F10CC3FA589A77A4D73DD9459B8A

Function 00402A30 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 167
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 00402A6C
strchr.MSVCRT ref: 00402A8A
strncat.MSVCRT ref: 00402AAF
strncat.MSVCRT ref: 00402ADA
strlen.MSVCRT ref: 00402AF0
strstr.MSVCRT ref: 00402B65
GetEnvironmentVariableA.KERNEL32 ref: 00402B94
strcat.MSVCRT(?,?,00403609), ref: 00402BDD
fprintf.MSVCRT ref: 00402C19
strncat.MSVCRT ref: 00402C37
strcat.MSVCRT ref: 00402C4E
GetCurrentDirectoryA.KERNEL32 ref: 00402C66
strcat.MSVCRT ref: 00402C82
strcat.MSVCRT(?,00008000,?,?,00403609), ref: 00402CB6

Strings

EXEFILE, xrefs: 00402B0C
OLDPWD, xrefs: 00402B3E
C:\Users\user\Desktop, xrefs: 00402C76
HKEY, xrefs: 00402B53
EXEDIR, xrefs: 00402AE2
PWD, xrefs: 00402B25
Substitute:%s = %s, xrefs: 00402C0C

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strcat$strncat$strchr$CurrentDirectoryEnvironmentVariablefprintfstrlenstrstr
String ID: C:\Users\user\Desktop$EXEDIR$EXEFILE$HKEY$OLDPWD$PWD$Substitute:%s = %s
API String ID: 1816310627-1435958981
Opcode ID: 557825d837c7bee13b9dcc2b9774faa3785b3bb199ed70112449aa9433a5436a
Instruction ID: a3250f9e5731c696cfa46b821dc8bafca942bd9f0803d40a23b6cf00076f12fd
Opcode Fuzzy Hash: 557825d837c7bee13b9dcc2b9774faa3785b3bb199ed70112449aa9433a5436a
Instruction Fuzzy Hash: FF6140709047059BCB54EF25C98435ABBF1FF84314F01C87EE98C67381CB78A9859B96

Function 00402CD0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 197
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32 ref: 00402D1B
LoadResource.KERNEL32 ref: 00402D38
LockResource.KERNEL32 ref: 00402D47
atoi.MSVCRT ref: 00402D6F
FindResourceExA.KERNEL32 ref: 00402DAB
LoadResource.KERNEL32 ref: 00402DC8
LockResource.KERNEL32 ref: 00402DD7
atoi.MSVCRT ref: 00402DFF
strcat.MSVCRT(?), ref: 00402E95
strlen.MSVCRT ref: 00402E9D
_itoa.MSVCRT ref: 00402EB4
strlen.MSVCRT ref: 00402EBC
fprintf.MSVCRT ref: 00402F11
fprintf.MSVCRT ref: 00402F34
SetLastError.KERNEL32 ref: 00402F4B
SetLastError.KERNEL32 ref: 00402F5F

Strings

-Xmx, xrefs: 00402CDC
Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB, xrefs: 00402F23
Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB, xrefs: 00402EF5
-Xms, xrefs: 00402CD5

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLockatoifprintfstrlen$_itoastrcat
String ID: -Xms$-Xmx$Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB$Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB
API String ID: 636361558-2330190027
Opcode ID: 49bac7fe6f19ca0f5bd07a777ba95da00ba2692b1f2fcb73d42c15d88026703e
Instruction ID: 9aecac28fc5dbd291391d4754e14ca6bb2a3230fcdd307f80071577cc15113ea
Opcode Fuzzy Hash: 49bac7fe6f19ca0f5bd07a777ba95da00ba2692b1f2fcb73d42c15d88026703e
Instruction Fuzzy Hash: E87160B19083158BDB14EF29D58526EBBF1BFC8344F01843FE988AB391D7789805DB96

Function 00402060 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 118stringregistryCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0040207D
strstr.MSVCRT ref: 00402097
strstr.MSVCRT ref: 004020B1
strstr.MSVCRT ref: 004020CB
strstr.MSVCRT ref: 004020E5
strchr.MSVCRT ref: 00402104
strrchr.MSVCRT ref: 00402118
RegOpenKeyExA.ADVAPI32 ref: 00402152
RegQueryValueExA.ADVAPI32 ref: 00402183
RegCloseKey.ADVAPI32 ref: 0040219C
RegOpenKeyExA.ADVAPI32 ref: 004021D0

Strings

HKEY_CURRENT_USER, xrefs: 00402089
HKEY_CURRENT_CONFIG, xrefs: 004020D7
HKEY, xrefs: 00402068
HKEY_USERS, xrefs: 004020BD
HKEY_LOCAL_MACHINE, xrefs: 004020A3
HKEY_CLASSES_ROOT, xrefs: 00402061

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strstr$Open$CloseQueryValuestrchrstrrchr
String ID: HKEY$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 356245303-4236897492
Opcode ID: 5c2711ff94cca963458cf507547e09b59df7b2f0a65b0f2675fb1cf67cf2534b
Instruction ID: 7b57610d86410dffa4a0aa1252a1797adbc7715624c0aad137216de424c346f3
Opcode Fuzzy Hash: 5c2711ff94cca963458cf507547e09b59df7b2f0a65b0f2675fb1cf67cf2534b
Instruction Fuzzy Hash: B44140B19083119FDB00EF69D58555EFBE0BF84314F05C83FEA98A7381D77989489B86

Function 00402950 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 58stringCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402996
strcpy.MSVCRT ref: 004029B3
strlen.MSVCRT ref: 004029C5
strcat.MSVCRT ref: 004029E3
_stat.MSVCRT ref: 004029F6
strlen.MSVCRT ref: 00402A08

Strings

bin\javaw.exe, xrefs: 00402A1A
Check launcher:%s %s, xrefs: 00402980
bin\java.exe, xrefs: 004029D7
(n/a), xrefs: 00402977
(OK), xrefs: 00402970

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strlen$_statfprintfstrcatstrcpy
String ID: (OK)$(n/a)$Check launcher:%s %s$bin\java.exe$bin\javaw.exe
API String ID: 882030775-291028976
Opcode ID: 3a737aaa2f9c364d49fc00a44d18b990e604c09d1433cb05d02c114c702a0f6e
Instruction ID: 8018404b5ef50dabb5b93d2653235a7c06d24b677d78717b0f5c7ccaf4d26fd7
Opcode Fuzzy Hash: 3a737aaa2f9c364d49fc00a44d18b990e604c09d1433cb05d02c114c702a0f6e
Instruction Fuzzy Hash: 2C1145B0A083449FD720AF6995C566ABAE0BF84304F05C47FA589A73D1DB7C88449B4A

Function 00401AFC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401B0E
GetProcAddress.KERNEL32 ref: 00401B22
GetCurrentProcess.KERNEL32 ref: 00401B30
fprintf.MSVCRT ref: 00401B73

Strings

WOW64:%s, xrefs: 00401B67
IsWow64Process, xrefs: 00401B16
~`@, xrefs: 00401B5E
yes, xrefs: 00401B55

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes$~`@
API String ID: 24026888-71265849
Opcode ID: 51305618214c0ba30116f8fc18af47c9d8f331261b948467b54d85ac15f00ac4
Instruction ID: 11b031cada2c8f52232e6b9cc39170e82d59abd8a686cc32ef86a0f2d0e1404c
Opcode Fuzzy Hash: 51305618214c0ba30116f8fc18af47c9d8f331261b948467b54d85ac15f00ac4
Instruction Fuzzy Hash: D601FBB0A043049BCB10FF75D68551A7AF4AF84344F01C43EAA89BB795E778E8158B9A

Function 00401B00 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401B0E
GetProcAddress.KERNEL32 ref: 00401B22
GetCurrentProcess.KERNEL32 ref: 00401B30
fprintf.MSVCRT ref: 00401B73

Strings

WOW64:%s, xrefs: 00401B67
IsWow64Process, xrefs: 00401B16
~`@, xrefs: 00401B5E
yes, xrefs: 00401B55

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes$~`@
API String ID: 24026888-71265849
Opcode ID: 4888365b0b4b81b55560ce55fcae3362c7a4aa79adf2c55a673206aa49c2d4ca
Instruction ID: d525f3c9823b811787ccd3d125d57a95285788dfaaa60455273fc0be7c930dab
Opcode Fuzzy Hash: 4888365b0b4b81b55560ce55fcae3362c7a4aa79adf2c55a673206aa49c2d4ca
Instruction Fuzzy Hash: ABF031B0A043048BC700FF75D68551A7AF4AF84344F01C43EEA85BB7D5E778E814879A

Function 00401A60 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 33stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401A82
strncpy.MSVCRT ref: 00401A98
strlen.MSVCRT ref: 00401AA0
fopen.MSVCRT ref: 00401AD1

Strings

j.lo, xrefs: 00401AB1
nch4, xrefs: 00401AAC
``@, xrefs: 00401AC5

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: fopenmemsetstrlenstrncpy
String ID: ``@$j.lo$nch4
API String ID: 80595551-9945926
Opcode ID: 9a4ff01140eb6cd6d2ff592d0c9a1b43f0a674710d240b7d889367cb50cbc086
Instruction ID: 1e0e73c0bc485388541f9261c06b4dd11082136fe696d302e2fbee76c2dd3950
Opcode Fuzzy Hash: 9a4ff01140eb6cd6d2ff592d0c9a1b43f0a674710d240b7d889367cb50cbc086
Instruction Fuzzy Hash: 6B01F6F0D083049BC724AF29D4C155DBBE0FF84308F42C83EB99C9B352DA3888949B96

Function 00401930 Relevance: 10.6, APIs: 7, Instructions: 72timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401972
KillTimer.USER32 ref: 00401998
PostQuitMessage.USER32 ref: 004019A7
ShowWindow.USER32 ref: 004019E7
KillTimer.USER32 ref: 00401A1A
PostQuitMessage.USER32 ref: 00401A2E
EnumWindows.USER32 ref: 00401A4D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: KillMessagePostQuitTimer$CodeEnumExitProcessShowWindowWindows
String ID:
API String ID: 1905518172-0
Opcode ID: 908e1c4a2d6816fdb463079a13a016f6fa06e961dc5782ddf8e03a78c551d5c2
Instruction ID: 2407081703d323812a7a2ee4af166e89deffda79c1e67c6e6d523c687404f7b2
Opcode Fuzzy Hash: 908e1c4a2d6816fdb463079a13a016f6fa06e961dc5782ddf8e03a78c551d5c2
Instruction Fuzzy Hash: 782162B06082058BD314FF39D65131B36E1BBC0384F00893EE985B73A5DB38D848DB9A

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 0d913dcc96c4dc2ce39cf1c73b3c4cd3388d7077edd27571fed9032662073fd7
Instruction ID: 026972816123a001b062272259e12c6676799cf41c40ad00ae128651dbc386b1
Opcode Fuzzy Hash: 0d913dcc96c4dc2ce39cf1c73b3c4cd3388d7077edd27571fed9032662073fd7
Instruction Fuzzy Hash: FF3121B0A082409BD724AF69C58032EB6A0BF89314F15897FD9C5E77E1C67E8DC0975A

Function 00401F95 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 00401FDA
LoadResource.KERNEL32 ref: 00401FF3
LockResource.KERNEL32 ref: 00402002
atoi.MSVCRT ref: 0040202F
SetLastError.KERNEL32 ref: 00402040
atoi.MSVCRT ref: 0040204B

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$atoi$ErrorFindLastLoadLock
String ID:
API String ID: 3704303549-0
Opcode ID: 8917aa49ca170ea9424a4871177909678324a0128281268087337ba5d4e2214c
Instruction ID: d2e30d868b6ce554d07eddf99e8fb6c9642cdc6314cd9da99df76be242991cc3
Opcode Fuzzy Hash: 8917aa49ca170ea9424a4871177909678324a0128281268087337ba5d4e2214c
Instruction Fuzzy Hash: 5B117FB15047058BDB10BF39D54136EBBE1BFC4348F06853EDA88A7291D678E906CB86

Function 00402FF9 Relevance: 9.1, APIs: 6, Instructions: 54stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403036
GetEnvironmentVariableA.KERNEL32 ref: 0040304F
strlen.MSVCRT ref: 0040305C
strlen.MSVCRT ref: 00403079
strcat.MSVCRT ref: 0040308B
SetEnvironmentVariableA.KERNEL32 ref: 0040309B

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: EnvironmentVariablestrlen$memsetstrcat
String ID:
API String ID: 2108680700-0
Opcode ID: 1aeff4ed8d99c1ae33423b22697d7e36fe73b048e479dcd255a7cf66a70f4411
Instruction ID: 86b5df9b3431fb8133a4f6ed8904d7532b204288b27cc5577f69cc4901c0064d
Opcode Fuzzy Hash: 1aeff4ed8d99c1ae33423b22697d7e36fe73b048e479dcd255a7cf66a70f4411
Instruction Fuzzy Hash: 6F1126B1D086089BCB00BFA9C04005DFBF5EF88314F1284BEE988A7351DB386A419B86

Function 004028A0 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004028B6
strcat.MSVCRT ref: 004028D4
strlen.MSVCRT ref: 004028E3
strcat.MSVCRT ref: 00402901

Strings

bin\javaw.exe, xrefs: 004028F8
bin\java.exe, xrefs: 004028CB

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strcatstrlen
String ID: bin\java.exe$bin\javaw.exe
API String ID: 1179760717-2770878578
Opcode ID: 854bfbc186050e28c01aca1e52af11a5c6d2265732dea4351e5e53cdbfa1f743
Instruction ID: c625f8ff6eb4937acacc3d066b804341fc1bdd91dfaabe361e5825c854feadc3
Opcode Fuzzy Hash: 854bfbc186050e28c01aca1e52af11a5c6d2265732dea4351e5e53cdbfa1f743
Instruction Fuzzy Hash: 6AF0C8B1C083409FD7217F65A8C461A7BD0AF40304F06847ED1481B393DB798454975A

Function 00401EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 00401EFB
LoadResource.KERNEL32 ref: 00401F14
LockResource.KERNEL32 ref: 00401F23
SetLastError.KERNEL32 ref: 00401F77

