Edit tour

Windows Analysis Report
flupdate.exe

Overview

General Information

Sample name:	flupdate.exe
Analysis ID:	1562193
MD5:	728d903e430115d74f5adbd2f725f2eb
SHA1:	7786bd4ce8f25bc023722b4cb6fc17860a5e29bd
SHA256:	c1d322835ee594b660a39b105516d944a92bba93af7c8b3f5e7bd0828aa6afe1
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Found evasive API chain (may stop execution after checking mutex)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

flupdate.exe (PID: 7512 cmdline: "C:\Users\user\Desktop\flupdate.exe" MD5: 728D903E430115D74F5ADBD2F725F2EB)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 80.4% probability

Source: flupdate.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_00402870 _sprintf,FindFirstFileA,FindFirstFileA,_sprintf,FindFirstFileA,FindClose,

0_2_00402870

Source: flupdate.exe

String found in binary or memory: http://crl.g

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_00401834 NtdllDefWindowProc_A,BeginPaint,GetClientRect,_strlen,DrawTextA,EndPaint,PostQuitMessage,

0_2_00401834

Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00412CCC	0_2_00412CCC
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_004078EF	0_2_004078EF
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00412090	0_2_00412090
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00413CB1	0_2_00413CB1
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00403D70	0_2_00403D70
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_004125D4	0_2_004125D4
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00411B4C	0_2_00411B4C

Source: C:\Users\user\Desktop\flupdate.exe

Code function: String function: 00407EB8 appears 38 times

Source: flupdate.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: flupdate.exe

Binary string: \Device\KeyboardClass0@p

Source: classification engine

Classification label: mal48.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_004026F0 GetDiskFreeSpaceExA,

0_2_004026F0

Source: C:\Users\user\Desktop\flupdate.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\FUMutexName

Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -coh	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -coh	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -coh	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -coh	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -cmsg	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -cmsg	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -cmsg	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: -cmsg	0_2_00401E45
Source: C:\Users\user\Desktop\flupdate.exe	Command line argument: FLU	0_2_00401E45

Source: C:\Users\user\Desktop\flupdate.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\flupdate.exe

File read: C:\Users\user\Desktop\flupdate.exe

Jump to behavior

Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\flupdate.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_004376D0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_004376D0

Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_004050C8 push dword ptr [ecx-75h]; iretd	0_2_004050D0
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00420989 push eax; ret	0_2_004209B9
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00420A08 push eax; ret	0_2_004209B9
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00407EFD push ecx; ret	0_2_00407F10

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\flupdate.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-9535

Source: C:\Users\user\Desktop\flupdate.exe

Evaded block: after key decision

graph_0-9551

Source: C:\Users\user\Desktop\flupdate.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-9547

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_00402870 _sprintf,FindFirstFileA,FindFirstFileA,_sprintf,FindFirstFileA,FindClose,

0_2_00402870

Source: C:\Users\user\Desktop\flupdate.exe

API call chain: ExitProcess graph end node

graph_0-12300

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_004086F0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004086F0

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_004376D0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_004376D0

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_004116D9 CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004116D9

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00410421 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00410421
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_0040D02A SetUnhandledExceptionFilter,	0_2_0040D02A
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_004086F0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004086F0
Source: C:\Users\user\Desktop\flupdate.exe	Code function: 0_2_00404FC8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00404FC8

Source: C:\Users\user\Desktop\flupdate.exe

Code function: GetLocaleInfoA,

0_2_00413A30

Source: C:\Users\user\Desktop\flupdate.exe

Code function: 0_2_0040D755 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0040D755

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Software Packing	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	21 Obfuscated Files or Information	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://crl.g	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.g	flupdate.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562193
Start date and time:	2024-11-25 10:29:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	flupdate.exe
Detection:	MAL
Classification:	mal48.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 13 Number of non-executed functions: 44
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: flupdate.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.738303090285732
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	flupdate.exe
File size:	262'144 bytes
MD5:	728d903e430115d74f5adbd2f725f2eb
SHA1:	7786bd4ce8f25bc023722b4cb6fc17860a5e29bd
SHA256:	c1d322835ee594b660a39b105516d944a92bba93af7c8b3f5e7bd0828aa6afe1
SHA512:	d6190757b48f90b19c1a1d11937590f16201c55df93cc700a65a7dafc9dabe580fc39372a749e82aeb48f81047ab35eb52aa359a6011a0b290e6fd938f909b39
SSDEEP:	6144:qPKo3zZhCncVIKQOpmYUDuXrdmSHPUUKVVBeaw:V0z/dvwYUDuXT8xBw
TLSH:	09441215EF1E5CC4F0C4CB7A0597AE3A07F4F4522505736922F8E6EC2E36E44C6A22A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7..ts..'s..'s..'..A'v..'z.B'd..'Tv.'t..'s..'...'z.T'...'z.S'V..'m.C'r..'z.F'r..'Richs..'........................PE..L.....:]...

File Icon


Icon Hash:	4c1617edfa3d0f86

Static PE Info

General

Entrypoint:	0x4376d0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5D3AB080 [Fri Jul 26 07:49:20 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	26bacf39ecc38d64cdc04c882ade86d1

Entrypoint Preview

Instruction
pushad
mov esi, 0042B000h
lea edi, dword ptr [esi-0002A000h]
push edi
jmp 00007FA3D87EF41Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FA3D87EF419h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FA3D87EF3FFh
mov eax, 00000001h
add ebx, ebx
jne 00007FA3D87EF419h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FA3D87EF401h
jne 00007FA3D87EF41Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FA3D87EF3F6h
xor ecx, ecx
sub eax, 03h
jc 00007FA3D87EF41Fh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FA3D87EF486h
mov ebp, eax
add ebx, ebx
jne 00007FA3D87EF419h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007FA3D87EF419h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007FA3D87EF432h
inc ecx
add ebx, ebx
jne 00007FA3D87EF419h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FA3D87EF401h
jne 00007FA3D87EF41Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FA3D87EF3F6h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007FA3D87EF421h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007FA3D87EF409h
jmp 00007FA3D87EF378h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 04h
jnbe 00007FA3D87EF403h
add edi, ecx
jmp 00007FA3D87FF361h

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a2c8	0x114	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0x22c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x37858	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x2a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x2b000	0xd000	0xca00	ce349d1a7ab0f4665ba3f398917290a1	False	0.9862507735148515	data	7.900524926940504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x38000	0x3000	0x2400	f3048574b480eacd8b4ae85f0b9bc348	False	0.2849392361111111	data	4.2827029161518855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x38194	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Hebrew	Israel	0.5028901734104047
RT_ICON	0x38700	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Hebrew	Israel	0.41335740072202165
RT_ICON	0x38fac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	Hebrew	Israel	0.3302238805970149
RT_GROUP_ICON	0x39e58	0x30	data	Hebrew	Israel	0.875
RT_VERSION	0x39e8c	0x2d0	data	English	United States	0.44305555555555554
RT_MANIFEST	0x3a160	0x165	ASCII text, with CRLF line terminators	English	United States	0.5434173669467787

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
USER32.dll	EndPaint
VERSION.dll	VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Hebrew	Israel
English	United States

Target ID:	0
Start time:	04:30:21
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\flupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\flupdate.exe"
Imagebase:	0x400000
File size:	262'144 bytes
MD5 hash:	728D903E430115D74F5ADBD2F725F2EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00401E45 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 230
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00401E7A

Part of subcall function 004046BA: __FF_MSGBANNER.LIBCMT ref: 004046DD
Part of subcall function 004046BA: __NMSG_WRITE.LIBCMT ref: 004046E4
Part of subcall function 004046BA: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00404731

CreateMutexA.KERNELBASE(00000000,00000000,00000318), ref: 00401E8C
GetLastError.KERNEL32 ref: 00401E92
_strlen.LIBCMT ref: 00401ECD
_strlen.LIBCMT ref: 00401EDD
_strlen.LIBCMT ref: 00401F16
_strlen.LIBCMT ref: 00401F26
_strlen.LIBCMT ref: 00401F66
_strlen.LIBCMT ref: 00401F76
_strlen.LIBCMT ref: 00401FB6
_strlen.LIBCMT ref: 00401FC6
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402011
GetTempPathA.KERNEL32(00000104,?), ref: 00402031
GetTempFileNameA.KERNEL32(?,FLU,00000000,?), ref: 00402046
DeleteFileA.KERNEL32(?), ref: 00402053
_strlen.LIBCMT ref: 00402067
CreateDirectoryA.KERNEL32(?,00000000), ref: 00402099

Part of subcall function 004013FE: swprintf.LIBCMT ref: 00401480

Part of subcall function 00401CDF: MessageBoxA.USER32(00000000,00000000,00000000), ref: 00401D38

_strncmp.LIBCMT ref: 00402075

Part of subcall function 004049A5: __lock.LIBCMT ref: 004049C3
Part of subcall function 004049A5: ___sbh_find_block.LIBCMT ref: 004049CE
Part of subcall function 004049A5: ___sbh_free_block.LIBCMT ref: 004049DD
Part of subcall function 004049A5: HeapFree.KERNEL32(00000000,?,004177D0,0000000C,0040739F,00000000,00417948,0000000C,004073D9,?,?,?,00411421,00000004,00417C38,0000000C), ref: 00404A0D
Part of subcall function 004049A5: GetLastError.KERNEL32(?,00411421,00000004,00417C38,0000000C,0040E691,?,?,00000000,00000000,00000000,?,00406F1E,00000001,00000214), ref: 00404A1E