Strings

true, xrefs: 00401F4F, 00401F72

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: true
API String ID: 1074440638-4261170317
Opcode ID: fa88095351f1cf649c4e0f59975f4c8608c77ca3866356f65f7bb502d8a741c9
Instruction ID: 720aba9a36caa5c46db755dcfa968833f6afea8c066c512ca53f753ba12c794b
Opcode Fuzzy Hash: fa88095351f1cf649c4e0f59975f4c8608c77ca3866356f65f7bb502d8a741c9
Instruction Fuzzy Hash: F72108B2A043155ADB10AB39E94036ABBE5FBC0350F01857FEE84A3380E7399619C796

Function 00401CBC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401CED
strcat.MSVCRT ref: 00401D63
printf.MSVCRT ref: 00401D8B
LocalFree.KERNEL32 ref: 00401D96
fprintf.MSVCRT ref: 00401DB6

Strings

An error occurred while starting the application., xrefs: 00401D03, 00401D42, 00401D58, 00401D79

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: FormatFreeLocalMessagefprintfprintfstrcat
String ID: An error occurred while starting the application.
API String ID: 3558087145-2110520379
Opcode ID: 0309dab1ae88623b91bd0ca979ed66dc958a41dd0f1e69883467f3f5c59eb028
Instruction ID: 897b2e7710a6a7b3f267c2baffa0a05fecd79613af50bb048a3b26d972268dd0
Opcode Fuzzy Hash: 0309dab1ae88623b91bd0ca979ed66dc958a41dd0f1e69883467f3f5c59eb028
Instruction Fuzzy Hash: 612177B1A086009BD318EF28C50021B77E2EF94304F04C83EE489A77A5D73DE9498B8A

Function 004012D0 Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012F4

Part of subcall function 00401E10: FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
Part of subcall function 00401E10: LoadResource.KERNEL32 ref: 00401E55
Part of subcall function 00401E10: LockResource.KERNEL32 ref: 00401E64

FindWindowExA.USER32 ref: 0040132A
GetWindowTextA.USER32 ref: 00401350
strstr.MSVCRT ref: 0040135F
FindWindowExA.USER32 ref: 0040137F

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: FindResourceWindow$LoadLockTextmemsetstrstr
String ID:
API String ID: 1871962372-0
Opcode ID: 68f9b9fe8e26284ea4466cd7be2fd0a699b70c6e89954b03eac0d4cd0079519f
Instruction ID: 2c743d1d3da27c05cd938fc0b836d91f0b76d418a83aa4d99297ae1c1db7ab18
Opcode Fuzzy Hash: 68f9b9fe8e26284ea4466cd7be2fd0a699b70c6e89954b03eac0d4cd0079519f
Instruction Fuzzy Hash: 7F215EB2A083005BD714BF6AD54125EFBE4EFC4354F01C83FEA88D3691E63885458B86

Function 0040489E Relevance: 7.5, APIs: 5, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048B2
GetExitCodeProcess.KERNEL32 ref: 004048CD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048E8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048F9
fclose.MSVCRT ref: 0040490D
fprintf.MSVCRT ref: 0040492D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseHandle$CodeExitObjectProcessSingleWaitfclosefprintf
String ID:
API String ID: 1585231095-0
Opcode ID: ba37172a1753ab43741c320a5b96a6367dc65ef8d5e99b837736b0aa74c96b18
Instruction ID: eb652ffc412eefeed0e718282237602074e50451812d2df90e84619bac2913a3
Opcode Fuzzy Hash: ba37172a1753ab43741c320a5b96a6367dc65ef8d5e99b837736b0aa74c96b18
Instruction Fuzzy Hash: 850121B59046048BE710FF79E98245EB7B1BBC4314F01893EDD8467691EA3498198B86

Function 00402F6C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00402F87

Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402D1B
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402D38
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402D47
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402D6F
Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402DAB
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402DC8
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402DD7
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402DFF

Part of subcall function 00402CD0: strcat.MSVCRT(?), ref: 00402E95
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402E9D
Part of subcall function 00402CD0: _itoa.MSVCRT ref: 00402EB4
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402EBC

Strings

-Xmx, xrefs: 00402FC6
-Xms, xrefs: 00402F92
@, xrefs: 00402F7D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$FindLoadLockatoistrlen$GlobalMemoryStatus_itoastrcat
String ID: -Xms$-Xmx$@
API String ID: 3228920701-2676391021
Opcode ID: 1ee8ed68ac0c068930fb015abfc5e24d0c88b4e77e9116532bd67e932936c618
Instruction ID: 83f1aa44919a4c99108a5316738b6ebc3d89b658feaab29e7295632cd6d8abda
Opcode Fuzzy Hash: 1ee8ed68ac0c068930fb015abfc5e24d0c88b4e77e9116532bd67e932936c618
Instruction Fuzzy Hash: 890192B0A097099FDB04EF69D18055EBBF1EF88304F10C82EE589AB380D778D9459B86

Function 00402F70 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00402F87

Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402D1B
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402D38
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402D47
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402D6F
Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402DAB
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402DC8
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402DD7
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402DFF

Part of subcall function 00402CD0: strcat.MSVCRT(?), ref: 00402E95
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402E9D
Part of subcall function 00402CD0: _itoa.MSVCRT ref: 00402EB4
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402EBC

Strings

-Xmx, xrefs: 00402FC6
-Xms, xrefs: 00402F92
@, xrefs: 00402F7D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$FindLoadLockatoistrlen$GlobalMemoryStatus_itoastrcat
String ID: -Xms$-Xmx$@
API String ID: 3228920701-2676391021
Opcode ID: 3d5dd6a6b33f9c710683a0e9a068311a38a7e96d1987d357962a79e933fbc725
Instruction ID: 6e677b9b8fabcb62c193d886980ddecd66842c0ac049963db457ddd5af3e35c3
Opcode Fuzzy Hash: 3d5dd6a6b33f9c710683a0e9a068311a38a7e96d1987d357962a79e933fbc725
Instruction Fuzzy Hash: FF0193B0A093099FD704EF69D18055EBBF1EF88304F10C83EE589AB380D778D9459B86

Function 00402945 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 29stringCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402996
strcpy.MSVCRT ref: 004029B3
strlen.MSVCRT ref: 004029C5
strcat.MSVCRT ref: 004029E3
_stat.MSVCRT ref: 004029F6

Strings

Check launcher:%s %s, xrefs: 00402980
(n/a), xrefs: 00402977
(OK), xrefs: 00402970

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _statfprintfstrcatstrcpystrlen
String ID: (OK)$(n/a)$Check launcher:%s %s
API String ID: 619758015-4217937889
Opcode ID: 8e35bfdefc2d965162e0c46b7f7b8511bec3a04771cfdae5fb4af482349bacc5
Instruction ID: fa1afa973b0b716c6a45a6db043711451785159eaff392967d20973c2505f891
Opcode Fuzzy Hash: 8e35bfdefc2d965162e0c46b7f7b8511bec3a04771cfdae5fb4af482349bacc5
Instruction Fuzzy Hash: C3F05EB0A043085FDB109E59E980766B7E4FB84314F01C47EE94CA7380D778A8548B89

Function 00401A3C Relevance: 6.0, APIs: 4, Instructions: 26timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401972
KillTimer.USER32 ref: 00401998
PostQuitMessage.USER32 ref: 004019A7
EnumWindows.USER32 ref: 00401A4D

Memory Dump Source

Source File: 00000000.00000002.2165632316.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2165473208.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165752910.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165829187.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2166217491.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CodeEnumExitKillMessagePostProcessQuitTimerWindows
String ID:
API String ID: 405088690-0
Opcode ID: 4f729626180ff1f826cd159275eaebbc8f8a505249547bf250ab6daea0a3e3ed
Instruction ID: 5dfb1647a7b45fe9d990e1e5a37a50df87d11f83294e09497229981203e6544d
Opcode Fuzzy Hash: 4f729626180ff1f826cd159275eaebbc8f8a505249547bf250ab6daea0a3e3ed
Instruction Fuzzy Hash: 83F0D0B59083008AD314BF34D6462197AE0BB84344F018A3ED9C5637D5D7789558DB9B

Analysis Process: HkppfZO2WW.exePID: 7588, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	739
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004030C0 Relevance: 302.4, APIs: 119, Strings: 53, Instructions: 1411stringfilelibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004030EE
GetModuleHandleA.KERNEL32(?,004013C7), ref: 004030FA
memset.MSVCRT ref: 00403143
GetModuleFileNameA.KERNEL32(004013C7), ref: 00403159
strrchr.MSVCRT ref: 00403175
strstr.MSVCRT ref: 00403198
memset.MSVCRT ref: 004031C2
strncpy.MSVCRT ref: 004031DE
strlen.MSVCRT ref: 004031E6
fopen.MSVCRT ref: 00403212
fprintf.MSVCRT ref: 00403240
GetModuleHandleA.KERNEL32 ref: 0040324C
GetProcAddress.KERNEL32 ref: 00403260
GetCurrentProcess.KERNEL32 ref: 0040326E
fprintf.MSVCRT ref: 004032B1

Strings

~`@, xrefs: 0040329C
Add classpath:%s, xrefs: 004043AE
--l4j-, xrefs: 004044EB
Args length:%d/32768 chars, xrefs: 004040D8
C:\Users\user\Desktop, xrefs: 0040337C
Bc@, xrefs: 00403524
ini, xrefs: 00403C8F
p@, xrefs: 00404688
-Xmx, xrefs: 00403B99
true, xrefs: 00403727, 00403EEA
Working dir:%s, xrefs: 004037C8
-jar, xrefs: 00404127
Launcher args:%s, xrefs: 0040408C
Bundled JRE:%s, xrefs: 00403958
nch4, xrefs: 004031BA
-Xms, xrefs: 00403B7C
An error occurred while starting the application., xrefs: 004032E7, 0040340A, 004038EB, 004039DD, 004039EB, 00403A29, 00403A3E, 00403A7D
-jar, xrefs: 00403F7A
p@, xrefs: 00403FAE
p@, xrefs: 00403F3D
th ", xrefs: 00404359
:, xrefs: 0040361F
1.7.0, xrefs: 004033ED, 00403A20
bin\javaw.exe, xrefs: 00404254, 00404273, 004042A7
bin\java.exe, xrefs: 004039A8, 00403B66, 004041FD
p@, xrefs: 0040453F
(OK), xrefs: 00403657, 004038B1
p@, xrefs: 0040459F
yes, xrefs: 00403293
p@, xrefs: 0040444B
\, xrefs: 00403616
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 00403431, 00403630, 0040363E, 00403882, 00403898, 0040390E, 0040391E, 00403943, 0040396E, 00403B45, 00403B6F, 00404064, 004041C7, 00404286
``@, xrefs: 004031F2
j.lo, xrefs: 004031F7
Bc@, xrefs: 00403538
Launcher:%s, xrefs: 00404069
--l4j-debug, xrefs: 00403189
p@, xrefs: 00404312
" :%s, xrefs: 004044C5
IsWow64Process, xrefs: 00403254
p@, xrefs: 004041A5
sspa, xrefs: 00404349
p@, xrefs: 00404654
Check launcher:%s %s, xrefs: 0040366D, 004038C1
CmdLine:%s %s, xrefs: 00403230
-cla, xrefs: 00404341
(n/a), xrefs: 0040365E, 004038B8
WOW64:%s, xrefs: 004032A5
p@, xrefs: 00404087
l4j., xrefs: 00403CB4
p@, xrefs: 00403FFD
p@, xrefs: 004040A8
Set var:%s = %s, xrefs: 004035B2

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Modulememset$Handlefprintf$AddressCurrentFileNameProcProcessfopenstrlenstrncpystrrchrstrstr
String ID: CmdLine:%s %s$ " :%s$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$(OK)$(n/a)$--l4j-$--l4j-debug$-Xms$-Xmx$-cla$-jar$-jar$1.7.0$:$Add classpath:%s$An error occurred while starting the application.$Args length:%d/32768 chars$Bc@$Bc@$Bundled JRE:%s$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$C:\Users\user\Desktop$Check launcher:%s %s$IsWow64Process$Launcher args:%s$Launcher:%s$Set var:%s = %s$WOW64:%s$Working dir:%s$\$``@$bin\java.exe$bin\javaw.exe$ini$j.lo$l4j.$nch4$sspa$th "$true$yes$~`@
API String ID: 2968499522-3589992203
Opcode ID: 1f20b5c9895d9af463517c6fa9c024e1b337b39d992afbb1f21ae2ed438d1340
Instruction ID: 0e89a22367f5d3f2eae708a14e8bb05f6e03d73e7b0ab72636a6b4786490bd8a
Opcode Fuzzy Hash: 1f20b5c9895d9af463517c6fa9c024e1b337b39d992afbb1f21ae2ed438d1340
Instruction Fuzzy Hash: CAD251B19087048BD714AF25C54026ABBE5EFC4304F05C9BFE5C8A7391DB7C9989DB8A

Function 004013B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 332
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004030C0: memset.MSVCRT ref: 004030EE
Part of subcall function 004030C0: GetModuleHandleA.KERNEL32(?,004013C7), ref: 004030FA

strstr.MSVCRT ref: 0040142A
CreateWindowExA.USER32 ref: 004014A7
strstr.MSVCRT ref: 0040150F
LoadImageA.USER32 ref: 0040155E

Part of subcall function 00401BF0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401BF6
Part of subcall function 00401BF0: MessageBoxA.USER32 ref: 00401C32
Part of subcall function 00401BF0: ShellExecuteA.SHELL32 ref: 00401C7E

memset.MSVCRT ref: 004017E1
ShowWindow.USER32 ref: 00401808
SetForegroundWindow.USER32 ref: 00401813

Strings

--l4j-no-splash-err, xrefs: 00401506
Exit code:%d, xrefs: 00401754
--l4j-dont-wait, xrefs: 00401421
--l4j-no-splash, xrefs: 00401719
STATIC, xrefs: 00401487

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Window$memsetstrstr$CreateErrorExecuteForegroundHandleImageLastLoadMessageModuleShellShow
String ID: --l4j-dont-wait$--l4j-no-splash$--l4j-no-splash-err$Exit code:%d$STATIC
API String ID: 1172715904-121186343
Opcode ID: b7e873c6563f926a30741e0d117d4a65a1acbb56b3432b0c167deef810c33fa7
Instruction ID: 22f332a72cef92a8da5d6acb595563ebd0f99b3e0e1198dea9edd092bcf45b6f
Opcode Fuzzy Hash: b7e873c6563f926a30741e0d117d4a65a1acbb56b3432b0c167deef810c33fa7
Instruction Fuzzy Hash: 6FD101B19083018BD714FF2AD54131EBAE5BFC4344F01C93FE989A73A1DB7899459B8A