Strings

-o , xrefs: 00401F98
Local\FUMutexName, xrefs: 00401E7F
-s , xrefs: 00401EB4
-coh, xrefs: 00401F10, 00401F15, 00401F2F, 00401F3C
-cmsg, xrefs: 00401F60, 00401F65, 00401F7F, 00401F8C
FLU, xrefs: 00402040
-cmsg , xrefs: 00401F48
-coh , xrefs: 00401EF9

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _strlen$File$CreateErrorHeapLastNameTemp$AllocateDeleteDirectoryFreeMessageModuleMutexPath___sbh_find_block___sbh_free_block__lock_malloc_strncmpswprintf
String ID: -cmsg$-cmsg $-coh$-coh $-o $-s $FLU$Local\FUMutexName
API String ID: 2080818568-112401573
Opcode ID: 8565448094c9fabb384253f26313dc656fce7faebb17f7b735fd9eba31cd3180
Instruction ID: f13b9500db5cf2fdbfef360ed6f043dedbddf05904c77ae10fa87ade50a28a67
Opcode Fuzzy Hash: 8565448094c9fabb384253f26313dc656fce7faebb17f7b735fd9eba31cd3180
Instruction Fuzzy Hash: DA718572904205AFEB24BBB1DC45EEE3B68AB85708F10003FF604B71D2EB399540CB58

Function 00401834 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 61
nativewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00401865
BeginPaint.USER32(?,?), ref: 00401874
GetClientRect.USER32(?,?), ref: 00401881
_strlen.LIBCMT ref: 0040189A
DrawTextA.USER32(00000000,Please wait...,00000000,?,00000001), ref: 004018A3
EndPaint.USER32(?,?), ref: 004018AE
PostQuitMessage.USER32(00000000), ref: 004018BA

Strings

Please wait..., xrefs: 0040188D, 00401892, 004018A1
*, xrefs: 00401893

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: Paint$BeginClientDrawMessageNtdllPostProc_QuitRectTextWindow_strlen
String ID: *$Please wait...
API String ID: 3585501550-310496419
Opcode ID: 0b9f259886c2e8d8265fc05c1827541f8b14f46f23242a06cbee0394f8c172e5
Instruction ID: 4dd80ec288db4b62e7ff0d84e0455e0fcd25cdf9ab30a6d22abe7f1842d97108
Opcode Fuzzy Hash: 0b9f259886c2e8d8265fc05c1827541f8b14f46f23242a06cbee0394f8c172e5
Instruction Fuzzy Hash: 33112B72500108FBD701ABA8DD49EFE77BCEB49304B508136F502E61A0D7789A059B69

Function 004376D0 Relevance: 7.7, APIs: 5, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ae8178db3a66adb13442b4a249dddd31793b7a2b77b7130bd57b40c639ccc2
Instruction ID: 55d6107a75208e6dedf5cbf38e280ece3e4ffeb315001ed265430692a0fad248
Opcode Fuzzy Hash: 71ae8178db3a66adb13442b4a249dddd31793b7a2b77b7130bd57b40c639ccc2
Instruction Fuzzy Hash: 015128F16487520BD7315E78CDD06A5BB94EB1A334F28177AC9E1873C5E79C2806C7A8

Function 00405BF2 Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00405C3D
__mtinit.LIBCMT ref: 00405C43
_fast_error_exit.LIBCMT ref: 00405C4E
__RTC_Initialize.LIBCMT ref: 00405C54
__ioinit.LIBCMT ref: 00405C5C
__amsg_exit.LIBCMT ref: 00405C67
GetCommandLineA.KERNEL32 ref: 00405C6D
___crtGetEnvironmentStringsA.LIBCMT ref: 00405C78
__setargv.LIBCMT ref: 00405C82
__amsg_exit.LIBCMT ref: 00405C8D
__setenvp.LIBCMT ref: 00405C93
__amsg_exit.LIBCMT ref: 00405C9E
__cinit.LIBCMT ref: 00405CA5
__amsg_exit.LIBCMT ref: 00405CB0
__wincmdln.LIBCMT ref: 00405CB6

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: f55ea4e93cdfae3b47f987d4bf8d73404d29df4f07ec6ee2fa2f3088e080a7b9
Instruction ID: 7f9845ccf83d47d0208cfa3dd8e882dda803d7003e942a83c03e6db5ba0379fd
Opcode Fuzzy Hash: f55ea4e93cdfae3b47f987d4bf8d73404d29df4f07ec6ee2fa2f3088e080a7b9
Instruction Fuzzy Hash: 42215370D49B049AFB147BB2A946B6F6664EF0071DF10483FF405BA1C2EABC88859E5D

Function 004017AC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 004017B8
GetSystemMetrics.USER32(00000001), ref: 004017BE
CreateWindowExA.USER32(00000000,Window,Nuvoton Flash Update Tool,80880000,-00000069,-0000009B,000000D2,0000006E,00000000,00000000,?,00000000), ref: 00401803
ShowWindow.USER32(00000000,?), ref: 0040181B
KiUserCallbackDispatcher.NTDLL ref: 00401827

Strings

Nuvoton Flash Update Tool, xrefs: 004017F8
Window, xrefs: 004017FD

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: CallbackDispatcherUserWindow$CreateMetricsShowSystem
String ID: Nuvoton Flash Update Tool$Window
API String ID: 2363862556-599115452
Opcode ID: be37ca720a6fec147d08e4b9a590f6ce7b7f8294bf0507c6bd921885c9de1557
Instruction ID: 1cf8fc465e946f803013fd292a57106d4a460a93c848c879d3f3f7887aa7ce13
Opcode Fuzzy Hash: be37ca720a6fec147d08e4b9a590f6ce7b7f8294bf0507c6bd921885c9de1557
Instruction Fuzzy Hash: 5501F972750711BFD7125FB4AC4CFAB3EADE7C8711F14483AF500E6191D6A4A441CB28

Function 00404A33 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00404A95
_memcpy_s.LIBCMT ref: 00404B0A
__fileno.LIBCMT ref: 00404B6A
__read.LIBCMT ref: 00404B71
__filbuf.LIBCMT ref: 00404B95
_memset.LIBCMT ref: 00404BDB
_memset.LIBCMT ref: 00404C06

Part of subcall function 00408302: __getptd_noexit.LIBCMT ref: 00408302

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: ba4df12e5b988ea9f83b8fcca753877d76c40a3aef18d5ba92c5ac3350b89337
Instruction ID: 6dc5c9f63e16c19c60eeb3d75317718148f919c4155afa3ce9aacf3d1c47d86c
Opcode Fuzzy Hash: ba4df12e5b988ea9f83b8fcca753877d76c40a3aef18d5ba92c5ac3350b89337
Instruction Fuzzy Hash: 5951E3B1A00204EBCB209FA98944A9FBB75EFC1320F14823BE925722D0D7789E51CF59

Function 00402650 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040493B: __fsopen.LIBCMT ref: 00404948

Sleep.KERNEL32(000000FA), ref: 00402680
_fseek.LIBCMT ref: 0040269B
__fread_nolock.LIBCMT ref: 004026AA
_strncmp.LIBCMT ref: 004026D6

Strings

AHXX, xrefs: 004026D0

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: Sleep__fread_nolock__fsopen_fseek_strncmp
String ID: AHXX
API String ID: 2366002348-1807168166
Opcode ID: 767e7a1a58b364449a9693a02ec593de220677a22e6f973bcf6e1155576d4aa7
Instruction ID: c37c82d072a685b29b90b03a1b87c44c1a0edcd69af0e97925b51c7e0d5c6eb3
Opcode Fuzzy Hash: 767e7a1a58b364449a9693a02ec593de220677a22e6f973bcf6e1155576d4aa7
Instruction Fuzzy Hash: 3F01F9F2A4471039F12075659C87F6F210C8742728F10063BF619761D2E5BA9A0141BF

Function 00404C3D Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00404C6A
__lock_file.LIBCMT ref: 00404C95

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 92754d5ebd34ea83f09b3b840a0b11f5a31ce0a13565c81ef6a16daa5dab5496
Instruction ID: dce89d9f424f3ff3ecd1ad94c1a1c0aa29fddc81f75565c6e727210f33e9abde
Opcode Fuzzy Hash: 92754d5ebd34ea83f09b3b840a0b11f5a31ce0a13565c81ef6a16daa5dab5496
Instruction Fuzzy Hash: BE016DB1805209EBDF22AFA1CC0249F3A20AF40720F05817BF924262D1C7398A62DFD9

Function 004047FB Relevance: 3.0, APIs: 2, Instructions: 39
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408302: __getptd_noexit.LIBCMT ref: 00408302

Part of subcall function 00408818: __decode_pointer.LIBCMT ref: 00408823

__lock_file.LIBCMT ref: 0040484B

Part of subcall function 00408915: __lock.LIBCMT ref: 0040893A

__fclose_nolock.LIBCMT ref: 00404855

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 717694121-0
Opcode ID: 56c03c318f0d627eace7ba44fc2451671e05ed73f1eb78214da3e554f7642d6d
Instruction ID: 744dffb88b720ac09e790225845c17770a4fd893448e1305e55c26c15cc3dacb
Opcode Fuzzy Hash: 56c03c318f0d627eace7ba44fc2451671e05ed73f1eb78214da3e554f7642d6d
Instruction Fuzzy Hash: 90F0C8B2C0520085C711BB2A880265E7AA49FC1334F11CA6FE574771D1CB3C59429B5E

Function 0040548C Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00405494

Part of subcall function 00405461: GetModuleHandleW.KERNEL32(mscoree.dll,?,00405499,?,?,004046F3,000000FF,0000001E,?,0040E647,?,00000001,?,?,00407348,00000018), ref: 0040546B
Part of subcall function 00405461: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040547B

ExitProcess.KERNEL32 ref: 0040549D

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 7177857381d44b339cf50db4fa47a8771b969b20e63409ebe98ec3a1f6cf0251
Instruction ID: 7840fc3f8f1d9011e0ad5e14e95efe73fbfe7621e5692a9ff6139c53c7f7316b
Opcode Fuzzy Hash: 7177857381d44b339cf50db4fa47a8771b969b20e63409ebe98ec3a1f6cf0251
Instruction Fuzzy Hash: 20B04831000508BBCB012B62EC0A98A3E2AEA807A1B148025B80849061DA72AA929A89

Function 004080AC Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004080C1

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ae9763bd8f644d0f4786c269ee46d89e939af661feed9d8e3c2758acd7132950
Instruction ID: 8fa0ab9d9efd42a1935edfcd8972d2c17a5a4deb6e057b4b4df76c32ce643e84
Opcode Fuzzy Hash: ae9763bd8f644d0f4786c269ee46d89e939af661feed9d8e3c2758acd7132950
Instruction Fuzzy Hash: 41D05E726507059EDB105FB5AD097663BEC9784395F048436B80CC6190E6B4D5509A48

Function 0040493B Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fsopen.LIBCMT ref: 00404948

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction ID: f95237979f1c5846dddcd27aad135eab44c03c9d8f3c64067a621dc7d222edc2
Opcode Fuzzy Hash: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction Fuzzy Hash: E5C092B754024C77CF112A83EC02E4A3F1A9BC1764F148021FB1C291A1AA77EA61D689

Function 004056A8 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 004056B4

Part of subcall function 0040557C: __lock.LIBCMT ref: 0040558A
Part of subcall function 0040557C: __decode_pointer.LIBCMT ref: 004055C1
Part of subcall function 0040557C: __decode_pointer.LIBCMT ref: 004055D6
Part of subcall function 0040557C: __decode_pointer.LIBCMT ref: 00405600
Part of subcall function 0040557C: __decode_pointer.LIBCMT ref: 00405616
Part of subcall function 0040557C: __decode_pointer.LIBCMT ref: 00405623
Part of subcall function 0040557C: __initterm.LIBCMT ref: 00405652
Part of subcall function 0040557C: __initterm.LIBCMT ref: 00405662

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 23e37c46c76d3ea1cb9fa48a39cfe1f561427936b3cb337eab43370ee01939b4
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: E8B0923298060C33DA202542AC03F0A3A0A87C1B64E240021BA0C291E1A9B2A9A5888D

Non-executed Functions

Function 00412CCC Relevance: 18.3, APIs: 4, Strings: 6, Instructions: 793COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 00412DE2
__invoke_watson.LIBCMT ref: 00412DF5
_strcpy_s.LIBCMT ref: 00412E0E
__invoke_watson.LIBCMT ref: 00412E21

Strings

T, xrefs: 00412E9C
1#IND, xrefs: 00412DC8
1#INF, xrefs: 00412DD7
?, xrefs: 00412D37
1#SNAN, xrefs: 00412DAE
1#QNAN, xrefs: 00412E03

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __invoke_watson_strcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$?$T
API String ID: 3990783250-1230703744
Opcode ID: bce4f6b20b5be04094cfd0d3a90b1aed5ecc2659c89314c707dcce361637fbd5
Instruction ID: 1f1f38a5171cc0cfaf63f40fe0c2a03535788cb8127d452b8a2f9641d9799ed8
Opcode Fuzzy Hash: bce4f6b20b5be04094cfd0d3a90b1aed5ecc2659c89314c707dcce361637fbd5
Instruction Fuzzy Hash: D062A171E0065A8BDF14CFA8C5403EEBBB1FF54311F54816BD816AB381D7788A86CB98

Function 00402870 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 129fileCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 004028BF
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 0040292D
_sprintf.LIBCMT ref: 00402967
FindFirstFileA.KERNEL32(?,?), ref: 004029CC
FindClose.KERNEL32(00000000), ref: 004029D8

Strings

.exe, xrefs: 00402909, 004029AE
FUrep, xrefs: 0040288B, 00402940

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: Find$FileFirst_sprintf$Close
String ID: .exe$FUrep
API String ID: 1211650730-2859872544
Opcode ID: 6be2900ba5bc446e5326daeb18f7424a77297df40848b910a5b57b4ddc5c78b0
Instruction ID: a8dfba24ddf6f2ad3a1b96e0c355d722fe7b14cac474d7563ffb552bf2dff24c
Opcode Fuzzy Hash: 6be2900ba5bc446e5326daeb18f7424a77297df40848b910a5b57b4ddc5c78b0
Instruction Fuzzy Hash: A74107701087858FC725CB28D9989EBBBE5EFC9300F11862EE899D7390EB759448C799

Function 00404FC8 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004099C9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004099DE
UnhandledExceptionFilter.KERNEL32(00416ACC), ref: 004099E9
GetCurrentProcess.KERNEL32(C0000409), ref: 00409A05
TerminateProcess.KERNEL32(00000000), ref: 00409A0C

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 198bba26c7be076e61dcaef8401e461012ca6d5fd355e9cd124247f9669f3046
Instruction ID: 6df0053adf25e75117556794615b0754d00daf640825ebb8b0d2f504d57cb16e
Opcode Fuzzy Hash: 198bba26c7be076e61dcaef8401e461012ca6d5fd355e9cd124247f9669f3046
Instruction Fuzzy Hash: 3E21E3B9911344DFE700EFA5E984A843BF0FB48740F10A07AE90997BB0E7B459858F4D

Function 00403D70 Relevance: 3.3, APIs: 2, Instructions: 277COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00403EBA
_memset.LIBCMT ref: 00403FE4

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 80527d86115d66d10184407f554bd980a89e073e06867996d96bf944e9a053de
Instruction ID: 2719c25028b2964a963ab2a271ffcdf57eff4c161546a46cc739ece6188be7e6
Opcode Fuzzy Hash: 80527d86115d66d10184407f554bd980a89e073e06867996d96bf944e9a053de
Instruction Fuzzy Hash: C7A104709083824FD711CE28C59026BBFE5EFD6304F144A7EE9D167382D3399A4AC79A

Function 004026F0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExA.KERNEL32 ref: 0040270E

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 7fa45b61e74cf9f79088d2bd21c4ab5ad7d055186bfc16143c512fbb37a47155
Instruction ID: f330874e7cdb97657f19c3ad480c9a7c12e910a9927b2e212953bd0ede7f8aa4
Opcode Fuzzy Hash: 7fa45b61e74cf9f79088d2bd21c4ab5ad7d055186bfc16143c512fbb37a47155
Instruction Fuzzy Hash: D5E012346543015BD704EF20DE59B4B77D5AB84B41F804D38F545DB2C0E3B9990CC79A

Function 0040D02A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000CFE8), ref: 0040D02F

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 60b7e3fe404f69667ea992068b43ecc70ec854a88509bcf5d10e662ee912d222
Instruction ID: 2f52fb7ba1cb4ad789a5c1a6a3f8c844c2865c88a70f2b8e2df5dffb9245326f
Opcode Fuzzy Hash: 60b7e3fe404f69667ea992068b43ecc70ec854a88509bcf5d10e662ee912d222
Instruction Fuzzy Hash: E5900260351501C68600A7B95C5DA852991AACC7867A185716002D40D4DA644000555A

Function 00401B08 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 172processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00401A34: _malloc.LIBCMT ref: 00401A5B

_strncpy.LIBCMT ref: 00401B75
__fcloseall.LIBCMT ref: 00401BB0
__fcloseall.LIBCMT ref: 00401BC1
_strncat.LIBCMT ref: 00401BD0
_strlen.LIBCMT ref: 00401BD9
_strncat.LIBCMT ref: 00401BEB
_memset.LIBCMT ref: 00401C10
_memset.LIBCMT ref: 00401C1C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00401C43
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00415CBC,00000000,00000001), ref: 00401C4D
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401C5D
GetExitCodeProcess.KERNEL32(?,?), ref: 00401C6A
CloseHandle.KERNEL32(?), ref: 00401C79
CloseHandle.KERNEL32(?), ref: 00401C7E
_strlen.LIBCMT ref: 00401C9E
_strlen.LIBCMT ref: 00401CAB