Function 004013E9 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 205
stringwindowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401EC0: FindResourceExA.KERNEL32 ref: 00401EFB
Part of subcall function 00401EC0: LoadResource.KERNEL32 ref: 00401F14
Part of subcall function 00401EC0: LockResource.KERNEL32 ref: 00401F23

strstr.MSVCRT ref: 0040142A
CreateWindowExA.USER32 ref: 004014A7
strstr.MSVCRT ref: 0040150F
LoadImageA.USER32 ref: 0040155E
SendMessageA.USER32 ref: 0040158F
GetWindowRect.USER32 ref: 004015A4
GetSystemMetrics.USER32 ref: 004015B3
GetSystemMetrics.USER32 ref: 004015DC
SetWindowPos.USER32 ref: 0040162B
ShowWindow.USER32 ref: 00401643
UpdateWindow.USER32 ref: 00401654
SetTimer.USER32 ref: 0040167F

Part of subcall function 004047A0: memset.MSVCRT ref: 004047DE
Part of subcall function 004047A0: strcat.MSVCRT ref: 0040480B
Part of subcall function 004047A0: strlen.MSVCRT ref: 00404813
Part of subcall function 004047A0: strcat.MSVCRT ref: 0040482F
Part of subcall function 004047A0: CreateProcessA.KERNEL32 ref: 00404875

GetMessageA.USER32 ref: 004016EC
strstr.MSVCRT ref: 00401722

Strings

--l4j-no-splash-err, xrefs: 00401506
--l4j-dont-wait, xrefs: 00401421
STATIC, xrefs: 00401487

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Window$Resourcestrstr$CreateLoadMessageMetricsSystemstrcat$FindImageLockProcessRectSendShowTimerUpdatememsetstrlen
String ID: --l4j-dont-wait$--l4j-no-splash-err$STATIC
API String ID: 4182365790-3920415740
Opcode ID: d398302fcecea8767c2f4d14e06c24a15f3e1a15badd60b91015d221b8449cc4
Instruction ID: ee7b831562b9b24d1f16b922444e8b63d9d8e08211f115b699755232a1a447d7
Opcode Fuzzy Hash: d398302fcecea8767c2f4d14e06c24a15f3e1a15badd60b91015d221b8449cc4
Instruction Fuzzy Hash: 338103B1A083018FD714EF7AD94131EBBE1BFC4344F05893EE988A7391DB7899458B86

Function 00401150 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
__getmainargs.MSVCRT ref: 0040119A
_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 3549981cb67ff38a295ae9781b7f217a27204a441156aad90a8880d90c2b952a
Instruction ID: fab3366932fbaa3ebb4d58be2606cf2eda9a25db2a2b1f6ef0ea82b631d7fdb2
Opcode Fuzzy Hash: 3549981cb67ff38a295ae9781b7f217a27204a441156aad90a8880d90c2b952a
Instruction Fuzzy Hash: 11211DB49043049FC304EF65E58151E7BF1BF88354F408A7EE694A77A5D778A880CF9A

Function 0040311C Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 184stringfilelibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403143
GetModuleFileNameA.KERNEL32(004013C7), ref: 00403159
strrchr.MSVCRT ref: 00403175
strstr.MSVCRT ref: 00403198
memset.MSVCRT ref: 004031C2
strncpy.MSVCRT ref: 004031DE
strlen.MSVCRT ref: 004031E6
fopen.MSVCRT ref: 00403212
fprintf.MSVCRT ref: 00403240
GetModuleHandleA.KERNEL32 ref: 0040324C
GetProcAddress.KERNEL32 ref: 00403260
GetCurrentProcess.KERNEL32 ref: 0040326E
fprintf.MSVCRT ref: 004032B1
CreateMutexA.KERNEL32 ref: 00403353
GetLastError.KERNEL32 ref: 0040335B
memset.MSVCRT ref: 00403388
GetCurrentDirectoryA.KERNEL32 ref: 00403398
strcpy.MSVCRT ref: 0040344E
strlen.MSVCRT ref: 00403456
memset.MSVCRT ref: 0040347F
GetEnvironmentVariableA.KERNEL32 ref: 00403498
strlen.MSVCRT ref: 004034A5
strlen.MSVCRT ref: 004034BB
strcat.MSVCRT ref: 004034D4
SetEnvironmentVariableA.KERNEL32 ref: 004034E4
memset.MSVCRT ref: 0040350C
SetEnvironmentVariableA.KERNEL32 ref: 00403541
strtok.MSVCRT ref: 00403554
strchr.MSVCRT ref: 00403575
fprintf.MSVCRT ref: 004035C2
memset.MSVCRT ref: 004035E4
strcpy.MSVCRT ref: 00403637
FindResourceExA.KERNEL32 ref: 0040382E
LoadResource.KERNEL32 ref: 0040384B
LockResource.KERNEL32 ref: 0040385A
atoi.MSVCRT ref: 00403879
fprintf.MSVCRT ref: 004038D7

Part of subcall function 00401E10: FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
Part of subcall function 00401E10: LoadResource.KERNEL32 ref: 00401E55
Part of subcall function 00401E10: LockResource.KERNEL32 ref: 00401E64

Strings

IsWow64Process, xrefs: 00403254
WOW64:%s, xrefs: 004032A5
~`@, xrefs: 0040329C
``@, xrefs: 004031F2
j.lo, xrefs: 004031F7
C:\Users\user\Desktop, xrefs: 0040337C
yes, xrefs: 00403293
1.7.0, xrefs: 004033ED
nch4, xrefs: 004031BA
An error occurred while starting the application., xrefs: 004032E7, 0040340A
CmdLine:%s %s, xrefs: 00403230
--l4j-debug, xrefs: 00403189

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resourcememset$fprintfstrlen$EnvironmentVariable$CurrentFindLoadLockModulestrcpy$AddressCreateDirectoryErrorFileHandleLastMutexNameProcProcessatoifopenstrcatstrchrstrncpystrrchrstrstrstrtok
String ID: CmdLine:%s %s$--l4j-debug$1.7.0$An error occurred while starting the application.$C:\Users\user\Desktop$IsWow64Process$WOW64:%s$``@$j.lo$nch4$yes$~`@
API String ID: 276419104-4214590570
Opcode ID: 2a3f9d9becd6b63c6195d3f3105f1d5613062485fea006847c855bd2f4b45a57
Instruction ID: f0a9dd12e9f155100ecc80547f8524881e04b64e39f325f861530ddbe7d78783
Opcode Fuzzy Hash: 2a3f9d9becd6b63c6195d3f3105f1d5613062485fea006847c855bd2f4b45a57
Instruction Fuzzy Hash: CE811CB09087009BD714AF25C58025EBAE5FFC4744F01C87FE9C8AB391DB7899859F8A

Function 00402280 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 107
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004022C9
RegEnumKeyExA.ADVAPI32 ref: 0040232F
strcmp.MSVCRT ref: 0040234B
strcmp.MSVCRT ref: 0040236D
strcpy.MSVCRT ref: 00402385
strcpy.MSVCRT ref: 00402398
strlen.MSVCRT ref: 004023A4
strcat.MSVCRT ref: 004023C9
fprintf.MSVCRT ref: 004023FC
fprintf.MSVCRT ref: 0040241D

Strings

SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381, xrefs: 0040238A, 0040239D, 004023C2, 004023EA
Match:%s, xrefs: 004023EF
Ignore:%s\%s, xrefs: 0040240D
1.8.0_381, xrefs: 00402364, 0040237E
1.7.0, xrefs: 00402342

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: fprintfstrcmpstrcpy$Enummemsetstrcatstrlen
String ID: 1.7.0$1.8.0_381$Ignore:%s\%s$Match:%s$SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381
API String ID: 2366812193-779923612
Opcode ID: feb0feb41c432621510d2774921ed4ae6fb30bd5dcd4c6b6128fc8dc5ae5dabe
Instruction ID: 9ab0c8db1ba71b2b6d2ba768174804a11d38db5b54a87c79ea0cb8f479a381c0
Opcode Fuzzy Hash: feb0feb41c432621510d2774921ed4ae6fb30bd5dcd4c6b6128fc8dc5ae5dabe
Instruction Fuzzy Hash: AC411DF0A093049FD754AF69C58065ABBE4FF88314F41C87FEA88A7381D77889459F4A

Function 004047A0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 106
stringprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004047DE
strcat.MSVCRT ref: 0040480B
strlen.MSVCRT ref: 00404813
strcat.MSVCRT ref: 0040482F
CreateProcessA.KERNEL32 ref: 00404875
WaitForSingleObject.KERNEL32(?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048B2
GetExitCodeProcess.KERNEL32 ref: 004048CD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048E8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048F9
fclose.MSVCRT ref: 0040490D

Strings

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004047CD
Exit code:%d, xrefs: 00404920
p@, xrefs: 0040481E
D, xrefs: 00404804

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseHandleProcessstrcat$CodeCreateExitObjectSingleWaitfclosememsetstrlen
String ID: p@$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$D$Exit code:%d
API String ID: 1835003254-3076985505
Opcode ID: 3242635cd407cc207b4e9632af2587f9fe911d2d8e26333d3a4061cd7df8f18c
Instruction ID: 5caefe9559b27fe27b5d30c0e67c063fa4c1d1b371c170d15aebd52dad6435f1
Opcode Fuzzy Hash: 3242635cd407cc207b4e9632af2587f9fe911d2d8e26333d3a4061cd7df8f18c
Instruction Fuzzy Hash: BB411FB19087048FD710EF69D58111EBBE1BFC4314F01C93EE988A7391DB389959CB9A

Function 00402640 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381, xrefs: 00402783
JavaHome, xrefs: 004027D6
jre, xrefs: 00402841

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseOpen$fprintffwrite
String ID: JavaHome$SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381$jre
API String ID: 2632948728-210039947
Opcode ID: 9364065cee4006aa1e248f2a8bc137236dbc144057ed49c4486b6edb3bc99a87
Instruction ID: 13784bda21131abe29e605e60e8874ea15ce2e043269139803be6fc73a734c89
Opcode Fuzzy Hash: 9364065cee4006aa1e248f2a8bc137236dbc144057ed49c4486b6edb3bc99a87
Instruction Fuzzy Hash: F9516CB59083158BD714AF25C64425ABBE0FF80304F41C97FE9883B3C2C7BD99458B8A

Function 00402430 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 102
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00402715), ref: 00402485
fprintf.MSVCRT ref: 004024B5
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00402715), ref: 004024EE
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00402715), ref: 0040251F
fwrite.MSVCRT ref: 0040255E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00402715), ref: 00402581
fprintf.MSVCRT ref: 004025A6

Strings

64-bit search:%s..., xrefs: 004024A6
32-bit search:%s..., xrefs: 0040259A

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseOpenfprintf$fwrite
String ID: 32-bit search:%s...$64-bit search:%s...
API String ID: 2131660067-1681012534
Opcode ID: c9c749f2187168bffb8da3167b872fe2273aff8a064b781ea05361dbc82f9642
Instruction ID: db78835e4e37dc56512bf58087c2aef207271a2ad5982ab85f3d843889212adc
Opcode Fuzzy Hash: c9c749f2187168bffb8da3167b872fe2273aff8a064b781ea05361dbc82f9642
Instruction Fuzzy Hash: 6741FBB09083159BC700EF65D68525EFBF4FF88304F11887EE888A7391D778E9458B46

Function 0040124A Relevance: 10.5, APIs: 7, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241
_setmode.MSVCRT ref: 00401256

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExitProcess__p__environ__p__fmode_cexit
String ID:
API String ID: 2747451157-0
Opcode ID: 612ea18759bad0b7cbd0a5ec3d2df94d679dbe7011e7526947487d00c96e5d27
Instruction ID: d94ddfb0904ed1d1b1fcd9f17775da174976b76cb98335a262b590a7c617f90a
Opcode Fuzzy Hash: 612ea18759bad0b7cbd0a5ec3d2df94d679dbe7011e7526947487d00c96e5d27
Instruction Fuzzy Hash: CF11E8B4604700DFC304EF65E5C541A77B1BFC8314B108A7EE694A77A6CB78A880CB89

Function 00401E10 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
LoadResource.KERNEL32 ref: 00401E55
LockResource.KERNEL32 ref: 00401E64
SetLastError.KERNEL32 ref: 00401E9D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID:
API String ID: 1074440638-0
Opcode ID: 5656401f9e567967a8485652ef1563bf0e9ef1944012dd97e3ad28967893910f
Instruction ID: f588b214a1d680624203c40b2ff752b88374fd5a224907c8dedae4407861157b
Opcode Fuzzy Hash: 5656401f9e567967a8485652ef1563bf0e9ef1944012dd97e3ad28967893910f
Instruction Fuzzy Hash: E4114FB16047019ADB00AB39C54175BBBE1BB84344F01853AED85A7391D638E905CBD6

Function 00404940 Relevance: 4.6, APIs: 3, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00404959
GetStartupInfoA.KERNEL32 ref: 00404966
GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: caeae535246a066ec4027968bdff7b90be6b14e88b81f7980858a74c74548f5b
Instruction ID: a5db5900d75afb6c5168a722f043656c093b3c7bcdd2ff3413d71d09629adc29
Opcode Fuzzy Hash: caeae535246a066ec4027968bdff7b90be6b14e88b81f7980858a74c74548f5b
Instruction Fuzzy Hash: E2214CF67047054BDB14A67694E23ABBBD77FC0344F89813AC781322C3E23C5A91565A

Function 004049CC Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 640ac14f03c0242051221d45c1bfb32813a6530bddfb4f1dd95e636b1bdeabfb
Instruction ID: 5d636c514429e280118d9dbd7938b1e1d94385514683ffc3c512b9d4b85b8e02
Opcode Fuzzy Hash: 640ac14f03c0242051221d45c1bfb32813a6530bddfb4f1dd95e636b1bdeabfb
Instruction Fuzzy Hash: E5F0F4F1A087054BDB149B39919139BBBE2AF80344F44C43EDA86332C2E23C59918E06

Function 004049FE Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: be7efde4b0b02bdb2840ff36021931a74c2a51f0cb252b5f7cb9762ef76da80f
Instruction ID: 25b03b7247f52adc190129cc9a2441f77ae864ffa51203875fe0df8adb52ff07
Opcode Fuzzy Hash: be7efde4b0b02bdb2840ff36021931a74c2a51f0cb252b5f7cb9762ef76da80f
Instruction Fuzzy Hash: 91F0A0B2A083544ADB04AF7AC18136EFFE1AF84398F44C46DDA84226D2D27C85408F56