Strings

-runbsf , xrefs: 00401B92
-bec, xrefs: 00401C98, 00401C9D, 00401CB3
-bec , xrefs: 00401C85
i2c, xrefs: 00401B7E
-if , xrefs: 00401B52

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _strlen$CloseHandleProcess__fcloseall_memset_strncat$CodeCreateErrorExitLastObjectSingleWait_malloc_strncpy
String ID: -bec$-bec $-if $-runbsf $i2c
API String ID: 3324597316-406442058
Opcode ID: 31f4ab88ed1526c60a5e635369d4c10c188644256ff341ac6f58cd9782edfdaf
Instruction ID: 4ec7579e8a8b02e7694737c12fa4a89657318d557ef3c3bb4c3bebb1a852eaca
Opcode Fuzzy Hash: 31f4ab88ed1526c60a5e635369d4c10c188644256ff341ac6f58cd9782edfdaf
Instruction Fuzzy Hash: F1518872D00248AADB10ABA5EC45EEF7BBCEF48314F14443BF505B2191EB3C99048B68

Function 00401611 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 129stringfilelibraryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,TVicHW32.sys), ref: 00401652
lstrcpy.KERNEL32(?,TVicHW64.sys), ref: 00401660
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040166E
lstrcat.KERNEL32(?,\drivers\), ref: 00401686
lstrcat.KERNEL32(?,?), ref: 00401696
lstrcpy.KERNEL32(?,?), ref: 004016A0
lstrcpy.KERNEL32(?,?), ref: 004016AD
lstrcat.KERNEL32(?,?), ref: 004016BD
lstrcat.KERNEL32(?,?), ref: 004016CA

Part of subcall function 0040493B: __fsopen.LIBCMT ref: 00404948

CopyFileA.KERNEL32(?,?,00000000), ref: 00401721
GetModuleHandleA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection), ref: 00401744
GetProcAddress.KERNEL32(00000000), ref: 0040174D
GetModuleHandleA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection), ref: 00401758
GetProcAddress.KERNEL32(00000000), ref: 0040175B
CopyFileA.KERNEL32(?,?,00000000), ref: 00401783

Part of subcall function 0040154E: _malloc.LIBCMT ref: 00401569
Part of subcall function 0040154E: 74D41540.VERSION(00000000,00415CBC,00000000,?,?,?,00000000,00000000,?,?), ref: 0040158C

Strings

Wow64RevertWow64FsRedirection, xrefs: 0040174F
kernel32, xrefs: 0040173E, 00401743, 00401754
TVicHW64.sys, xrefs: 00401654
Wow64DisableWow64FsRedirection, xrefs: 00401739
\drivers\, xrefs: 0040167A
TVicHW32.sys, xrefs: 0040163F

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: lstrcatlstrcpy$AddressCopyFileHandleModuleProc$D41540DirectorySystem__fsopen_malloc
String ID: TVicHW32.sys$TVicHW64.sys$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$\drivers\$kernel32
API String ID: 3178957742-2758921077
Opcode ID: b60890f1a3503ce63d4b602ea2b07d268a25b69e701c4c0326ce008c21acf88b
Instruction ID: c5eb5fac36edd1ab76eba7e42002dac0df6a4527c06735851329c875dfc35cc2
Opcode Fuzzy Hash: b60890f1a3503ce63d4b602ea2b07d268a25b69e701c4c0326ce008c21acf88b
Instruction Fuzzy Hash: 3B41ECB291024CAADF30EFF5DC89ECE77ACAB48304F11452BAA09D7151DA78D6458F64

Function 00402100 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 58COMMON

Download Yara Rule

APIs

_printf.LIBCMT ref: 00402105
_printf.LIBCMT ref: 00402133
_printf.LIBCMT ref: 0040214E
_printf.LIBCMT ref: 00402169
_printf.LIBCMT ref: 00402184
_printf.LIBCMT ref: 0040219E
_printf.LIBCMT ref: 004021B9
_printf.LIBCMT ref: 004021D4
_printf.LIBCMT ref: 004021F3

Strings

Reading from %s failed, xrefs: 0040212E
There is not enough space on drive, xrefs: 00402199
%s missing, xrefs: 0040217F
Memory allocation failed %s, xrefs: 004021CF
Failed to open %s, xrefs: 00402164
Failed to compress %s, xrefs: 004021B4
Writing to %s failed, xrefs: 00402149

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _printf
String ID: %s missing$Failed to compress %s$Failed to open %s$Memory allocation failed %s$Reading from %s failed$There is not enough space on drive$Writing to %s failed
API String ID: 723836530-3683205635
Opcode ID: 3a4027b462162ad5a6a50c437409e611084f9c27c3cb0eadeb5ec5186ad3e7f3
Instruction ID: 390be67d09cdb724ff97686d3c01a47f9a740aa9f018bcd15236d3e1abfaf7c1
Opcode Fuzzy Hash: 3a4027b462162ad5a6a50c437409e611084f9c27c3cb0eadeb5ec5186ad3e7f3
Instruction Fuzzy Hash: 51115EB0909B00A7EA402B415E0E5CB6D84DD62B08B15C47FF44C7E2C2F2BEC5599EAF

Function 004018D1 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 004018DD

Part of subcall function 00404414: __getptd.LIBCMT ref: 00404432

_strtok.LIBCMT ref: 0040190B
_strcat.LIBCMT ref: 00401931
__strlwr.LIBCMT ref: 0040193F
__strlwr.LIBCMT ref: 0040195B
_strrchr.LIBCMT ref: 00401968
_strtok.LIBCMT ref: 0040199E
_strcat.LIBCMT ref: 004019C0
_strtok.LIBCMT ref: 004019DD
_strtok.LIBCMT ref: 00401A1C

Strings

.exe, xrefs: 00401938, 0040193D, 00401951
-coh, xrefs: 0040198A, 0040198F, 004019AB
-cmsg, xrefs: 004019C9, 004019CE, 004019EA

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _strtok$__strlwr_strcat$__getptd_strrchr
String ID: -cmsg$-coh$.exe
API String ID: 2054980399-586899726
Opcode ID: ddd1e3a9480941dd67566616629b63406c1bd87d1a0f8e8ea7f6421d09e0d373
Instruction ID: daee60b6a93fcd967a7de978cb950dda6c30c4eb0e34f876ebf12504e36bb5d0
Opcode Fuzzy Hash: ddd1e3a9480941dd67566616629b63406c1bd87d1a0f8e8ea7f6421d09e0d373
Instruction Fuzzy Hash: 0F315EB365971229F92471667C57F9B168CCB91778F20003FFA04BA1E2EE7E9D4084AD

Function 00402E20 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 277COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00402E50

Part of subcall function 004046BA: __FF_MSGBANNER.LIBCMT ref: 004046DD
Part of subcall function 004046BA: __NMSG_WRITE.LIBCMT ref: 004046E4
Part of subcall function 004046BA: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00404731

Part of subcall function 00402650: Sleep.KERNEL32(000000FA), ref: 00402680
Part of subcall function 00402650: _fseek.LIBCMT ref: 0040269B
Part of subcall function 00402650: __fread_nolock.LIBCMT ref: 004026AA
Part of subcall function 00402650: _strncmp.LIBCMT ref: 004026D6

_malloc.LIBCMT ref: 00402EBB
_malloc.LIBCMT ref: 00402ED2
_strncpy.LIBCMT ref: 00402F14
_malloc.LIBCMT ref: 00402F3A
_malloc.LIBCMT ref: 00402F52
_strncpy.LIBCMT ref: 00402F9A

Part of subcall function 00402C40: _malloc.LIBCMT ref: 00402C44

Part of subcall function 00405FEB: DeleteFileA.KERNEL32(?,?,00403D46,?,?,?), ref: 00405FF3
Part of subcall function 00405FEB: GetLastError.KERNEL32 ref: 00405FFD
Part of subcall function 00405FEB: __dosmaperr.LIBCMT ref: 0040600C

_malloc.LIBCMT ref: 00402FCD
_malloc.LIBCMT ref: 00402FEB
_malloc.LIBCMT ref: 00403032

Strings

.tmp, xrefs: 004030A8

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _malloc$_strncpy$AllocateDeleteErrorFileHeapLastSleep__dosmaperr__fread_nolock_fseek_strncmp
String ID: .tmp
API String ID: 1077077875-2986845003
Opcode ID: 9ea4bbf3d634008f5fc82c8f363c5e8382ca436f74c39de2ba870d23d5ef5ab8
Instruction ID: 37ba2904df3d9823651b2d5de5d7e307e317590d2fb1cc1cfeef1be77dc65240
Opcode Fuzzy Hash: 9ea4bbf3d634008f5fc82c8f363c5e8382ca436f74c39de2ba870d23d5ef5ab8
Instruction Fuzzy Hash: E2B1E2B0A042029FC328DF28C981A27F7E5BF88304F14856EE5495B3C2E779E951CBD9

Function 00403B70 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 00403BD4
_fseek.LIBCMT ref: 00403C00
__wfopen_s.LIBCMT ref: 00403C17
_fseek.LIBCMT ref: 00403C45
__fread_nolock.LIBCMT ref: 00403C73
__wfopen_s.LIBCMT ref: 00403CAE
_fseek.LIBCMT ref: 00403CD5
_fseek.LIBCMT ref: 00403CE3

Part of subcall function 00405F32: __lock_file.LIBCMT ref: 00405F7D
Part of subcall function 00405F32: __fseek_nolock.LIBCMT ref: 00405F8D

__fread_nolock.LIBCMT ref: 00403D01

Strings

.tmp, xrefs: 00403BB8
wb+, xrefs: 00403C05

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _fseek$__wfopen_s$__fread_nolock$__fseek_nolock__lock_file
String ID: .tmp$wb+
API String ID: 933030327-1507332519
Opcode ID: c0094b74ebda08a865674a722f3ca168325d1cc8fe1930203f7491c5635f4751
Instruction ID: 18ac9957c6aa1dc69943f09a9cb54da27e6243f9c9932203dcdc9a45fdee6a6e
Opcode Fuzzy Hash: c0094b74ebda08a865674a722f3ca168325d1cc8fe1930203f7491c5635f4751
Instruction Fuzzy Hash: 9B51ECB15083416FE320EF65CC82FAB7798ABD4704F14493DF684672C2EA78E5448B9A

Function 004022B0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

__vswprintf.LIBCMT ref: 004022DD

Part of subcall function 00405E8E: __vsprintf_l.LIBCMT ref: 00405E9E

_printf.LIBCMT ref: 00402309
_printf.LIBCMT ref: 00402319
_printf.LIBCMT ref: 0040233F
_printf.LIBCMT ref: 00402349
_printf.LIBCMT ref: 00402330

Part of subcall function 00405D4B: __stbuf.LIBCMT ref: 00405DA1
Part of subcall function 00405D4B: __output_l.LIBCMT ref: 00405DB9
Part of subcall function 00405D4B: __ftbuf.LIBCMT ref: 00405DCA

_printf.LIBCMT ref: 00402358
__fcloseall.LIBCMT ref: 00402380

Strings

Error %d, xrefs: 00402304
Error %d, xrefs: 00402314, 00402364

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _printf$__fcloseall__ftbuf__output_l__stbuf__vsprintf_l__vswprintf
String ID: Error %d$Error %d
API String ID: 3853979076-600224260
Opcode ID: 8e5477119bb3f71064b26e893e7b6d57078d967389269548839556b3a400f9cd
Instruction ID: 49633a08206f613e657b383c6326dce30d920fae71d15d53b22ebbfa9e1a2462
Opcode Fuzzy Hash: 8e5477119bb3f71064b26e893e7b6d57078d967389269548839556b3a400f9cd
Instruction Fuzzy Hash: 6711A1B2500200ABD630B7758E4BBEB76949FE5704F14483FB988752C1E6BCD54489AF

Function 00406E0C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004178F8,0000000C,00406F47,00000000,00000000,?,00000000,?,0040101B,?,?,00415C90), ref: 00406E1E
__crt_waiting_on_module_handle.LIBCMT ref: 00406E29

Part of subcall function 00405408: Sleep.KERNEL32(000003E8,00000000,?,00406D6F,KERNEL32.DLL,?,00406DBB,?,00000000,?,0040101B,?,?,00415C90), ref: 00405414
Part of subcall function 00405408: GetModuleHandleW.KERNEL32(?,?,00406D6F,KERNEL32.DLL,?,00406DBB,?,00000000,?,0040101B,?,?,00415C90), ref: 0040541D

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00406E52
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00406E62
__lock.LIBCMT ref: 00406E84
InterlockedIncrement.KERNEL32(00420138), ref: 00406E91
__lock.LIBCMT ref: 00406EA5
___addlocaleref.LIBCMT ref: 00406EC3

Strings

EncodePointer, xrefs: 00406E46
KERNEL32.DLL, xrefs: 00406E18, 00406E1D, 00406E28
DecodePointer, xrefs: 00406E5A

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: c93c9f14678bb327ce72342197a0b131b4ce90c27da7fa20a8dfa6764ac69880
Instruction ID: 370c4a453f9527b03cbd195256e81a95704cfde9a7854f7aacd47b981beba66d
Opcode Fuzzy Hash: c93c9f14678bb327ce72342197a0b131b4ce90c27da7fa20a8dfa6764ac69880
Instruction Fuzzy Hash: 0C11C3709447009ED7109F7AC80179ABBE4AF04318F10852FE499A63D1C778A941CF9D

Function 004039A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111sleepCOMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 004039DC
Sleep.KERNEL32(000000FA), ref: 004039F5

Part of subcall function 004022B0: __vswprintf.LIBCMT ref: 004022DD
Part of subcall function 004022B0: _printf.LIBCMT ref: 00402309
Part of subcall function 004022B0: __fcloseall.LIBCMT ref: 00402380

__wfopen_s.LIBCMT ref: 00403A1C
Sleep.KERNEL32(000000FA), ref: 00403A35
_fseek.LIBCMT ref: 00403A5E
_ftell.LIBCMT ref: 00403A68
_fseek.LIBCMT ref: 00403A78
__fread_nolock.LIBCMT ref: 00403A91

Strings

ab+, xrefs: 004039D0

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: Sleep__wfopen_s_fseek$__fcloseall__fread_nolock__vswprintf_ftell_printf
String ID: ab+
API String ID: 669739137-1294174304
Opcode ID: 4b32efcf49464804236c7e0260b134c629de66e68d2961c99cc564dce9fe2c18
Instruction ID: 862efc8666cd4963f9580d00043b2002f28743bc2b2c21e88ba1549d5625bc52
Opcode Fuzzy Hash: 4b32efcf49464804236c7e0260b134c629de66e68d2961c99cc564dce9fe2c18
Instruction Fuzzy Hash: 6731E8B2A043006BD220EF65CC42F6BB6ACABC5704F04493EF695771C1D678E9058BAB

Function 004031C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004031FB

Part of subcall function 004046BA: __FF_MSGBANNER.LIBCMT ref: 004046DD
Part of subcall function 004046BA: __NMSG_WRITE.LIBCMT ref: 004046E4
Part of subcall function 004046BA: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00404731

Part of subcall function 004026F0: GetDiskFreeSpaceExA.KERNEL32 ref: 0040270E

_malloc.LIBCMT ref: 00403242
_malloc.LIBCMT ref: 004032CB

Strings

ReadMe.txt, xrefs: 0040334A

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _malloc$AllocateDiskFreeHeapSpace
String ID: ReadMe.txt
API String ID: 2338698063-1789431278
Opcode ID: 931e0a5ece422a68a42c3ef7e03972e06dc0890a145eb5b81c3e80848ac20664
Instruction ID: 46175a259f093b081afdc5a53347db39955771dd1f1fb6107be6ec15acc1f33a
Opcode Fuzzy Hash: 931e0a5ece422a68a42c3ef7e03972e06dc0890a145eb5b81c3e80848ac20664
Instruction Fuzzy Hash: 408109715043419BC714DF25D891AABB7E8BFC9304F04897EF88997381E739EA08C79A

Function 00401311 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0040131C
_strcpy_s.LIBCMT ref: 00401341
__wfopen_s.LIBCMT ref: 0040136D
_strlen.LIBCMT ref: 00401388

Strings

update.log, xrefs: 00401336
ab+, xrefs: 00401366

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _strlen$__wfopen_s_strcpy_s
String ID: ab+$update.log
API String ID: 2601613033-2574336263
Opcode ID: 978d86f40e704335e5815c714d73de1e400675b37cd3ea472732b76ee38d6999
Instruction ID: 8753d6b4cb48f81154bdc3ce0a9135871b943940d455b6ce72dfcc4232a15052
Opcode Fuzzy Hash: 978d86f40e704335e5815c714d73de1e400675b37cd3ea472732b76ee38d6999
Instruction Fuzzy Hash: 9601B1B1912204FBEB11AB51DD02BCE3A64AF40758F600037F904790E2E7BD5B809A9D

Function 0040118E Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 004011B8

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _strtok
String ID:
API String ID: 1675499619-0
Opcode ID: 6a703242efe55d424a99105dcb90bf55d0f93dc5dbf6e352152614512f81314c
Instruction ID: 8048e60ad9a14299f83927c1cd8c71b889c9f891cc99d35ec7a6fe31f88e3d20
Opcode Fuzzy Hash: 6a703242efe55d424a99105dcb90bf55d0f93dc5dbf6e352152614512f81314c
Instruction Fuzzy Hash: C23106366043466ADB10BAB59C82FDF27DC9B41354F10017FFA05F61D2EA7C894582AD

Function 00402B50 Relevance: 9.1, APIs: 6, Instructions: 92sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00402650: Sleep.KERNEL32(000000FA), ref: 00402680
Part of subcall function 00402650: _fseek.LIBCMT ref: 0040269B
Part of subcall function 00402650: __fread_nolock.LIBCMT ref: 004026AA
Part of subcall function 00402650: _strncmp.LIBCMT ref: 004026D6