Function 00401290 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0040129D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119A
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D5
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FB
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401200
Part of subcall function 00401150: __p__environ.MSVCRT ref: 00401215
Part of subcall function 00401150: _cexit.MSVCRT ref: 00401239
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode__set_app_type_cexit
String ID:
API String ID: 250851222-0
Opcode ID: 07d231db7de6fe80658fabe20cc0a2b477427057892decb2133d087f286a5da2
Instruction ID: ee6e0f434122d3ee92d33c208706bcb836196eff62b72ac1d1d53b2e3b1dd9b5
Opcode Fuzzy Hash: 07d231db7de6fe80658fabe20cc0a2b477427057892decb2133d087f286a5da2
Instruction Fuzzy Hash: D8C09B3444521497C3103BB5DC0E359BBE86B05301F51443DD5C567261D7743C454796

Non-executed Functions

Function 00402A30 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 167
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 00402A6C
strchr.MSVCRT ref: 00402A8A
strncat.MSVCRT ref: 00402AAF
strncat.MSVCRT ref: 00402ADA
strlen.MSVCRT ref: 00402AF0
strstr.MSVCRT ref: 00402B65
GetEnvironmentVariableA.KERNEL32 ref: 00402B94
strcat.MSVCRT(?,?,00403609), ref: 00402BDD
fprintf.MSVCRT ref: 00402C19
strncat.MSVCRT ref: 00402C37
strcat.MSVCRT ref: 00402C4E
GetCurrentDirectoryA.KERNEL32 ref: 00402C66
strcat.MSVCRT ref: 00402C82
strcat.MSVCRT(?,00008000,?,?,00403609), ref: 00402CB6

Strings

PWD, xrefs: 00402B25
EXEFILE, xrefs: 00402B0C
EXEDIR, xrefs: 00402AE2
HKEY, xrefs: 00402B53
Substitute:%s = %s, xrefs: 00402C0C
C:\Users\user\Desktop, xrefs: 00402C76
OLDPWD, xrefs: 00402B3E

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strcat$strncat$strchr$CurrentDirectoryEnvironmentVariablefprintfstrlenstrstr
String ID: C:\Users\user\Desktop$EXEDIR$EXEFILE$HKEY$OLDPWD$PWD$Substitute:%s = %s
API String ID: 1816310627-1435958981
Opcode ID: 557825d837c7bee13b9dcc2b9774faa3785b3bb199ed70112449aa9433a5436a
Instruction ID: a3250f9e5731c696cfa46b821dc8bafca942bd9f0803d40a23b6cf00076f12fd
Opcode Fuzzy Hash: 557825d837c7bee13b9dcc2b9774faa3785b3bb199ed70112449aa9433a5436a
Instruction Fuzzy Hash: FF6140709047059BCB54EF25C98435ABBF1FF84314F01C87EE98C67381CB78A9859B96

Function 00402CD0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 197
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32 ref: 00402D1B
LoadResource.KERNEL32 ref: 00402D38
LockResource.KERNEL32 ref: 00402D47
atoi.MSVCRT ref: 00402D6F
FindResourceExA.KERNEL32 ref: 00402DAB
LoadResource.KERNEL32 ref: 00402DC8
LockResource.KERNEL32 ref: 00402DD7
atoi.MSVCRT ref: 00402DFF
strcat.MSVCRT(?), ref: 00402E95
strlen.MSVCRT ref: 00402E9D
_itoa.MSVCRT ref: 00402EB4
strlen.MSVCRT ref: 00402EBC
fprintf.MSVCRT ref: 00402F11
fprintf.MSVCRT ref: 00402F34
SetLastError.KERNEL32 ref: 00402F4B
SetLastError.KERNEL32 ref: 00402F5F

Strings

Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB, xrefs: 00402EF5
Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB, xrefs: 00402F23
-Xms, xrefs: 00402CD5
-Xmx, xrefs: 00402CDC

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLockatoifprintfstrlen$_itoastrcat
String ID: -Xms$-Xmx$Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB$Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB
API String ID: 636361558-2330190027
Opcode ID: 49bac7fe6f19ca0f5bd07a777ba95da00ba2692b1f2fcb73d42c15d88026703e
Instruction ID: 9aecac28fc5dbd291391d4754e14ca6bb2a3230fcdd307f80071577cc15113ea
Opcode Fuzzy Hash: 49bac7fe6f19ca0f5bd07a777ba95da00ba2692b1f2fcb73d42c15d88026703e
Instruction Fuzzy Hash: E87160B19083158BDB14EF29D58526EBBF1BFC8344F01843FE988AB391D7789805DB96

Function 00402060 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 118stringregistryCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0040207D
strstr.MSVCRT ref: 00402097
strstr.MSVCRT ref: 004020B1
strstr.MSVCRT ref: 004020CB
strstr.MSVCRT ref: 004020E5
strchr.MSVCRT ref: 00402104
strrchr.MSVCRT ref: 00402118
RegOpenKeyExA.ADVAPI32 ref: 00402152
RegQueryValueExA.ADVAPI32 ref: 00402183
RegCloseKey.ADVAPI32 ref: 0040219C
RegOpenKeyExA.ADVAPI32 ref: 004021D0

Strings

HKEY_CURRENT_CONFIG, xrefs: 004020D7
HKEY, xrefs: 00402068
HKEY_CLASSES_ROOT, xrefs: 00402061
HKEY_USERS, xrefs: 004020BD
HKEY_CURRENT_USER, xrefs: 00402089
HKEY_LOCAL_MACHINE, xrefs: 004020A3

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strstr$Open$CloseQueryValuestrchrstrrchr
String ID: HKEY$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 356245303-4236897492
Opcode ID: 5c2711ff94cca963458cf507547e09b59df7b2f0a65b0f2675fb1cf67cf2534b
Instruction ID: 7b57610d86410dffa4a0aa1252a1797adbc7715624c0aad137216de424c346f3
Opcode Fuzzy Hash: 5c2711ff94cca963458cf507547e09b59df7b2f0a65b0f2675fb1cf67cf2534b
Instruction Fuzzy Hash: B44140B19083119FDB00EF69D58555EFBE0BF84314F05C83FEA98A7381D77989489B86

Function 00401BF0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 134windowstringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401BF6
MessageBoxA.USER32 ref: 00401C32
ShellExecuteA.SHELL32 ref: 00401C7E
printf.MSVCRT ref: 00401CAA
fclose.MSVCRT ref: 00401CB4
FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401CED
strcat.MSVCRT ref: 00401D63
printf.MSVCRT ref: 00401D8B
LocalFree.KERNEL32 ref: 00401D96

Strings

Error:%s, xrefs: 00401DA6
An error occurred while starting the application., xrefs: 00401C25, 00401C98, 00401D03, 00401D42, 00401D58, 00401D79, 00401DF1
Open URL:%s, xrefs: 00401DC8
open, xrefs: 00401C6D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Messageprintf$ErrorExecuteFormatFreeLastLocalShellfclosestrcat
String ID: An error occurred while starting the application.$Error:%s$Open URL:%s$open
API String ID: 519069059-3584283646
Opcode ID: d50ecb3a0fe696158464c957faeb54865f91f7cff6ca1c14cdd2f225c6ce74fd
Instruction ID: 5a562d4ed0a2dbc2a1e4330f613c05cbce52b9a6d063ec7aa8dcb6c58c2de855
Opcode Fuzzy Hash: d50ecb3a0fe696158464c957faeb54865f91f7cff6ca1c14cdd2f225c6ce74fd
Instruction Fuzzy Hash: 04511AB0A087009BD358EF69D55121BBAE1EFC4304F10CC3FA589A77A4D73DD9459B8A

Function 00402950 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 58stringCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402996
strcpy.MSVCRT ref: 004029B3
strlen.MSVCRT ref: 004029C5
strcat.MSVCRT ref: 004029E3
_stat.MSVCRT ref: 004029F6
strlen.MSVCRT ref: 00402A08

Strings

(n/a), xrefs: 00402977
bin\java.exe, xrefs: 004029D7
(OK), xrefs: 00402970
Check launcher:%s %s, xrefs: 00402980
bin\javaw.exe, xrefs: 00402A1A

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strlen$_statfprintfstrcatstrcpy
String ID: (OK)$(n/a)$Check launcher:%s %s$bin\java.exe$bin\javaw.exe
API String ID: 882030775-291028976
Opcode ID: 3a737aaa2f9c364d49fc00a44d18b990e604c09d1433cb05d02c114c702a0f6e
Instruction ID: 8018404b5ef50dabb5b93d2653235a7c06d24b677d78717b0f5c7ccaf4d26fd7
Opcode Fuzzy Hash: 3a737aaa2f9c364d49fc00a44d18b990e604c09d1433cb05d02c114c702a0f6e
Instruction Fuzzy Hash: 2C1145B0A083449FD720AF6995C566ABAE0BF84304F05C47FA589A73D1DB7C88449B4A

Function 00401AFC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401B0E
GetProcAddress.KERNEL32 ref: 00401B22
GetCurrentProcess.KERNEL32 ref: 00401B30
fprintf.MSVCRT ref: 00401B73

Strings

IsWow64Process, xrefs: 00401B16
WOW64:%s, xrefs: 00401B67
yes, xrefs: 00401B55
~`@, xrefs: 00401B5E

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes$~`@
API String ID: 24026888-71265849
Opcode ID: 51305618214c0ba30116f8fc18af47c9d8f331261b948467b54d85ac15f00ac4
Instruction ID: 11b031cada2c8f52232e6b9cc39170e82d59abd8a686cc32ef86a0f2d0e1404c
Opcode Fuzzy Hash: 51305618214c0ba30116f8fc18af47c9d8f331261b948467b54d85ac15f00ac4
Instruction Fuzzy Hash: D601FBB0A043049BCB10FF75D68551A7AF4AF84344F01C43EAA89BB795E778E8158B9A

Function 00401B00 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401B0E
GetProcAddress.KERNEL32 ref: 00401B22
GetCurrentProcess.KERNEL32 ref: 00401B30
fprintf.MSVCRT ref: 00401B73

Strings

IsWow64Process, xrefs: 00401B16
WOW64:%s, xrefs: 00401B67
yes, xrefs: 00401B55
~`@, xrefs: 00401B5E

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes$~`@
API String ID: 24026888-71265849
Opcode ID: 4888365b0b4b81b55560ce55fcae3362c7a4aa79adf2c55a673206aa49c2d4ca
Instruction ID: d525f3c9823b811787ccd3d125d57a95285788dfaaa60455273fc0be7c930dab
Opcode Fuzzy Hash: 4888365b0b4b81b55560ce55fcae3362c7a4aa79adf2c55a673206aa49c2d4ca
Instruction Fuzzy Hash: ABF031B0A043048BC700FF75D68551A7AF4AF84344F01C43EEA85BB7D5E778E814879A

Function 00401A60 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 33stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401A82
strncpy.MSVCRT ref: 00401A98
strlen.MSVCRT ref: 00401AA0
fopen.MSVCRT ref: 00401AD1

Strings

nch4, xrefs: 00401AAC
``@, xrefs: 00401AC5
j.lo, xrefs: 00401AB1

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: fopenmemsetstrlenstrncpy
String ID: ``@$j.lo$nch4
API String ID: 80595551-9945926
Opcode ID: 9a4ff01140eb6cd6d2ff592d0c9a1b43f0a674710d240b7d889367cb50cbc086
Instruction ID: 1e0e73c0bc485388541f9261c06b4dd11082136fe696d302e2fbee76c2dd3950
Opcode Fuzzy Hash: 9a4ff01140eb6cd6d2ff592d0c9a1b43f0a674710d240b7d889367cb50cbc086
Instruction Fuzzy Hash: 6B01F6F0D083049BC724AF29D4C155DBBE0FF84308F42C83EB99C9B352DA3888949B96

Function 00401930 Relevance: 10.6, APIs: 7, Instructions: 72timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401972
KillTimer.USER32 ref: 00401998
PostQuitMessage.USER32 ref: 004019A7
ShowWindow.USER32 ref: 004019E7
KillTimer.USER32 ref: 00401A1A
PostQuitMessage.USER32 ref: 00401A2E
EnumWindows.USER32 ref: 00401A4D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: KillMessagePostQuitTimer$CodeEnumExitProcessShowWindowWindows
String ID:
API String ID: 1905518172-0
Opcode ID: 908e1c4a2d6816fdb463079a13a016f6fa06e961dc5782ddf8e03a78c551d5c2
Instruction ID: 2407081703d323812a7a2ee4af166e89deffda79c1e67c6e6d523c687404f7b2
Opcode Fuzzy Hash: 908e1c4a2d6816fdb463079a13a016f6fa06e961dc5782ddf8e03a78c551d5c2
Instruction Fuzzy Hash: 782162B06082058BD314FF39D65131B36E1BBC0384F00893EE985B73A5DB38D848DB9A

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 0d913dcc96c4dc2ce39cf1c73b3c4cd3388d7077edd27571fed9032662073fd7
Instruction ID: 026972816123a001b062272259e12c6676799cf41c40ad00ae128651dbc386b1
Opcode Fuzzy Hash: 0d913dcc96c4dc2ce39cf1c73b3c4cd3388d7077edd27571fed9032662073fd7
Instruction Fuzzy Hash: FF3121B0A082409BD724AF69C58032EB6A0BF89314F15897FD9C5E77E1C67E8DC0975A

Function 00401F95 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 00401FDA
LoadResource.KERNEL32 ref: 00401FF3
LockResource.KERNEL32 ref: 00402002
atoi.MSVCRT ref: 0040202F
SetLastError.KERNEL32 ref: 00402040
atoi.MSVCRT ref: 0040204B

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$atoi$ErrorFindLastLoadLock
String ID:
API String ID: 3704303549-0
Opcode ID: 8917aa49ca170ea9424a4871177909678324a0128281268087337ba5d4e2214c
Instruction ID: d2e30d868b6ce554d07eddf99e8fb6c9642cdc6314cd9da99df76be242991cc3
Opcode Fuzzy Hash: 8917aa49ca170ea9424a4871177909678324a0128281268087337ba5d4e2214c
Instruction Fuzzy Hash: 5B117FB15047058BDB10BF39D54136EBBE1BFC4348F06853EDA88A7291D678E906CB86

Function 00402FF9 Relevance: 9.1, APIs: 6, Instructions: 54stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403036
GetEnvironmentVariableA.KERNEL32 ref: 0040304F
strlen.MSVCRT ref: 0040305C
strlen.MSVCRT ref: 00403079
strcat.MSVCRT ref: 0040308B
SetEnvironmentVariableA.KERNEL32 ref: 0040309B

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: EnvironmentVariablestrlen$memsetstrcat
String ID:
API String ID: 2108680700-0
Opcode ID: 1aeff4ed8d99c1ae33423b22697d7e36fe73b048e479dcd255a7cf66a70f4411
Instruction ID: 86b5df9b3431fb8133a4f6ed8904d7532b204288b27cc5577f69cc4901c0064d
Opcode Fuzzy Hash: 1aeff4ed8d99c1ae33423b22697d7e36fe73b048e479dcd255a7cf66a70f4411
Instruction Fuzzy Hash: 6F1126B1D086089BCB00BFA9C04005DFBF5EF88314F1284BEE988A7351DB386A419B86

Function 004028A0 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004028B6
strcat.MSVCRT ref: 004028D4
strlen.MSVCRT ref: 004028E3
strcat.MSVCRT ref: 00402901

Strings

bin\java.exe, xrefs: 004028CB
bin\javaw.exe, xrefs: 004028F8

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strcatstrlen
String ID: bin\java.exe$bin\javaw.exe
API String ID: 1179760717-2770878578
Opcode ID: 854bfbc186050e28c01aca1e52af11a5c6d2265732dea4351e5e53cdbfa1f743
Instruction ID: c625f8ff6eb4937acacc3d066b804341fc1bdd91dfaabe361e5825c854feadc3
Opcode Fuzzy Hash: 854bfbc186050e28c01aca1e52af11a5c6d2265732dea4351e5e53cdbfa1f743
Instruction Fuzzy Hash: 6AF0C8B1C083409FD7217F65A8C461A7BD0AF40304F06847ED1481B393DB798454975A

Function 00401EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 00401EFB
LoadResource.KERNEL32 ref: 00401F14
LockResource.KERNEL32 ref: 00401F23
SetLastError.KERNEL32 ref: 00401F77

Strings

true, xrefs: 00401F4F, 00401F72

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: true
API String ID: 1074440638-4261170317
Opcode ID: fa88095351f1cf649c4e0f59975f4c8608c77ca3866356f65f7bb502d8a741c9
Instruction ID: 720aba9a36caa5c46db755dcfa968833f6afea8c066c512ca53f753ba12c794b
Opcode Fuzzy Hash: fa88095351f1cf649c4e0f59975f4c8608c77ca3866356f65f7bb502d8a741c9
Instruction Fuzzy Hash: F72108B2A043155ADB10AB39E94036ABBE5FBC0350F01857FEE84A3380E7399619C796

Function 00401CBC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401CED
strcat.MSVCRT ref: 00401D63
printf.MSVCRT ref: 00401D8B
LocalFree.KERNEL32 ref: 00401D96
fprintf.MSVCRT ref: 00401DB6

Strings

An error occurred while starting the application., xrefs: 00401D03, 00401D42, 00401D58, 00401D79

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: FormatFreeLocalMessagefprintfprintfstrcat
String ID: An error occurred while starting the application.
API String ID: 3558087145-2110520379
Opcode ID: 0309dab1ae88623b91bd0ca979ed66dc958a41dd0f1e69883467f3f5c59eb028
Instruction ID: 897b2e7710a6a7b3f267c2baffa0a05fecd79613af50bb048a3b26d972268dd0
Opcode Fuzzy Hash: 0309dab1ae88623b91bd0ca979ed66dc958a41dd0f1e69883467f3f5c59eb028
Instruction Fuzzy Hash: 612177B1A086009BD318EF28C50021B77E2EF94304F04C83EE489A77A5D73DE9498B8A

Function 004012D0 Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012F4

Part of subcall function 00401E10: FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
Part of subcall function 00401E10: LoadResource.KERNEL32 ref: 00401E55
Part of subcall function 00401E10: LockResource.KERNEL32 ref: 00401E64

FindWindowExA.USER32 ref: 0040132A
GetWindowTextA.USER32 ref: 00401350
strstr.MSVCRT ref: 0040135F
FindWindowExA.USER32 ref: 0040137F

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: FindResourceWindow$LoadLockTextmemsetstrstr
String ID:
API String ID: 1871962372-0
Opcode ID: 68f9b9fe8e26284ea4466cd7be2fd0a699b70c6e89954b03eac0d4cd0079519f
Instruction ID: 2c743d1d3da27c05cd938fc0b836d91f0b76d418a83aa4d99297ae1c1db7ab18
Opcode Fuzzy Hash: 68f9b9fe8e26284ea4466cd7be2fd0a699b70c6e89954b03eac0d4cd0079519f
Instruction Fuzzy Hash: 7F215EB2A083005BD714BF6AD54125EFBE4EFC4354F01C83FEA88D3691E63885458B86

Function 0040489E Relevance: 7.5, APIs: 5, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048B2
GetExitCodeProcess.KERNEL32 ref: 004048CD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048E8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048F9
fclose.MSVCRT ref: 0040490D
fprintf.MSVCRT ref: 0040492D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseHandle$CodeExitObjectProcessSingleWaitfclosefprintf
String ID:
API String ID: 1585231095-0
Opcode ID: ba37172a1753ab43741c320a5b96a6367dc65ef8d5e99b837736b0aa74c96b18
Instruction ID: eb652ffc412eefeed0e718282237602074e50451812d2df90e84619bac2913a3
Opcode Fuzzy Hash: ba37172a1753ab43741c320a5b96a6367dc65ef8d5e99b837736b0aa74c96b18
Instruction Fuzzy Hash: 850121B59046048BE710FF79E98245EB7B1BBC4314F01893EDD8467691EA3498198B86

Function 00402F6C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00402F87

Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402D1B
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402D38
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402D47
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402D6F
Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402DAB
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402DC8
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402DD7
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402DFF

Part of subcall function 00402CD0: strcat.MSVCRT(?), ref: 00402E95
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402E9D
Part of subcall function 00402CD0: _itoa.MSVCRT ref: 00402EB4
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402EBC

Strings

@, xrefs: 00402F7D
-Xms, xrefs: 00402F92
-Xmx, xrefs: 00402FC6

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$FindLoadLockatoistrlen$GlobalMemoryStatus_itoastrcat
String ID: -Xms$-Xmx$@
API String ID: 3228920701-2676391021
Opcode ID: 1ee8ed68ac0c068930fb015abfc5e24d0c88b4e77e9116532bd67e932936c618
Instruction ID: 83f1aa44919a4c99108a5316738b6ebc3d89b658feaab29e7295632cd6d8abda
Opcode Fuzzy Hash: 1ee8ed68ac0c068930fb015abfc5e24d0c88b4e77e9116532bd67e932936c618
Instruction Fuzzy Hash: 890192B0A097099FDB04EF69D18055EBBF1EF88304F10C82EE589AB380D778D9459B86

Function 00402F70 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00402F87

Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402D1B
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402D38
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402D47
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402D6F
Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402DAB
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402DC8
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402DD7
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402DFF

Part of subcall function 00402CD0: strcat.MSVCRT(?), ref: 00402E95
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402E9D
Part of subcall function 00402CD0: _itoa.MSVCRT ref: 00402EB4
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402EBC

Strings

@, xrefs: 00402F7D
-Xms, xrefs: 00402F92
-Xmx, xrefs: 00402FC6

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$FindLoadLockatoistrlen$GlobalMemoryStatus_itoastrcat
String ID: -Xms$-Xmx$@
API String ID: 3228920701-2676391021
Opcode ID: 3d5dd6a6b33f9c710683a0e9a068311a38a7e96d1987d357962a79e933fbc725
Instruction ID: 6e677b9b8fabcb62c193d886980ddecd66842c0ac049963db457ddd5af3e35c3
Opcode Fuzzy Hash: 3d5dd6a6b33f9c710683a0e9a068311a38a7e96d1987d357962a79e933fbc725
Instruction Fuzzy Hash: FF0193B0A093099FD704EF69D18055EBBF1EF88304F10C83EE589AB380D778D9459B86

Function 00402945 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 29stringCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402996
strcpy.MSVCRT ref: 004029B3
strlen.MSVCRT ref: 004029C5
strcat.MSVCRT ref: 004029E3
_stat.MSVCRT ref: 004029F6

Strings

(n/a), xrefs: 00402977
(OK), xrefs: 00402970
Check launcher:%s %s, xrefs: 00402980

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _statfprintfstrcatstrcpystrlen
String ID: (OK)$(n/a)$Check launcher:%s %s
API String ID: 619758015-4217937889
Opcode ID: 8e35bfdefc2d965162e0c46b7f7b8511bec3a04771cfdae5fb4af482349bacc5
Instruction ID: fa1afa973b0b716c6a45a6db043711451785159eaff392967d20973c2505f891
Opcode Fuzzy Hash: 8e35bfdefc2d965162e0c46b7f7b8511bec3a04771cfdae5fb4af482349bacc5
Instruction Fuzzy Hash: C3F05EB0A043085FDB109E59E980766B7E4FB84314F01C47EE94CA7380D778A8548B89

Function 00401A3C Relevance: 6.0, APIs: 4, Instructions: 26timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401972
KillTimer.USER32 ref: 00401998
PostQuitMessage.USER32 ref: 004019A7
EnumWindows.USER32 ref: 00401A4D

Memory Dump Source

Source File: 00000004.00000002.2191306183.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2191280273.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191329852.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191363659.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2191385256.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CodeEnumExitKillMessagePostProcessQuitTimerWindows
String ID:
API String ID: 405088690-0
Opcode ID: 4f729626180ff1f826cd159275eaebbc8f8a505249547bf250ab6daea0a3e3ed
Instruction ID: 5dfb1647a7b45fe9d990e1e5a37a50df87d11f83294e09497229981203e6544d
Opcode Fuzzy Hash: 4f729626180ff1f826cd159275eaebbc8f8a505249547bf250ab6daea0a3e3ed
Instruction Fuzzy Hash: 83F0D0B59083008AD314BF34D6462197AE0BB84344F018A3ED9C5637D5D7789558DB9B

Analysis Process: HkppfZO2WW.exePID: 7648, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	739
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004030C0 Relevance: 302.4, APIs: 119, Strings: 53, Instructions: 1411stringfilelibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004030EE
GetModuleHandleA.KERNEL32(?,004013C7), ref: 004030FA
memset.MSVCRT ref: 00403143
GetModuleFileNameA.KERNEL32(004013C7), ref: 00403159
strrchr.MSVCRT ref: 00403175
strstr.MSVCRT ref: 00403198
memset.MSVCRT ref: 004031C2
strncpy.MSVCRT ref: 004031DE
strlen.MSVCRT ref: 004031E6
fopen.MSVCRT ref: 00403212
fprintf.MSVCRT ref: 00403240
GetModuleHandleA.KERNEL32 ref: 0040324C
GetProcAddress.KERNEL32 ref: 00403260
GetCurrentProcess.KERNEL32 ref: 0040326E
fprintf.MSVCRT ref: 004032B1

Strings

Add classpath:%s, xrefs: 004043AE
p@, xrefs: 00403FFD
Bc@, xrefs: 00403538
p@, xrefs: 00404654
j.lo, xrefs: 004031F7
p@, xrefs: 004041A5
ini, xrefs: 00403C8F
-Xmx, xrefs: 00403B99
nch4, xrefs: 004031BA
p@, xrefs: 00404312
Working dir:%s, xrefs: 004037C8
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 00403431, 00403630, 0040363E, 00403882, 00403898, 0040390E, 0040391E, 00403943, 0040396E, 00403B45, 00403B6F, 00404064, 004041C7, 00404286
th ", xrefs: 00404359
yes, xrefs: 00403293
Set var:%s = %s, xrefs: 004035B2
p@, xrefs: 0040459F
1.7.0, xrefs: 004033ED, 00403A20
p@, xrefs: 00403F3D
--l4j-debug, xrefs: 00403189
true, xrefs: 00403727, 00403EEA
p@, xrefs: 00404087
-jar, xrefs: 00403F7A
WOW64:%s, xrefs: 004032A5
Launcher args:%s, xrefs: 0040408C
C:\Users\user\Desktop, xrefs: 0040337C
p@, xrefs: 0040444B
Launcher:%s, xrefs: 00404069
bin\java.exe, xrefs: 004039A8, 00403B66, 004041FD
p@, xrefs: 00403FAE
\, xrefs: 00403616
p@, xrefs: 004040A8
IsWow64Process, xrefs: 00403254
``@, xrefs: 004031F2
sspa, xrefs: 00404349
bin\javaw.exe, xrefs: 00404254, 00404273, 004042A7
Args length:%d/32768 chars, xrefs: 004040D8
(OK), xrefs: 00403657, 004038B1
p@, xrefs: 00404688
" :%s, xrefs: 004044C5
-jar, xrefs: 00404127
l4j., xrefs: 00403CB4
~`@, xrefs: 0040329C
-cla, xrefs: 00404341
:, xrefs: 0040361F
-Xms, xrefs: 00403B7C
p@, xrefs: 0040453F
CmdLine:%s %s, xrefs: 00403230
Bundled JRE:%s, xrefs: 00403958
Check launcher:%s %s, xrefs: 0040366D, 004038C1
An error occurred while starting the application., xrefs: 004032E7, 0040340A, 004038EB, 004039DD, 004039EB, 00403A29, 00403A3E, 00403A7D
Bc@, xrefs: 00403524
(n/a), xrefs: 0040365E, 004038B8
--l4j-, xrefs: 004044EB

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Modulememset$Handlefprintf$AddressCurrentFileNameProcProcessfopenstrlenstrncpystrrchrstrstr
String ID: CmdLine:%s %s$ " :%s$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$ p@$(OK)$(n/a)$--l4j-$--l4j-debug$-Xms$-Xmx$-cla$-jar$-jar$1.7.0$:$Add classpath:%s$An error occurred while starting the application.$Args length:%d/32768 chars$Bc@$Bc@$Bundled JRE:%s$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$C:\Users\user\Desktop$Check launcher:%s %s$IsWow64Process$Launcher args:%s$Launcher:%s$Set var:%s = %s$WOW64:%s$Working dir:%s$\$``@$bin\java.exe$bin\javaw.exe$ini$j.lo$l4j.$nch4$sspa$th "$true$yes$~`@
API String ID: 2968499522-3589992203
Opcode ID: 9a828ee921b1d8379db5194f7a2a7bd7a944953bb407b50695efd66db1fd3284
Instruction ID: 0e89a22367f5d3f2eae708a14e8bb05f6e03d73e7b0ab72636a6b4786490bd8a
Opcode Fuzzy Hash: 9a828ee921b1d8379db5194f7a2a7bd7a944953bb407b50695efd66db1fd3284
Instruction Fuzzy Hash: CAD251B19087048BD714AF25C54026ABBE5EFC4304F05C9BFE5C8A7391DB7C9989DB8A