Part of subcall function 0040493B: __fsopen.LIBCMT ref: 00404948

Sleep.KERNEL32(000000FA,?,?), ref: 00402B90
_fseek.LIBCMT ref: 00402BAB
_fseek.LIBCMT ref: 00402BCF
_malloc.LIBCMT ref: 00402BE6
_fseek.LIBCMT ref: 00402BF2
_malloc.LIBCMT ref: 00402C06

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _fseek$Sleep_malloc$__fread_nolock__fsopen_strncmp
String ID:
API String ID: 1639090907-0
Opcode ID: a21f36b184e389274e83b6429785d2aff77163b6d95a59808c5afae02f190621
Instruction ID: 8003af9ef2f5da178f51b093a37a81b4dae3e384dfd4f4c9dd704a419efdd0ab
Opcode Fuzzy Hash: a21f36b184e389274e83b6429785d2aff77163b6d95a59808c5afae02f190621
Instruction Fuzzy Hash: 97213BB594421066DB207F668D86F6B77A89F41728F04413EF9097A2C3E97DE80182BE

Function 00402A10 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,00000000,00000000), ref: 00402A7A

Part of subcall function 0040493B: __fsopen.LIBCMT ref: 00404948

_malloc.LIBCMT ref: 00402ADD

Strings

Messages.txt, xrefs: 00402A4F

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: CopyFile__fsopen_malloc
String ID: Messages.txt
API String ID: 2574532697-927597410
Opcode ID: f6fcf69aa9c912b755bf916f682d5a90e107dbff799cd7994e606d2e7586e9eb
Instruction ID: 3eacb031f304ec70200b1f3a7947c44c7a13ab544bd14205e8b22d2f6a377069
Opcode Fuzzy Hash: f6fcf69aa9c912b755bf916f682d5a90e107dbff799cd7994e606d2e7586e9eb
Instruction Fuzzy Hash: 2F3107706043455FD720EB249D81BEB77E89B95704F41443EE989973C2FBB9A404C79A

Function 004015D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 004015EB
GetProcAddress.KERNEL32(00000000), ref: 004015F2
GetCurrentProcess.KERNEL32(00000000), ref: 00401602

Strings

kernel32, xrefs: 004015E6
IsWow64Process, xrefs: 004015E1

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: b2aca0ec7bf92af278214477662a4d3f7d5c5d7740f1b72562a74feca57423ff
Instruction ID: 9a3b83f776da344963104e0b8a714f039fee01f3c7fa5efd94b2982bb78a5a7f
Opcode Fuzzy Hash: b2aca0ec7bf92af278214477662a4d3f7d5c5d7740f1b72562a74feca57423ff
Instruction Fuzzy Hash: 76E0E676941714F7CB1097E4DD0DACE7B6CEB48799B114451B901E3150D778DA0486E8

Function 00403490 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 004034E2
_fseek.LIBCMT ref: 0040351B
_malloc.LIBCMT ref: 00403526
__fread_nolock.LIBCMT ref: 0040354D
_malloc.LIBCMT ref: 00403569

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _fseek_malloc$__fread_nolock
String ID:
API String ID: 4292992340-0
Opcode ID: b17d128d1fee479573328fadd862354f9c26940b3acd077026021a0d8309b77c
Instruction ID: b6225a47b14886cf5607417cd21ea5aeae2a00ed47b3fc5580effaca9e4b2edd
Opcode Fuzzy Hash: b17d128d1fee479573328fadd862354f9c26940b3acd077026021a0d8309b77c
Instruction Fuzzy Hash: AF4109B19043107BD521AE655C82F6F769CEBC1B14F04093EF984762C2F67D9A0587EB

Function 00403610 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 0040493B: __fsopen.LIBCMT ref: 00404948

_fseek.LIBCMT ref: 00403670
_fseek.LIBCMT ref: 0040367A
_malloc.LIBCMT ref: 00403688
__fread_nolock.LIBCMT ref: 004036B1
_malloc.LIBCMT ref: 004036CF

Part of subcall function 004022B0: __vswprintf.LIBCMT ref: 004022DD
Part of subcall function 004022B0: _printf.LIBCMT ref: 00402309
Part of subcall function 004022B0: __fcloseall.LIBCMT ref: 00402380

Part of subcall function 004049A5: __lock.LIBCMT ref: 004049C3
Part of subcall function 004049A5: ___sbh_find_block.LIBCMT ref: 004049CE
Part of subcall function 004049A5: ___sbh_free_block.LIBCMT ref: 004049DD
Part of subcall function 004049A5: HeapFree.KERNEL32(00000000,?,004177D0,0000000C,0040739F,00000000,00417948,0000000C,004073D9,?,?,?,00411421,00000004,00417C38,0000000C), ref: 00404A0D
Part of subcall function 004049A5: GetLastError.KERNEL32(?,00411421,00000004,00417C38,0000000C,0040E691,?,?,00000000,00000000,00000000,?,00406F1E,00000001,00000214), ref: 00404A1E

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _fseek_malloc$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__fcloseall__fread_nolock__fsopen__lock__vswprintf_printf
String ID:
API String ID: 1382160792-0
Opcode ID: 26e2c6dfb10ae880395ccc8cab07e0334f8c5e11a5d8db95b1e7772bda4d1d93
Instruction ID: 3eeebca1c346b6f77922f680f9f337c9749621d28cbe54a08cd24c51514e10b8
Opcode Fuzzy Hash: 26e2c6dfb10ae880395ccc8cab07e0334f8c5e11a5d8db95b1e7772bda4d1d93
Instruction Fuzzy Hash: 5D31E5F19403113AD120BEA25C82F6B759C9B91B15F10093EFD54762C2F6BE9A0542FA

Function 00401A34 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00401A5B

Part of subcall function 004046BA: __FF_MSGBANNER.LIBCMT ref: 004046DD
Part of subcall function 004046BA: __NMSG_WRITE.LIBCMT ref: 004046E4
Part of subcall function 004046BA: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 00404731

Part of subcall function 00402B50: Sleep.KERNEL32(000000FA,?,?), ref: 00402B90
Part of subcall function 00402B50: _fseek.LIBCMT ref: 00402BAB
Part of subcall function 00402B50: _fseek.LIBCMT ref: 00402BCF
Part of subcall function 00402B50: _malloc.LIBCMT ref: 00402BE6
Part of subcall function 00402B50: _fseek.LIBCMT ref: 00402BF2
Part of subcall function 00402B50: _malloc.LIBCMT ref: 00402C06

_strcat.LIBCMT ref: 00401A7F
_strncat.LIBCMT ref: 00401A8C
_strcat.LIBCMT ref: 00401AB8
_strncat.LIBCMT ref: 00401ACC

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _fseek_malloc$_strcat_strncat$AllocateHeapSleep
String ID:
API String ID: 4099709153-0
Opcode ID: ba5bf949d4ad24f7aadd043d2b5d4d6bd326073b62294adc8feddded278aaa32
Instruction ID: 4c486aade4d108400fa8c8343c85ae053f1b59c45874b80b17de3f84fc053f14
Opcode Fuzzy Hash: ba5bf949d4ad24f7aadd043d2b5d4d6bd326073b62294adc8feddded278aaa32
Instruction Fuzzy Hash: 75210775600114ABCB20EFA6CD41E9B77B8AF89714F00447AF145E71D1DA78E9818F98

Function 00401032 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0040103B
_strlen.LIBCMT ref: 00401060
_strlen.LIBCMT ref: 00401074
_strlen.LIBCMT ref: 00401084
_strlen.LIBCMT ref: 004010A1

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 23fbe9b6ad5bed6b898c158665aeefe29976a05bf6fd13301e6f89663f8d438e
Instruction ID: 1b00dbdc83848280184812239523aa17ce44544585329b6842cfcccb6d514d03
Opcode Fuzzy Hash: 23fbe9b6ad5bed6b898c158665aeefe29976a05bf6fd13301e6f89663f8d438e
Instruction Fuzzy Hash: 3001891E0085EA1AE33625BE2880BFB57494A43794B54013BDAC0B7BE6A57D88C341BD

Function 0040DC32 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040DC3E

Part of subcall function 00406F6C: __getptd_noexit.LIBCMT ref: 00406F6F
Part of subcall function 00406F6C: __amsg_exit.LIBCMT ref: 00406F7C

__amsg_exit.LIBCMT ref: 0040DC5E
__lock.LIBCMT ref: 0040DC6E
InterlockedDecrement.KERNEL32(?), ref: 0040DC8B
InterlockedIncrement.KERNEL32(02481660), ref: 0040DCB6

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 81e311dddf522e7d3084aa7a70a752c3268e01e8a930758be3bab5eebd167faf
Instruction ID: e617878ee2f16a8e25a8b4d4c559af0235a3eabdace909a070287724ea69338b
Opcode Fuzzy Hash: 81e311dddf522e7d3084aa7a70a752c3268e01e8a930758be3bab5eebd167faf
Instruction Fuzzy Hash: 3401A531E09711ABE720ABA9990579A77A07F04714F00003BE804B77C1C77C6946CBDE

Function 004049A5 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 004049C3

Part of subcall function 004073BE: __mtinitlocknum.LIBCMT ref: 004073D4
Part of subcall function 004073BE: __amsg_exit.LIBCMT ref: 004073E0
Part of subcall function 004073BE: RtlEnterCriticalSection.NTDLL(?), ref: 004073E8

___sbh_find_block.LIBCMT ref: 004049CE
___sbh_free_block.LIBCMT ref: 004049DD
HeapFree.KERNEL32(00000000,?,004177D0,0000000C,0040739F,00000000,00417948,0000000C,004073D9,?,?,?,00411421,00000004,00417C38,0000000C), ref: 00404A0D
GetLastError.KERNEL32(?,00411421,00000004,00417C38,0000000C,0040E691,?,?,00000000,00000000,00000000,?,00406F1E,00000001,00000214), ref: 00404A1E

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 89c0ff2ed7c23e1dd56953e22bf33076d678943e9418c9a16457b95e7bd3d70b
Instruction ID: 84755761099dd51f23b0207d8ba843017362870df5e383530f9929849ac19495
Opcode Fuzzy Hash: 89c0ff2ed7c23e1dd56953e22bf33076d678943e9418c9a16457b95e7bd3d70b
Instruction Fuzzy Hash: 4001A7B1E45201EADB20ABB29D0A79F3A64AF40768F20403FF600761C1CA3C99409F9D

Function 00402CA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00402650: Sleep.KERNEL32(000000FA), ref: 00402680
Part of subcall function 00402650: _fseek.LIBCMT ref: 0040269B
Part of subcall function 00402650: __fread_nolock.LIBCMT ref: 004026AA
Part of subcall function 00402650: _strncmp.LIBCMT ref: 004026D6

Sleep.KERNEL32(000000FA,?,?,?,?,00403145,?,00000000,?,00000000,?), ref: 00402CF1
_fseek.LIBCMT ref: 00402D10

Part of subcall function 00402C40: _malloc.LIBCMT ref: 00402C44

Part of subcall function 004022B0: __vswprintf.LIBCMT ref: 004022DD
Part of subcall function 004022B0: _printf.LIBCMT ref: 00402309
Part of subcall function 004022B0: __fcloseall.LIBCMT ref: 00402380

Strings

ab+, xrefs: 00402CD2
AHXX, xrefs: 00402DA5

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: Sleep_fseek$__fcloseall__fread_nolock__vswprintf_malloc_printf_strncmp
String ID: AHXX$ab+
API String ID: 4212895356-2189246863
Opcode ID: aa5074da67624f636bc94e4a837e2084076de8f3a3d0ea4624bec317f6683db4
Instruction ID: 36c90d3fd171ca64309d4177e0d021297623ecf75b3871874227e348100f8a01
Opcode Fuzzy Hash: aa5074da67624f636bc94e4a837e2084076de8f3a3d0ea4624bec317f6683db4
Instruction Fuzzy Hash: 3A3116B5604110ABD720AF16CDC6F6B7799AF85308F04807AF9056F2C3D779EC4287AA

Function 00402740 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,74DE8B60,?), ref: 0040276D

Part of subcall function 0040493B: __fsopen.LIBCMT ref: 00404948

__fread_nolock.LIBCMT ref: 0040280E
__fread_nolock.LIBCMT ref: 0040283B

Strings

Target.exe, xrefs: 004027C8

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __fread_nolock$FileModuleName__fsopen
String ID: Target.exe
API String ID: 2117439025-950882348
Opcode ID: a72cc3f7129ac1c3e1d76f16084bbd8381b00982c090409cd93cb19dfcc02525
Instruction ID: 14f32651891ab7ca99fda4062542255699bf2445bfe1a4bb10b185fa9a7fd621
Opcode Fuzzy Hash: a72cc3f7129ac1c3e1d76f16084bbd8381b00982c090409cd93cb19dfcc02525
Instruction Fuzzy Hash: 263148756043405BD320EB359D85FD777D4AFC9300F05803EFA88AB3D2EA79940983AA

Function 004025A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004025B8
_strncpy.LIBCMT ref: 004025DE
__fread_nolock.LIBCMT ref: 004025F1

Part of subcall function 004022B0: __vswprintf.LIBCMT ref: 004022DD
Part of subcall function 004022B0: _printf.LIBCMT ref: 00402309
Part of subcall function 004022B0: __fcloseall.LIBCMT ref: 00402380

Strings

loadAppendixEntry, xrefs: 004025C5

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __fread_nolock$__fcloseall__vswprintf_printf_strncpy
String ID: loadAppendixEntry
API String ID: 2454332532-1848498687
Opcode ID: 6cfc6128c87d84d3316c368bd86132e255f16fb7bb7e7b0528be50d13663434e
Instruction ID: a2ae9de9f5ce6144e48f3da8598412fb7f2ab621182596fac52061c18583e269
Opcode Fuzzy Hash: 6cfc6128c87d84d3316c368bd86132e255f16fb7bb7e7b0528be50d13663434e
Instruction Fuzzy Hash: 1A01BEB19043407AE620FF664C07F5BB7E89F85B04F408D6EF554661D2E6F8910487AB

Function 0040CE1A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040584B), ref: 0040CE1F
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040CE2F

Strings

KERNEL32, xrefs: 0040CE1A
IsProcessorFeaturePresent, xrefs: 0040CE29

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 278876fe050b092a17d163973210eb19038aff7eefd944aef3556e15ebeade95
Instruction ID: 3d953e03e469096359f81002a8816d2acfd62e72651eef726d163bcf37c06b7f
Opcode Fuzzy Hash: 278876fe050b092a17d163973210eb19038aff7eefd944aef3556e15ebeade95
Instruction Fuzzy Hash: 61F01D30A00A0DD2DB001BA5ED4E6AF7A79FB80746F9205A195D5B00C4DE34C0B5D2DA

Function 00401DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28registryCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00401E1A
RegisterClassExA.USER32(00000030), ref: 00401E3C

Strings

0, xrefs: 00401DF9
Window, xrefs: 00401E23

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$Window
API String ID: 1693014935-3868708051
Opcode ID: 2edf8ed269dab38aaddf65b2fc2e006d855c7ef136a6be0691d672e015d157bc
Instruction ID: 19b5dac3f314ba373096e42b926c340972aae28eb5609f511956d6f05cda5a0c
Opcode Fuzzy Hash: 2edf8ed269dab38aaddf65b2fc2e006d855c7ef136a6be0691d672e015d157bc
Instruction Fuzzy Hash: 85F092B1C11228ABCB01DF98D9496DEBFB8BB08704F50812AE404B6240D3B84A05CFD8

Function 00403180 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_printf.LIBCMT ref: 004031A8
_printf.LIBCMT ref: 004031B6

Strings

%d files compressed and added successfully to %s, xrefs: 004031B1
%d files added successfully to %s, xrefs: 004031A3

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _printf
String ID: %d files added successfully to %s$%d files compressed and added successfully to %s
API String ID: 723836530-2584807077
Opcode ID: 79809b5fa3fbe735bbce4060b7cdd4cf33db6ebb1866b4b113656256bca825aa
Instruction ID: 719c7f7874df1082bfcb9ca8da80f4d50e1cbe676ac997e25a0c3758f51fe535
Opcode Fuzzy Hash: 79809b5fa3fbe735bbce4060b7cdd4cf33db6ebb1866b4b113656256bca825aa
Instruction Fuzzy Hash: 37D0C2B2D8063432D83225125C4BFE7680DCB60F95F86407FBC08782C2E0BECA4485FA

Function 00414166 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(T4@,00000000,00403454,?), ref: 0041416E
GetLastError.KERNEL32 ref: 00414178
__dosmaperr.LIBCMT ref: 00414187

Strings

T4@, xrefs: 0041416B

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: DirectoryErrorLastRemove__dosmaperr
String ID: T4@
API String ID: 4061612599-1493363993
Opcode ID: b60becf4e369671bb11eed667a8f7553dc9830da5dc1b4e27e4af324fd980eda
Instruction ID: b1c379bf969d63926bb224c0a2c4e692d88dab086508e548b84942566873d674
Opcode Fuzzy Hash: b60becf4e369671bb11eed667a8f7553dc9830da5dc1b4e27e4af324fd980eda
Instruction Fuzzy Hash: DED05E3125460AB68B001BF6BC0C9DB3F5DAAD13743508936F41CC1190EE39CCC09058

Function 0040FFA4 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040FFD8
__isleadbyte_l.LIBCMT ref: 0041000C
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,75FF5003,00BFBBEF,00000000,?,?,?,0040F44D,00000109,00BFBBEF,00000003), ref: 0041003D
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,0040F44D,00000109,00BFBBEF,00000003), ref: 004100AB

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c6e65ad2396201a31396ff49d2e056812b876317f5d4d6a8b17c88786ae9998c
Instruction ID: 8bbd8488c1e8a46f27f4758db847ebc68d80bf04ad459b20f6593d2b3a7dbc8d
Opcode Fuzzy Hash: c6e65ad2396201a31396ff49d2e056812b876317f5d4d6a8b17c88786ae9998c
Instruction Fuzzy Hash: 1A31DF30A00296EFCB20DF64C880AAE3BA5FF06311B14857BF4659B2D1E775C984DB99