Function 004013B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 332
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004030C0: memset.MSVCRT ref: 004030EE
Part of subcall function 004030C0: GetModuleHandleA.KERNEL32(?,004013C7), ref: 004030FA

strstr.MSVCRT ref: 0040142A
CreateWindowExA.USER32 ref: 004014A7
strstr.MSVCRT ref: 0040150F
LoadImageA.USER32 ref: 0040155E

Part of subcall function 00401BF0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401BF6
Part of subcall function 00401BF0: MessageBoxA.USER32 ref: 00401C32
Part of subcall function 00401BF0: ShellExecuteA.SHELL32 ref: 00401C7E

memset.MSVCRT ref: 004017E1
ShowWindow.USER32 ref: 00401808
SetForegroundWindow.USER32 ref: 00401813

Strings

Exit code:%d, xrefs: 00401754
STATIC, xrefs: 00401487
--l4j-no-splash-err, xrefs: 00401506
--l4j-no-splash, xrefs: 00401719
--l4j-dont-wait, xrefs: 00401421

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Window$memsetstrstr$CreateErrorExecuteForegroundHandleImageLastLoadMessageModuleShellShow
String ID: --l4j-dont-wait$--l4j-no-splash$--l4j-no-splash-err$Exit code:%d$STATIC
API String ID: 1172715904-121186343
Opcode ID: b7e873c6563f926a30741e0d117d4a65a1acbb56b3432b0c167deef810c33fa7
Instruction ID: 22f332a72cef92a8da5d6acb595563ebd0f99b3e0e1198dea9edd092bcf45b6f
Opcode Fuzzy Hash: b7e873c6563f926a30741e0d117d4a65a1acbb56b3432b0c167deef810c33fa7
Instruction Fuzzy Hash: 6FD101B19083018BD714FF2AD54131EBAE5BFC4344F01C93FE989A73A1DB7899459B8A

Function 004013E9 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 205
stringwindowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401EC0: FindResourceExA.KERNEL32 ref: 00401EFB
Part of subcall function 00401EC0: LoadResource.KERNEL32 ref: 00401F14
Part of subcall function 00401EC0: LockResource.KERNEL32 ref: 00401F23

strstr.MSVCRT ref: 0040142A
CreateWindowExA.USER32 ref: 004014A7
strstr.MSVCRT ref: 0040150F
LoadImageA.USER32 ref: 0040155E
SendMessageA.USER32 ref: 0040158F
GetWindowRect.USER32 ref: 004015A4
GetSystemMetrics.USER32 ref: 004015B3
GetSystemMetrics.USER32 ref: 004015DC
SetWindowPos.USER32 ref: 0040162B
ShowWindow.USER32 ref: 00401643
UpdateWindow.USER32 ref: 00401654
SetTimer.USER32 ref: 0040167F

Part of subcall function 004047A0: memset.MSVCRT ref: 004047DE
Part of subcall function 004047A0: strcat.MSVCRT ref: 0040480B
Part of subcall function 004047A0: strlen.MSVCRT ref: 00404813
Part of subcall function 004047A0: strcat.MSVCRT ref: 0040482F
Part of subcall function 004047A0: CreateProcessA.KERNEL32 ref: 00404875

GetMessageA.USER32 ref: 004016EC
strstr.MSVCRT ref: 00401722

Strings

STATIC, xrefs: 00401487
--l4j-no-splash-err, xrefs: 00401506
--l4j-dont-wait, xrefs: 00401421

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Window$Resourcestrstr$CreateLoadMessageMetricsSystemstrcat$FindImageLockProcessRectSendShowTimerUpdatememsetstrlen
String ID: --l4j-dont-wait$--l4j-no-splash-err$STATIC
API String ID: 4182365790-3920415740
Opcode ID: d398302fcecea8767c2f4d14e06c24a15f3e1a15badd60b91015d221b8449cc4
Instruction ID: ee7b831562b9b24d1f16b922444e8b63d9d8e08211f115b699755232a1a447d7
Opcode Fuzzy Hash: d398302fcecea8767c2f4d14e06c24a15f3e1a15badd60b91015d221b8449cc4
Instruction Fuzzy Hash: 338103B1A083018FD714EF7AD94131EBBE1BFC4344F05893EE988A7391DB7899458B86

Function 00401150 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
__getmainargs.MSVCRT ref: 0040119A
_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 3549981cb67ff38a295ae9781b7f217a27204a441156aad90a8880d90c2b952a
Instruction ID: fab3366932fbaa3ebb4d58be2606cf2eda9a25db2a2b1f6ef0ea82b631d7fdb2
Opcode Fuzzy Hash: 3549981cb67ff38a295ae9781b7f217a27204a441156aad90a8880d90c2b952a
Instruction Fuzzy Hash: 11211DB49043049FC304EF65E58151E7BF1BF88354F408A7EE694A77A5D778A880CF9A

Function 0040311C Relevance: 50.9, APIs: 17, Strings: 12, Instructions: 184stringfilelibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403143
GetModuleFileNameA.KERNEL32(004013C7), ref: 00403159
strrchr.MSVCRT ref: 00403175
strstr.MSVCRT ref: 00403198
memset.MSVCRT ref: 004031C2
strncpy.MSVCRT ref: 004031DE
strlen.MSVCRT ref: 004031E6
fopen.MSVCRT ref: 00403212
fprintf.MSVCRT ref: 00403240
GetModuleHandleA.KERNEL32 ref: 0040324C
GetProcAddress.KERNEL32 ref: 00403260
GetCurrentProcess.KERNEL32 ref: 0040326E
fprintf.MSVCRT ref: 004032B1
CreateMutexA.KERNEL32 ref: 00403353
GetLastError.KERNEL32 ref: 0040335B
memset.MSVCRT ref: 00403388
GetCurrentDirectoryA.KERNEL32 ref: 00403398
strcpy.MSVCRT ref: 0040344E
strlen.MSVCRT ref: 00403456
memset.MSVCRT ref: 0040347F
GetEnvironmentVariableA.KERNEL32 ref: 00403498
strlen.MSVCRT ref: 004034A5
strlen.MSVCRT ref: 004034BB
strcat.MSVCRT ref: 004034D4
SetEnvironmentVariableA.KERNEL32 ref: 004034E4
memset.MSVCRT ref: 0040350C
SetEnvironmentVariableA.KERNEL32 ref: 00403541
strtok.MSVCRT ref: 00403554
strchr.MSVCRT ref: 00403575
fprintf.MSVCRT ref: 004035C2
memset.MSVCRT ref: 004035E4
strcpy.MSVCRT ref: 00403637
FindResourceExA.KERNEL32 ref: 0040382E
LoadResource.KERNEL32 ref: 0040384B
LockResource.KERNEL32 ref: 0040385A
atoi.MSVCRT ref: 00403879
fprintf.MSVCRT ref: 004038D7

Part of subcall function 00401E10: FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
Part of subcall function 00401E10: LoadResource.KERNEL32 ref: 00401E55
Part of subcall function 00401E10: LockResource.KERNEL32 ref: 00401E64

Strings

j.lo, xrefs: 004031F7
1.7.0, xrefs: 004033ED
C:\Users\user\Desktop, xrefs: 0040337C
IsWow64Process, xrefs: 00403254
--l4j-debug, xrefs: 00403189
``@, xrefs: 004031F2
An error occurred while starting the application., xrefs: 004032E7, 0040340A
WOW64:%s, xrefs: 004032A5
yes, xrefs: 00403293
~`@, xrefs: 0040329C
CmdLine:%s %s, xrefs: 00403230
nch4, xrefs: 004031BA

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resourcememset$fprintfstrlen$EnvironmentVariable$CurrentFindLoadLockModulestrcpy$AddressCreateDirectoryErrorFileHandleLastMutexNameProcProcessatoifopenstrcatstrchrstrncpystrrchrstrstrstrtok
String ID: CmdLine:%s %s$--l4j-debug$1.7.0$An error occurred while starting the application.$C:\Users\user\Desktop$IsWow64Process$WOW64:%s$``@$j.lo$nch4$yes$~`@
API String ID: 276419104-4214590570
Opcode ID: 2a3f9d9becd6b63c6195d3f3105f1d5613062485fea006847c855bd2f4b45a57
Instruction ID: f0a9dd12e9f155100ecc80547f8524881e04b64e39f325f861530ddbe7d78783
Opcode Fuzzy Hash: 2a3f9d9becd6b63c6195d3f3105f1d5613062485fea006847c855bd2f4b45a57
Instruction Fuzzy Hash: CE811CB09087009BD714AF25C58025EBAE5FFC4744F01C87FE9C8AB391DB7899859F8A

Function 00402280 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 107
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004022C9
RegEnumKeyExA.ADVAPI32 ref: 0040232F
strcmp.MSVCRT ref: 0040234B
strcmp.MSVCRT ref: 0040236D
strcpy.MSVCRT ref: 00402385
strcpy.MSVCRT ref: 00402398
strlen.MSVCRT ref: 004023A4
strcat.MSVCRT ref: 004023C9
fprintf.MSVCRT ref: 004023FC
fprintf.MSVCRT ref: 0040241D

Strings

Ignore:%s\%s, xrefs: 0040240D
1.7.0, xrefs: 00402342
1.8.0_381, xrefs: 00402364, 0040237E
Match:%s, xrefs: 004023EF
SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381, xrefs: 0040238A, 0040239D, 004023C2, 004023EA

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: fprintfstrcmpstrcpy$Enummemsetstrcatstrlen
String ID: 1.7.0$1.8.0_381$Ignore:%s\%s$Match:%s$SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381
API String ID: 2366812193-779923612
Opcode ID: feb0feb41c432621510d2774921ed4ae6fb30bd5dcd4c6b6128fc8dc5ae5dabe
Instruction ID: 9ab0c8db1ba71b2b6d2ba768174804a11d38db5b54a87c79ea0cb8f479a381c0
Opcode Fuzzy Hash: feb0feb41c432621510d2774921ed4ae6fb30bd5dcd4c6b6128fc8dc5ae5dabe
Instruction Fuzzy Hash: AC411DF0A093049FD754AF69C58065ABBE4FF88314F41C87FEA88A7381D77889459F4A

Function 004047A0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 106
stringprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004047DE
strcat.MSVCRT ref: 0040480B
strlen.MSVCRT ref: 00404813
strcat.MSVCRT ref: 0040482F
CreateProcessA.KERNEL32 ref: 00404875
WaitForSingleObject.KERNEL32(?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048B2
GetExitCodeProcess.KERNEL32 ref: 004048CD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048E8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048F9
fclose.MSVCRT ref: 0040490D

Strings

p@, xrefs: 0040481E
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004047CD
Exit code:%d, xrefs: 00404920
D, xrefs: 00404804

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseHandleProcessstrcat$CodeCreateExitObjectSingleWaitfclosememsetstrlen
String ID: p@$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$D$Exit code:%d
API String ID: 1835003254-3076985505
Opcode ID: 3242635cd407cc207b4e9632af2587f9fe911d2d8e26333d3a4061cd7df8f18c
Instruction ID: 5caefe9559b27fe27b5d30c0e67c063fa4c1d1b371c170d15aebd52dad6435f1
Opcode Fuzzy Hash: 3242635cd407cc207b4e9632af2587f9fe911d2d8e26333d3a4061cd7df8f18c
Instruction Fuzzy Hash: BB411FB19087048FD710EF69D58111EBBE1BFC4314F01C93EE988A7391DB389959CB9A

Function 00402640 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jre, xrefs: 00402841
JavaHome, xrefs: 004027D6
SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381, xrefs: 00402783

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseOpen$fprintffwrite
String ID: JavaHome$SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381$jre
API String ID: 2632948728-210039947
Opcode ID: 9364065cee4006aa1e248f2a8bc137236dbc144057ed49c4486b6edb3bc99a87
Instruction ID: 13784bda21131abe29e605e60e8874ea15ce2e043269139803be6fc73a734c89
Opcode Fuzzy Hash: 9364065cee4006aa1e248f2a8bc137236dbc144057ed49c4486b6edb3bc99a87
Instruction Fuzzy Hash: F9516CB59083158BD714AF25C64425ABBE0FF80304F41C97FE9883B3C2C7BD99458B8A

Function 00402430 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 102
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00402715), ref: 00402485
fprintf.MSVCRT ref: 004024B5
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00402715), ref: 004024EE
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00402715), ref: 0040251F
fwrite.MSVCRT ref: 0040255E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00402715), ref: 00402581
fprintf.MSVCRT ref: 004025A6

Strings

64-bit search:%s..., xrefs: 004024A6
32-bit search:%s..., xrefs: 0040259A

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseOpenfprintf$fwrite
String ID: 32-bit search:%s...$64-bit search:%s...
API String ID: 2131660067-1681012534
Opcode ID: c9c749f2187168bffb8da3167b872fe2273aff8a064b781ea05361dbc82f9642
Instruction ID: db78835e4e37dc56512bf58087c2aef207271a2ad5982ab85f3d843889212adc
Opcode Fuzzy Hash: c9c749f2187168bffb8da3167b872fe2273aff8a064b781ea05361dbc82f9642
Instruction Fuzzy Hash: 6741FBB09083159BC700EF65D68525EFBF4FF88304F11887EE888A7391D778E9458B46

Function 0040124A Relevance: 10.5, APIs: 7, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241
_setmode.MSVCRT ref: 00401256

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExitProcess__p__environ__p__fmode_cexit
String ID:
API String ID: 2747451157-0
Opcode ID: 612ea18759bad0b7cbd0a5ec3d2df94d679dbe7011e7526947487d00c96e5d27
Instruction ID: d94ddfb0904ed1d1b1fcd9f17775da174976b76cb98335a262b590a7c617f90a
Opcode Fuzzy Hash: 612ea18759bad0b7cbd0a5ec3d2df94d679dbe7011e7526947487d00c96e5d27
Instruction Fuzzy Hash: CF11E8B4604700DFC304EF65E5C541A77B1BFC8314B108A7EE694A77A6CB78A880CB89

Function 00401E10 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
LoadResource.KERNEL32 ref: 00401E55
LockResource.KERNEL32 ref: 00401E64
SetLastError.KERNEL32 ref: 00401E9D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID:
API String ID: 1074440638-0
Opcode ID: 5656401f9e567967a8485652ef1563bf0e9ef1944012dd97e3ad28967893910f
Instruction ID: f588b214a1d680624203c40b2ff752b88374fd5a224907c8dedae4407861157b
Opcode Fuzzy Hash: 5656401f9e567967a8485652ef1563bf0e9ef1944012dd97e3ad28967893910f
Instruction Fuzzy Hash: E4114FB16047019ADB00AB39C54175BBBE1BB84344F01853AED85A7391D638E905CBD6

Function 00404940 Relevance: 4.6, APIs: 3, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00404959
GetStartupInfoA.KERNEL32 ref: 00404966
GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: caeae535246a066ec4027968bdff7b90be6b14e88b81f7980858a74c74548f5b
Instruction ID: a5db5900d75afb6c5168a722f043656c093b3c7bcdd2ff3413d71d09629adc29
Opcode Fuzzy Hash: caeae535246a066ec4027968bdff7b90be6b14e88b81f7980858a74c74548f5b
Instruction Fuzzy Hash: E2214CF67047054BDB14A67694E23ABBBD77FC0344F89813AC781322C3E23C5A91565A

Function 004049CC Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 640ac14f03c0242051221d45c1bfb32813a6530bddfb4f1dd95e636b1bdeabfb
Instruction ID: 5d636c514429e280118d9dbd7938b1e1d94385514683ffc3c512b9d4b85b8e02
Opcode Fuzzy Hash: 640ac14f03c0242051221d45c1bfb32813a6530bddfb4f1dd95e636b1bdeabfb
Instruction Fuzzy Hash: E5F0F4F1A087054BDB149B39919139BBBE2AF80344F44C43EDA86332C2E23C59918E06

Function 004049FE Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00404A1D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: be7efde4b0b02bdb2840ff36021931a74c2a51f0cb252b5f7cb9762ef76da80f
Instruction ID: 25b03b7247f52adc190129cc9a2441f77ae864ffa51203875fe0df8adb52ff07
Opcode Fuzzy Hash: be7efde4b0b02bdb2840ff36021931a74c2a51f0cb252b5f7cb9762ef76da80f
Instruction Fuzzy Hash: 91F0A0B2A083544ADB04AF7AC18136EFFE1AF84398F44C46DDA84226D2D27C85408F56

Function 00401290 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0040129D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119A
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D5
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FB
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401200
Part of subcall function 00401150: __p__environ.MSVCRT ref: 00401215
Part of subcall function 00401150: _cexit.MSVCRT ref: 00401239
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode__set_app_type_cexit
String ID:
API String ID: 250851222-0
Opcode ID: 07d231db7de6fe80658fabe20cc0a2b477427057892decb2133d087f286a5da2
Instruction ID: ee6e0f434122d3ee92d33c208706bcb836196eff62b72ac1d1d53b2e3b1dd9b5
Opcode Fuzzy Hash: 07d231db7de6fe80658fabe20cc0a2b477427057892decb2133d087f286a5da2
Instruction Fuzzy Hash: D8C09B3444521497C3103BB5DC0E359BBE86B05301F51443DD5C567261D7743C454796

Non-executed Functions

Function 00402A30 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 167
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 00402A6C
strchr.MSVCRT ref: 00402A8A
strncat.MSVCRT ref: 00402AAF
strncat.MSVCRT ref: 00402ADA
strlen.MSVCRT ref: 00402AF0
strstr.MSVCRT ref: 00402B65
GetEnvironmentVariableA.KERNEL32 ref: 00402B94
strcat.MSVCRT(?,?,00403609), ref: 00402BDD
fprintf.MSVCRT ref: 00402C19
strncat.MSVCRT ref: 00402C37
strcat.MSVCRT ref: 00402C4E
GetCurrentDirectoryA.KERNEL32 ref: 00402C66
strcat.MSVCRT ref: 00402C82
strcat.MSVCRT(?,00008000,?,?,00403609), ref: 00402CB6

Strings

C:\Users\user\Desktop, xrefs: 00402C76
EXEFILE, xrefs: 00402B0C
HKEY, xrefs: 00402B53
Substitute:%s = %s, xrefs: 00402C0C
OLDPWD, xrefs: 00402B3E
EXEDIR, xrefs: 00402AE2
PWD, xrefs: 00402B25

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strcat$strncat$strchr$CurrentDirectoryEnvironmentVariablefprintfstrlenstrstr
String ID: C:\Users\user\Desktop$EXEDIR$EXEFILE$HKEY$OLDPWD$PWD$Substitute:%s = %s
API String ID: 1816310627-1435958981
Opcode ID: b439f3ed1e230ba17b78e6689917fc82c9a24ba0c31b8ccbea4d443833dace49
Instruction ID: a3250f9e5731c696cfa46b821dc8bafca942bd9f0803d40a23b6cf00076f12fd
Opcode Fuzzy Hash: b439f3ed1e230ba17b78e6689917fc82c9a24ba0c31b8ccbea4d443833dace49
Instruction Fuzzy Hash: FF6140709047059BCB54EF25C98435ABBF1FF84314F01C87EE98C67381CB78A9859B96

Function 00402CD0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 197
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32 ref: 00402D1B
LoadResource.KERNEL32 ref: 00402D38
LockResource.KERNEL32 ref: 00402D47
atoi.MSVCRT ref: 00402D6F
FindResourceExA.KERNEL32 ref: 00402DAB
LoadResource.KERNEL32 ref: 00402DC8
LockResource.KERNEL32 ref: 00402DD7
atoi.MSVCRT ref: 00402DFF
strcat.MSVCRT(?), ref: 00402E95
strlen.MSVCRT ref: 00402E9D
_itoa.MSVCRT ref: 00402EB4
strlen.MSVCRT ref: 00402EBC
fprintf.MSVCRT ref: 00402F11
fprintf.MSVCRT ref: 00402F34
SetLastError.KERNEL32 ref: 00402F4B
SetLastError.KERNEL32 ref: 00402F5F

Strings

Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB, xrefs: 00402F23
-Xmx, xrefs: 00402CDC
-Xms, xrefs: 00402CD5
Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB, xrefs: 00402EF5

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLockatoifprintfstrlen$_itoastrcat
String ID: -Xms$-Xmx$Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB$Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB
API String ID: 636361558-2330190027
Opcode ID: 49bac7fe6f19ca0f5bd07a777ba95da00ba2692b1f2fcb73d42c15d88026703e
Instruction ID: 9aecac28fc5dbd291391d4754e14ca6bb2a3230fcdd307f80071577cc15113ea
Opcode Fuzzy Hash: 49bac7fe6f19ca0f5bd07a777ba95da00ba2692b1f2fcb73d42c15d88026703e
Instruction Fuzzy Hash: E87160B19083158BDB14EF29D58526EBBF1BFC8344F01843FE988AB391D7789805DB96

Function 00402060 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 118stringregistryCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0040207D
strstr.MSVCRT ref: 00402097
strstr.MSVCRT ref: 004020B1
strstr.MSVCRT ref: 004020CB
strstr.MSVCRT ref: 004020E5
strchr.MSVCRT ref: 00402104
strrchr.MSVCRT ref: 00402118
RegOpenKeyExA.ADVAPI32 ref: 00402152
RegQueryValueExA.ADVAPI32 ref: 00402183
RegCloseKey.ADVAPI32 ref: 0040219C
RegOpenKeyExA.ADVAPI32 ref: 004021D0

Strings

HKEY_CURRENT_CONFIG, xrefs: 004020D7
HKEY_CLASSES_ROOT, xrefs: 00402061
HKEY_CURRENT_USER, xrefs: 00402089
HKEY, xrefs: 00402068
HKEY_USERS, xrefs: 004020BD
HKEY_LOCAL_MACHINE, xrefs: 004020A3

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strstr$Open$CloseQueryValuestrchrstrrchr
String ID: HKEY$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 356245303-4236897492
Opcode ID: 5c2711ff94cca963458cf507547e09b59df7b2f0a65b0f2675fb1cf67cf2534b
Instruction ID: 7b57610d86410dffa4a0aa1252a1797adbc7715624c0aad137216de424c346f3
Opcode Fuzzy Hash: 5c2711ff94cca963458cf507547e09b59df7b2f0a65b0f2675fb1cf67cf2534b
Instruction Fuzzy Hash: B44140B19083119FDB00EF69D58555EFBE0BF84314F05C83FEA98A7381D77989489B86

Function 00401BF0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 134windowstringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401BF6
MessageBoxA.USER32 ref: 00401C32
ShellExecuteA.SHELL32 ref: 00401C7E
printf.MSVCRT ref: 00401CAA
fclose.MSVCRT ref: 00401CB4
FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401CED
strcat.MSVCRT ref: 00401D63
printf.MSVCRT ref: 00401D8B
LocalFree.KERNEL32 ref: 00401D96

Strings

Error:%s, xrefs: 00401DA6
An error occurred while starting the application., xrefs: 00401C25, 00401C98, 00401D03, 00401D42, 00401D58, 00401D79, 00401DF1
Open URL:%s, xrefs: 00401DC8
open, xrefs: 00401C6D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Messageprintf$ErrorExecuteFormatFreeLastLocalShellfclosestrcat
String ID: An error occurred while starting the application.$Error:%s$Open URL:%s$open
API String ID: 519069059-3584283646
Opcode ID: d50ecb3a0fe696158464c957faeb54865f91f7cff6ca1c14cdd2f225c6ce74fd
Instruction ID: 5a562d4ed0a2dbc2a1e4330f613c05cbce52b9a6d063ec7aa8dcb6c58c2de855
Opcode Fuzzy Hash: d50ecb3a0fe696158464c957faeb54865f91f7cff6ca1c14cdd2f225c6ce74fd
Instruction Fuzzy Hash: 04511AB0A087009BD358EF69D55121BBAE1EFC4304F10CC3FA589A77A4D73DD9459B8A

Function 00402950 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 58stringCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402996
strcpy.MSVCRT ref: 004029B3
strlen.MSVCRT ref: 004029C5
strcat.MSVCRT ref: 004029E3
_stat.MSVCRT ref: 004029F6
strlen.MSVCRT ref: 00402A08

Strings

bin\javaw.exe, xrefs: 00402A1A
Check launcher:%s %s, xrefs: 00402980
(OK), xrefs: 00402970
(n/a), xrefs: 00402977
bin\java.exe, xrefs: 004029D7

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strlen$_statfprintfstrcatstrcpy
String ID: (OK)$(n/a)$Check launcher:%s %s$bin\java.exe$bin\javaw.exe
API String ID: 882030775-291028976
Opcode ID: 3a737aaa2f9c364d49fc00a44d18b990e604c09d1433cb05d02c114c702a0f6e
Instruction ID: 8018404b5ef50dabb5b93d2653235a7c06d24b677d78717b0f5c7ccaf4d26fd7
Opcode Fuzzy Hash: 3a737aaa2f9c364d49fc00a44d18b990e604c09d1433cb05d02c114c702a0f6e
Instruction Fuzzy Hash: 2C1145B0A083449FD720AF6995C566ABAE0BF84304F05C47FA589A73D1DB7C88449B4A

Function 00401AFC Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401B0E
GetProcAddress.KERNEL32 ref: 00401B22
GetCurrentProcess.KERNEL32 ref: 00401B30
fprintf.MSVCRT ref: 00401B73

Strings

IsWow64Process, xrefs: 00401B16
~`@, xrefs: 00401B5E
WOW64:%s, xrefs: 00401B67
yes, xrefs: 00401B55

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes$~`@
API String ID: 24026888-71265849
Opcode ID: 51305618214c0ba30116f8fc18af47c9d8f331261b948467b54d85ac15f00ac4
Instruction ID: 11b031cada2c8f52232e6b9cc39170e82d59abd8a686cc32ef86a0f2d0e1404c
Opcode Fuzzy Hash: 51305618214c0ba30116f8fc18af47c9d8f331261b948467b54d85ac15f00ac4
Instruction Fuzzy Hash: D601FBB0A043049BCB10FF75D68551A7AF4AF84344F01C43EAA89BB795E778E8158B9A

Function 00401B00 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401B0E
GetProcAddress.KERNEL32 ref: 00401B22
GetCurrentProcess.KERNEL32 ref: 00401B30
fprintf.MSVCRT ref: 00401B73

Strings

IsWow64Process, xrefs: 00401B16
~`@, xrefs: 00401B5E
WOW64:%s, xrefs: 00401B67
yes, xrefs: 00401B55

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes$~`@
API String ID: 24026888-71265849
Opcode ID: 4888365b0b4b81b55560ce55fcae3362c7a4aa79adf2c55a673206aa49c2d4ca
Instruction ID: d525f3c9823b811787ccd3d125d57a95285788dfaaa60455273fc0be7c930dab
Opcode Fuzzy Hash: 4888365b0b4b81b55560ce55fcae3362c7a4aa79adf2c55a673206aa49c2d4ca
Instruction Fuzzy Hash: ABF031B0A043048BC700FF75D68551A7AF4AF84344F01C43EEA85BB7D5E778E814879A

Function 00401A60 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 33stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401A82
strncpy.MSVCRT ref: 00401A98
strlen.MSVCRT ref: 00401AA0
fopen.MSVCRT ref: 00401AD1

Strings

``@, xrefs: 00401AC5
nch4, xrefs: 00401AAC
j.lo, xrefs: 00401AB1

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: fopenmemsetstrlenstrncpy
String ID: ``@$j.lo$nch4
API String ID: 80595551-9945926
Opcode ID: 9a4ff01140eb6cd6d2ff592d0c9a1b43f0a674710d240b7d889367cb50cbc086
Instruction ID: 1e0e73c0bc485388541f9261c06b4dd11082136fe696d302e2fbee76c2dd3950
Opcode Fuzzy Hash: 9a4ff01140eb6cd6d2ff592d0c9a1b43f0a674710d240b7d889367cb50cbc086
Instruction Fuzzy Hash: 6B01F6F0D083049BC724AF29D4C155DBBE0FF84308F42C83EB99C9B352DA3888949B96

Function 00401930 Relevance: 10.6, APIs: 7, Instructions: 72timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401972
KillTimer.USER32 ref: 00401998
PostQuitMessage.USER32 ref: 004019A7
ShowWindow.USER32 ref: 004019E7
KillTimer.USER32 ref: 00401A1A
PostQuitMessage.USER32 ref: 00401A2E
EnumWindows.USER32 ref: 00401A4D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: KillMessagePostQuitTimer$CodeEnumExitProcessShowWindowWindows
String ID:
API String ID: 1905518172-0
Opcode ID: 908e1c4a2d6816fdb463079a13a016f6fa06e961dc5782ddf8e03a78c551d5c2
Instruction ID: 2407081703d323812a7a2ee4af166e89deffda79c1e67c6e6d523c687404f7b2
Opcode Fuzzy Hash: 908e1c4a2d6816fdb463079a13a016f6fa06e961dc5782ddf8e03a78c551d5c2
Instruction Fuzzy Hash: 782162B06082058BD314FF39D65131B36E1BBC0384F00893EE985B73A5DB38D848DB9A

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 0d913dcc96c4dc2ce39cf1c73b3c4cd3388d7077edd27571fed9032662073fd7
Instruction ID: 026972816123a001b062272259e12c6676799cf41c40ad00ae128651dbc386b1
Opcode Fuzzy Hash: 0d913dcc96c4dc2ce39cf1c73b3c4cd3388d7077edd27571fed9032662073fd7
Instruction Fuzzy Hash: FF3121B0A082409BD724AF69C58032EB6A0BF89314F15897FD9C5E77E1C67E8DC0975A

Function 00401F95 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 00401FDA
LoadResource.KERNEL32 ref: 00401FF3
LockResource.KERNEL32 ref: 00402002
atoi.MSVCRT ref: 0040202F
SetLastError.KERNEL32 ref: 00402040
atoi.MSVCRT ref: 0040204B

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$atoi$ErrorFindLastLoadLock
String ID:
API String ID: 3704303549-0
Opcode ID: 8917aa49ca170ea9424a4871177909678324a0128281268087337ba5d4e2214c
Instruction ID: d2e30d868b6ce554d07eddf99e8fb6c9642cdc6314cd9da99df76be242991cc3
Opcode Fuzzy Hash: 8917aa49ca170ea9424a4871177909678324a0128281268087337ba5d4e2214c
Instruction Fuzzy Hash: 5B117FB15047058BDB10BF39D54136EBBE1BFC4348F06853EDA88A7291D678E906CB86

Function 00402FF9 Relevance: 9.1, APIs: 6, Instructions: 54stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403036
GetEnvironmentVariableA.KERNEL32 ref: 0040304F
strlen.MSVCRT ref: 0040305C
strlen.MSVCRT ref: 00403079
strcat.MSVCRT ref: 0040308B
SetEnvironmentVariableA.KERNEL32 ref: 0040309B

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: EnvironmentVariablestrlen$memsetstrcat
String ID:
API String ID: 2108680700-0
Opcode ID: 6e76fc2e4af15f8032aad6a96e1840275bcb373fe908820486f238fd04cb349d
Instruction ID: 86b5df9b3431fb8133a4f6ed8904d7532b204288b27cc5577f69cc4901c0064d
Opcode Fuzzy Hash: 6e76fc2e4af15f8032aad6a96e1840275bcb373fe908820486f238fd04cb349d
Instruction Fuzzy Hash: 6F1126B1D086089BCB00BFA9C04005DFBF5EF88314F1284BEE988A7351DB386A419B86

Function 004028A0 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004028B6
strcat.MSVCRT ref: 004028D4
strlen.MSVCRT ref: 004028E3
strcat.MSVCRT ref: 00402901

Strings

bin\javaw.exe, xrefs: 004028F8
bin\java.exe, xrefs: 004028CB

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: strcatstrlen
String ID: bin\java.exe$bin\javaw.exe
API String ID: 1179760717-2770878578
Opcode ID: 854bfbc186050e28c01aca1e52af11a5c6d2265732dea4351e5e53cdbfa1f743
Instruction ID: c625f8ff6eb4937acacc3d066b804341fc1bdd91dfaabe361e5825c854feadc3
Opcode Fuzzy Hash: 854bfbc186050e28c01aca1e52af11a5c6d2265732dea4351e5e53cdbfa1f743
Instruction Fuzzy Hash: 6AF0C8B1C083409FD7217F65A8C461A7BD0AF40304F06847ED1481B393DB798454975A

Function 00401EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 00401EFB
LoadResource.KERNEL32 ref: 00401F14
LockResource.KERNEL32 ref: 00401F23
SetLastError.KERNEL32 ref: 00401F77

Strings

true, xrefs: 00401F4F, 00401F72

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: true
API String ID: 1074440638-4261170317
Opcode ID: fa88095351f1cf649c4e0f59975f4c8608c77ca3866356f65f7bb502d8a741c9
Instruction ID: 720aba9a36caa5c46db755dcfa968833f6afea8c066c512ca53f753ba12c794b
Opcode Fuzzy Hash: fa88095351f1cf649c4e0f59975f4c8608c77ca3866356f65f7bb502d8a741c9
Instruction Fuzzy Hash: F72108B2A043155ADB10AB39E94036ABBE5FBC0350F01857FEE84A3380E7399619C796

Function 00401CBC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,?,004013DA), ref: 00401CED
strcat.MSVCRT ref: 00401D63
printf.MSVCRT ref: 00401D8B
LocalFree.KERNEL32 ref: 00401D96
fprintf.MSVCRT ref: 00401DB6

Strings

An error occurred while starting the application., xrefs: 00401D03, 00401D42, 00401D58, 00401D79

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: FormatFreeLocalMessagefprintfprintfstrcat
String ID: An error occurred while starting the application.
API String ID: 3558087145-2110520379
Opcode ID: 0309dab1ae88623b91bd0ca979ed66dc958a41dd0f1e69883467f3f5c59eb028
Instruction ID: 897b2e7710a6a7b3f267c2baffa0a05fecd79613af50bb048a3b26d972268dd0
Opcode Fuzzy Hash: 0309dab1ae88623b91bd0ca979ed66dc958a41dd0f1e69883467f3f5c59eb028
Instruction Fuzzy Hash: 612177B1A086009BD318EF28C50021B77E2EF94304F04C83EE489A77A5D73DE9498B8A

Function 004012D0 Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012F4

Part of subcall function 00401E10: FindResourceExA.KERNEL32(?,?,00405010), ref: 00401E3C
Part of subcall function 00401E10: LoadResource.KERNEL32 ref: 00401E55
Part of subcall function 00401E10: LockResource.KERNEL32 ref: 00401E64

FindWindowExA.USER32 ref: 0040132A
GetWindowTextA.USER32 ref: 00401350
strstr.MSVCRT ref: 0040135F
FindWindowExA.USER32 ref: 0040137F

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: FindResourceWindow$LoadLockTextmemsetstrstr
String ID:
API String ID: 1871962372-0
Opcode ID: 68f9b9fe8e26284ea4466cd7be2fd0a699b70c6e89954b03eac0d4cd0079519f
Instruction ID: 2c743d1d3da27c05cd938fc0b836d91f0b76d418a83aa4d99297ae1c1db7ab18
Opcode Fuzzy Hash: 68f9b9fe8e26284ea4466cd7be2fd0a699b70c6e89954b03eac0d4cd0079519f
Instruction Fuzzy Hash: 7F215EB2A083005BD714BF6AD54125EFBE4EFC4354F01C83FEA88D3691E63885458B86

Function 0040489E Relevance: 7.5, APIs: 5, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048B2
GetExitCodeProcess.KERNEL32 ref: 004048CD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048E8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,8000000E,00401930,00000001,?,0040169B), ref: 004048F9
fclose.MSVCRT ref: 0040490D
fprintf.MSVCRT ref: 0040492D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CloseHandle$CodeExitObjectProcessSingleWaitfclosefprintf
String ID:
API String ID: 1585231095-0
Opcode ID: ba37172a1753ab43741c320a5b96a6367dc65ef8d5e99b837736b0aa74c96b18
Instruction ID: eb652ffc412eefeed0e718282237602074e50451812d2df90e84619bac2913a3
Opcode Fuzzy Hash: ba37172a1753ab43741c320a5b96a6367dc65ef8d5e99b837736b0aa74c96b18
Instruction Fuzzy Hash: 850121B59046048BE710FF79E98245EB7B1BBC4314F01893EDD8467691EA3498198B86

Function 00402F6C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00402F87

Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402D1B
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402D38
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402D47
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402D6F
Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402DAB
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402DC8
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402DD7
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402DFF

Part of subcall function 00402CD0: strcat.MSVCRT(?), ref: 00402E95
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402E9D
Part of subcall function 00402CD0: _itoa.MSVCRT ref: 00402EB4
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402EBC

Strings

@, xrefs: 00402F7D
-Xmx, xrefs: 00402FC6
-Xms, xrefs: 00402F92

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$FindLoadLockatoistrlen$GlobalMemoryStatus_itoastrcat
String ID: -Xms$-Xmx$@
API String ID: 3228920701-2676391021
Opcode ID: 1ee8ed68ac0c068930fb015abfc5e24d0c88b4e77e9116532bd67e932936c618
Instruction ID: 83f1aa44919a4c99108a5316738b6ebc3d89b658feaab29e7295632cd6d8abda
Opcode Fuzzy Hash: 1ee8ed68ac0c068930fb015abfc5e24d0c88b4e77e9116532bd67e932936c618
Instruction Fuzzy Hash: 890192B0A097099FDB04EF69D18055EBBF1EF88304F10C82EE589AB380D778D9459B86

Function 00402F70 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00402F87

Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402D1B
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402D38
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402D47
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402D6F
Part of subcall function 00402CD0: FindResourceExA.KERNEL32 ref: 00402DAB
Part of subcall function 00402CD0: LoadResource.KERNEL32 ref: 00402DC8
Part of subcall function 00402CD0: LockResource.KERNEL32 ref: 00402DD7
Part of subcall function 00402CD0: atoi.MSVCRT ref: 00402DFF

Part of subcall function 00402CD0: strcat.MSVCRT(?), ref: 00402E95
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402E9D
Part of subcall function 00402CD0: _itoa.MSVCRT ref: 00402EB4
Part of subcall function 00402CD0: strlen.MSVCRT ref: 00402EBC

Strings

@, xrefs: 00402F7D
-Xmx, xrefs: 00402FC6
-Xms, xrefs: 00402F92

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: Resource$FindLoadLockatoistrlen$GlobalMemoryStatus_itoastrcat
String ID: -Xms$-Xmx$@
API String ID: 3228920701-2676391021
Opcode ID: 3d5dd6a6b33f9c710683a0e9a068311a38a7e96d1987d357962a79e933fbc725
Instruction ID: 6e677b9b8fabcb62c193d886980ddecd66842c0ac049963db457ddd5af3e35c3
Opcode Fuzzy Hash: 3d5dd6a6b33f9c710683a0e9a068311a38a7e96d1987d357962a79e933fbc725
Instruction Fuzzy Hash: FF0193B0A093099FD704EF69D18055EBBF1EF88304F10C83EE589AB380D778D9459B86

Function 00402945 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 29stringCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00402996
strcpy.MSVCRT ref: 004029B3
strlen.MSVCRT ref: 004029C5
strcat.MSVCRT ref: 004029E3
_stat.MSVCRT ref: 004029F6

Strings

Check launcher:%s %s, xrefs: 00402980
(OK), xrefs: 00402970
(n/a), xrefs: 00402977

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: _statfprintfstrcatstrcpystrlen
String ID: (OK)$(n/a)$Check launcher:%s %s
API String ID: 619758015-4217937889
Opcode ID: 8e35bfdefc2d965162e0c46b7f7b8511bec3a04771cfdae5fb4af482349bacc5
Instruction ID: fa1afa973b0b716c6a45a6db043711451785159eaff392967d20973c2505f891
Opcode Fuzzy Hash: 8e35bfdefc2d965162e0c46b7f7b8511bec3a04771cfdae5fb4af482349bacc5
Instruction Fuzzy Hash: C3F05EB0A043085FDB109E59E980766B7E4FB84314F01C47EE94CA7380D778A8548B89

Function 00401A3C Relevance: 6.0, APIs: 4, Instructions: 26timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401972
KillTimer.USER32 ref: 00401998
PostQuitMessage.USER32 ref: 004019A7
EnumWindows.USER32 ref: 00401A4D

Memory Dump Source

Source File: 00000006.00000002.2212279499.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2212256977.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212302418.0000000000406000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212367507.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2212399628.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_HkppfZO2WW.jbxd

Similarity

API ID: CodeEnumExitKillMessagePostProcessQuitTimerWindows
String ID:
API String ID: 405088690-0
Opcode ID: 4f729626180ff1f826cd159275eaebbc8f8a505249547bf250ab6daea0a3e3ed
Instruction ID: 5dfb1647a7b45fe9d990e1e5a37a50df87d11f83294e09497229981203e6544d
Opcode Fuzzy Hash: 4f729626180ff1f826cd159275eaebbc8f8a505249547bf250ab6daea0a3e3ed
Instruction Fuzzy Hash: 83F0D0B59083008AD314BF34D6462197AE0BB84344F018A3ED9C5637D5D7789558DB9B

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HkppfZO2WW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: HkppfZO2WW.exePID: 7276, Parent PID: 4004

General

Chronological Activities

Analysis Process: javaw.exePID: 7292, Parent PID: 7276

General

Chronological Activities

Analysis Process: HkppfZO2WW.exePID: 7588, Parent PID: 4004

General

Chronological Activities

Analysis Process: javaw.exePID: 7600, Parent PID: 7588

General

Windows Analysis Report
HkppfZO2WW.exe

Function 004013B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 332
stringCOMMON

Function 004013E9 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 205
stringwindowtimeCOMMON

Function 00401150 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Function 00401E10 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Function 00402280 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 107
stringregistryCOMMON

Function 004047A0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 106
stringprocesssynchronizationCOMMON

Function 00402640 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147
COMMON

Function 00402430 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 102
registryfileCOMMON

Function 0040124A Relevance: 10.5, APIs: 7, Instructions: 41
COMMON

Function 00404940 Relevance: 4.6, APIs: 3, Instructions: 95
COMMON

Function 004049CC Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Function 004049FE Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Function 00401290 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Function 00402A30 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 167
stringCOMMON

Function 00402CD0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 197
stringCOMMON