Function 0040CD06 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040CD2C

Part of subcall function 0040CB51: __fltout2.LIBCMT ref: 0040CB7D

__cftog_l.LIBCMT ref: 0040CD52
__cftoe_l.LIBCMT ref: 0040CD84

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 4c89a29667a6a644c93cfcc237eb108a22ca2270e76d77b3e81f939bd98d48fb
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 6C116036000149FBCF125F84CC91CEE3F22BF19354B588626FA5869170D23AC972AB85

Function 00403AF0 Relevance: 6.0, APIs: 4, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 00403B0C
Sleep.KERNEL32(000000FA), ref: 00403B25
_fseek.LIBCMT ref: 00403B44
_ftell.LIBCMT ref: 00403B4E

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: Sleep__wfopen_s_fseek_ftell
String ID:
API String ID: 1505929214-0
Opcode ID: b3d6d89ea08bfaef7207b80891168195adeb8ff2e64cdcc1383dd4582f542d2d
Instruction ID: a6b85ff962b1b7f914773e7661d2fde02549b559be859891dbfccd327188d66b
Opcode Fuzzy Hash: b3d6d89ea08bfaef7207b80891168195adeb8ff2e64cdcc1383dd4582f542d2d
Instruction Fuzzy Hash: 91F0D6B2A042106AD120EA56CC46F4BB7ACDBD5728F11453EF645731C2D278E90187AA

Function 0040E39E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040E3AA

Part of subcall function 00406F6C: __getptd_noexit.LIBCMT ref: 00406F6F
Part of subcall function 00406F6C: __amsg_exit.LIBCMT ref: 00406F7C

__getptd.LIBCMT ref: 0040E3C1
__amsg_exit.LIBCMT ref: 0040E3CF
__lock.LIBCMT ref: 0040E3DF

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: dd8fc863e8f885b3c561b8df2c5cb76211283750ad3f1d1176e03c5728d6e8d8
Instruction ID: be2d1a64a67f66b6d49fb417a76dbfb2d431602fb7aad831492336e3cfa94afe
Opcode Fuzzy Hash: dd8fc863e8f885b3c561b8df2c5cb76211283750ad3f1d1176e03c5728d6e8d8
Instruction Fuzzy Hash: 7CF06231944710CAD720BB77D40674A76A0AB00724F514A7FB841B72D2CB7CA8519B9E

Function 00403268 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113fileCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004032CB
CopyFileA.KERNEL32(?,?,00000000), ref: 00403380

Strings

ReadMe.txt, xrefs: 0040334A

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: CopyFile_malloc
String ID: ReadMe.txt
API String ID: 656287990-1789431278
Opcode ID: 3864d7a58a2ede866a744287c8fec881c84d35688d2b0279a4daea497b2f4607
Instruction ID: 34c1bd59c38787f9ef00acb25da45058d6ef4a0886a37208756b6f2f2863ea9f
Opcode Fuzzy Hash: 3864d7a58a2ede866a744287c8fec881c84d35688d2b0279a4daea497b2f4607
Instruction Fuzzy Hash: B241E1702042428FC715CF2894A09A7BBE5EF9A304F1485BEECC59B3A1DB35EA09C795

Function 00402450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 0040493B: __fsopen.LIBCMT ref: 00404948

_fseek.LIBCMT ref: 004024C8
__fread_nolock.LIBCMT ref: 004024EC

Part of subcall function 004022B0: __vswprintf.LIBCMT ref: 004022DD
Part of subcall function 004022B0: _printf.LIBCMT ref: 00402309
Part of subcall function 004022B0: __fcloseall.LIBCMT ref: 00402380

Strings

wb+, xrefs: 00402493

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __fcloseall__fread_nolock__fsopen__vswprintf_fseek_printf
String ID: wb+
API String ID: 390474772-1434998690
Opcode ID: cb3be42f533742ed902167bdcb2c3c63011ca4700bd618292155323f51da8213
Instruction ID: ac44070a1f7cc776ba13a6f684cee5ab7e46ed3b197c9fbe6b39a1c9c301d360
Opcode Fuzzy Hash: cb3be42f533742ed902167bdcb2c3c63011ca4700bd618292155323f51da8213
Instruction Fuzzy Hash: 6F21B4F29002003BD721AE659D86FBB765CABC5318F04453EF948722C2E9BD990543BA

Function 004013FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00401480

Strings

Exit Code = %d (%s), xrefs: 004014BA
Exit Code = %d (SUCCESS), xrefs: 004014A5

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: swprintf
String ID: Exit Code = %d (%s)$Exit Code = %d (SUCCESS)
API String ID: 233258989-98890273
Opcode ID: 1ab350eb4244525582af5ebeea66bdccec0f06b0ed0fcc4db9d3b94c07057b6f
Instruction ID: edc2077cb815b9ce99a6c7c69256a64476b0036bde7191caedbb070315da29aa
Opcode Fuzzy Hash: 1ab350eb4244525582af5ebeea66bdccec0f06b0ed0fcc4db9d3b94c07057b6f
Instruction Fuzzy Hash: 1A21B772C0172676EB20BA758C46FAF325C5F01768F55413BF904BB2F2E67C994081AE

Function 004010B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004010B9

Strings

QA, xrefs: 004010EB

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: _strlen
String ID: QA
API String ID: 4218353326-1179289999
Opcode ID: a8d11eb3ef38a85dbdc09f48ff4fd92956afbae64ba74dd0aa2e2847e573e60f
Instruction ID: aa28490803a7165b5ef98f90feedd0a1fa81f26eb6cb4971e131ca711d2ab4ff
Opcode Fuzzy Hash: a8d11eb3ef38a85dbdc09f48ff4fd92956afbae64ba74dd0aa2e2847e573e60f
Instruction Fuzzy Hash: 41F059339082612AE7240512BC0274B6B81ABC0778F25883FF548B54F1E77E89C4159D

Function 00403850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00403876
__wcstoui64.LIBCMT ref: 0040389D

Part of subcall function 004022B0: __vswprintf.LIBCMT ref: 004022DD
Part of subcall function 004022B0: _printf.LIBCMT ref: 00402309
Part of subcall function 004022B0: __fcloseall.LIBCMT ref: 00402380

Strings

ReadIntFromFile, xrefs: 00403883

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __fcloseall__fread_nolock__vswprintf__wcstoui64_printf
String ID: ReadIntFromFile
API String ID: 985187543-3473613045
Opcode ID: e6eceb80573a1a7a8e269e1e1e216eba209d3fd0d6775ae1fe7d02717fd72f6b
Instruction ID: 31e979536ebfa4fa8f718abca7e187700f6df70b53f4c26c056aa020dd9aba05
Opcode Fuzzy Hash: e6eceb80573a1a7a8e269e1e1e216eba209d3fd0d6775ae1fe7d02717fd72f6b
Instruction Fuzzy Hash: 5AF0B4B1A183006BD614EF24DC43B5B77D0AB84704F508D3EF549A62D1F6789118875B

Function 004038C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004038D7
__wcstoui64.LIBCMT ref: 004038FE

Part of subcall function 004022B0: __vswprintf.LIBCMT ref: 004022DD
Part of subcall function 004022B0: _printf.LIBCMT ref: 00402309
Part of subcall function 004022B0: __fcloseall.LIBCMT ref: 00402380

Strings

ReadShortFromFile, xrefs: 004038E4

Memory Dump Source

Source File: 00000000.00000002.1668544809.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668521710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668544809.0000000000436000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668643905.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668664027.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_flupdate.jbxd

Similarity

API ID: __fcloseall__fread_nolock__vswprintf__wcstoui64_printf
String ID: ReadShortFromFile
API String ID: 985187543-2101736889
Opcode ID: 472770fdc4e90951eaf27427f3ecdbdbecaa1354d98841b549ba467b5e190b03
Instruction ID: f030ab604bc500c78fd9def6e026a44a33565679af9ae8dcb61d94eb4ce200a8
Opcode Fuzzy Hash: 472770fdc4e90951eaf27427f3ecdbdbecaa1354d98841b549ba467b5e190b03
Instruction Fuzzy Hash: 77E026B954830036F110BB588C43F9B32949B80B04F804D1DF718751E2F2F8A24442AF

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report flupdate.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: flupdate.exePID: 7512, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: flupdate.exePID: 7512, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 00401E45 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 230filesynchronizationCOMMON

Control-flow Graph

Function 00401834 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 61nativewindowCOMMON

Control-flow Graph

Windows Analysis Report
flupdate.exe

Function 00401E45 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 230
filesynchronizationCOMMON

Function 00401834 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 61
nativewindowCOMMON

Function 004376D0 Relevance: 7.7, APIs: 5, Instructions: 162
COMMON

Function 00405BF2 Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Function 004017AC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52
COMMON

Function 00404A33 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Function 00402650 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
sleepCOMMON

Function 00404C3D Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 004047FB Relevance: 3.0, APIs: 2, Instructions: 39
COMMONLIBRARYCODE

Function 0040548C Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 004080AC Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 0040493B Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Function 004056A8 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON