Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1562442
MD5:	0694a17da60d94bc3309098b233aef78
SHA1:	c5c79592819ea20caf0d2223b4404283fd32c702
SHA256:	881fb060bd03a238a1c2b9221d15d28df8705870680c17ac5070510ec6355e2d
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

LummaC encrypted strings found

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 5200 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 0694A17DA60D94BC3309098B233AEF78)

more.com (PID: 6596 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 4540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Gosse.com (PID: 3452 cmdline: C:\Users\user~1\AppData\Local\Temp\Gosse.com MD5: 3F58A517F1F4796225137E7659AD2ADB)

WerFault.exe (PID: 6168 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 340 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["p10tgrace.sbs", "3xp3cts1aim.sbs", "s1gn1fyh0se.cyou", "p3ar11fter.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "Dvh8ui--111"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Users\user~1\AppData\Local\Temp\Gosse.com, CommandLine: C:\Users\user~1\AppData\Local\Temp\Gosse.com, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\Gosse.com, NewProcessName: C:\Users\user\AppData\Local\Temp\Gosse.com, OriginalFileName: C:\Users\user\AppData\Local\Temp\Gosse.com, ParentCommandLine: C:\Windows\SysWOW64\more.com, ParentImage: C:\Windows\SysWOW64\more.com, ParentProcessId: 6596, ParentProcessName: more.com, ProcessCommandLine: C:\Users\user~1\AppData\Local\Temp\Gosse.com, ProcessId: 3452, ProcessName: Gosse.com

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Setup.exe

Avira: detected

Found malware configuration

Source: more.com.6596.6.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["p10tgrace.sbs", "3xp3cts1aim.sbs", "s1gn1fyh0se.cyou", "p3ar11fter.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "Dvh8ui--111"}

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 24%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: peepburry828.sbs
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: p10tgrace.sbs
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: processhol.sbs
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: s1gn1fyh0se.cyou
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source:	Binary string: wntdll.pdbUGP source: Setup.exe, 00000000.00000002.1394975504.0000000006C1C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1399354158.00000000071C0000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000006.00000002.2547493779.0000000004B15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2548312860.0000000005060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Setup.exe, 00000000.00000002.1394975504.0000000006C1C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1399354158.00000000071C0000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000006.00000002.2547493779.0000000004B15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2548312860.0000000005060000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0059C0D2 FindFirstFileExW,	8_2_0059C0D2
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005DA187 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_005DA187
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005CE180 GetFileAttributesW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_005CE180
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005DA2E4 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_005DA2E4
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005DA66E FindFirstFileW,Sleep,FindNextFileW,FindClose,	8_2_005DA66E
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005D686D FindFirstFileW,FindNextFileW,FindClose,	8_2_005D686D
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005CE9BA GetFileAttributesW,FindFirstFileW,FindClose,	8_2_005CE9BA
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005D74F0 FindFirstFileW,FindClose,	8_2_005D74F0
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005D7591 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	8_2_005D7591
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005CDE32 GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_005CDE32

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: s1gn1fyh0se.cyou
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005DD935 InternetReadFile,SetEvent,GetLastError,SetEvent,

8_2_005DD935

Source: Setup.exe	String found in binary or memory: http://%ipFTPftp://%ipPingcmd.exe/K
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com, 00000008.00000000.1398291303.0000000000635000.00000002.00000001.01000000.00000008.sdmp, Gosse.com.6.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Setup.exe, 00000000.00000002.1401884047.0000000007432000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: Setup.exe	String found in binary or memory: http://www.mylanviewer.com/myshowip.php
Source: Setup.exe	String found in binary or memory: http://www.mylanviewer.com/myshowip.phpMyLanViewerhttp://www.mylanviewer.com/myshowip.php0
Source: Setup.exe	String found in binary or memory: http://www.mylanviewer.com/showip.php
Source: Setup.exe	String found in binary or memory: http://www.mylanviewer.com/showip.phpl
Source: Setup.exe	String found in binary or memory: http://www.mylanviewer.com/version2.txt
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Gosse.com.6.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: Setup.exe	String found in binary or memory: https://www.mylanviewer.com/home.html
Source: Setup.exe	String found in binary or memory: https://www.mylanviewer.com/home.htmlhttps://www.mylanviewer.com/home.htmlopeniexplore.exehttps://ww
Source: Setup.exe	String found in binary or memory: https://www.mylanviewer.com/home.htmlopenhttps://www.mylanviewer.com/registers.htmlhttps://www.mylan
Source: Setup.exe	String found in binary or memory: https://www.mylanviewer.com/registers.html
Source: Setup.exe	String found in binary or memory: https://www.mylanviewer.com/registers.htmlArialRegistration
Source: Setup.exe	String found in binary or memory: https://www.mylanviewer.com/registers.htmlhttps://www.mylanviewer.com/registers.htmlopeniexplore.exe

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005DF664 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

8_2_005DF664

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005DF8D3 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

8_2_005DF8D3

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

8_2_005DF664

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005CAA95 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

8_2_005CAA95

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005F9FB4 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

8_2_005F9FB4

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0040776F NtQuerySystemInformation,

0_2_0040776F

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005CE3CB: CreateFileW,DeviceIoControl,CloseHandle,

8_2_005CE3CB

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005C230F LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

8_2_005C230F

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005CF76E ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

8_2_005CF76E

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040A375	0_2_0040A375
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040B1FD	0_2_0040B1FD
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0059E32F	8_2_0059E32F
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005824CA	8_2_005824CA
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00596599	8_2_00596599
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005EC844	8_2_005EC844
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0058C9C0	8_2_0058C9C0
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005829E3	8_2_005829E3
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0057CBF0	8_2_0057CBF0
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00596C09	8_2_00596C09
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005D2D81	8_2_005D2D81
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0056EE00	8_2_0056EE00
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0056CE20	8_2_0056CE20
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00582F23	8_2_00582F23
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00567070	8_2_00567070
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0057F0DA	8_2_0057F0DA
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005C9168	8_2_005C9168
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005F525A	8_2_005F525A
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0057D37F	8_2_0057D37F
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00587746	8_2_00587746
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005697D0	8_2_005697D0
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00587975	8_2_00587975
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00581964	8_2_00581964
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00573AD9	8_2_00573AD9
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00587BD2	8_2_00587BD2
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0056DC70	8_2_0056DC70
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00599D1E	8_2_00599D1E
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00581FC1	8_2_00581FC1

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\Gosse.com 1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48

Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: String function: 0056FA3B appears 33 times
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: String function: 0058014F appears 39 times
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: String function: 00581000 appears 41 times

Source: C:\Windows\SysWOW64\more.com

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 340

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.exe, 00000000.00000002.1399354158.00000000072ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Setup.exe
Source: Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeP vs Setup.exe
Source: Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs Setup.exe
Source: Setup.exe, 00000000.00000000.1295268522.000000000192A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLM_Support.exe8 vs Setup.exe
Source: Setup.exe, 00000000.00000002.1394975504.0000000006D3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Setup.exe
Source: Setup.exe, 00000000.00000002.1366545569.0000000006BE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLM_Support.exe8 vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameLM_Support.exe8 vs Setup.exe

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/9@0/0

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005D4573 GetLastError,FormatMessageW,

8_2_005D4573

Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005C21C9 AdjustTokenPrivileges,CloseHandle,		8_2_005C21C9
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005C27D9 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		8_2_005C27D9

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005D5D7E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

8_2_005D5D7E

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005CE2AB CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CompareStringW,CloseHandle,

8_2_005CE2AB

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005C8056 CoCreateInstance,SetErrorMode,GetProcAddress,SetErrorMode,

8_2_005C8056

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005D3DBD CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

8_2_005D3DBD

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\MyLanViewer\

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\MyLanViewerMutex
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6596

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user~1\AppData\Local\Temp\7ee79492

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe

ReversingLabs: Detection: 24%

Source: Setup.exe	String found in binary or memory: Your current external IP-address is %ip
Source: Setup.exe	String found in binary or memory: Your new external IP-address is %ipnew
Source: Setup.exe	String found in binary or memory: # To skip the line you need to put a symbol # in front of the line.ANYSounds\MessageRecv.wavSounds\MessageSent.wavSounds\FileRecv.wavSounds\FileComplete.wavsmtp.yourmaildomain.comuserMyLanViewer Notificationsuser@yourmaildomain.comuser@yourmaildomain.comMyLanViewer Notifications from ScannerMyLanViewer Notifications from HistoryMyLanViewer Notifications from FavoritesMyLanViewer Notifications from Subnet MonitoringYour current external IP-address is %ipYour current external IP-address is %ipYour new external IP-address is %ipnewYour new external IP-address is %ipnewData\Scanner\scanner.datNet.exesend Admin Scanning is finished at %tSounds\Finish.wavSounds\Finish.wavSounds\Join.wavSounds\Leave.wavSounds\New.wavSounds\Finish.wavSounds\Finish.wavSounds\Connect.wavSounds\Disconnect.wavNet.exesend Admin %ip is up at %tNet.exesend Admin %ip is down at %tNet.exesend Admin %ip is new at %tSounds\Join.wavSounds\Leave.wavSounds\New.wavNet.exesend Admin %mac is up at %tNet.exesend Admin %mac is down at %tNet.exesend Admin %mac is new at %t%mac - %ip - %hn is up at %t %d%mac - %ip - %hn is down at %t %d%mac - %ip - %hn is new at %t %d80,443.mp3 ; .wma ; *.wav192.168.0.1-254192.168.0-255.1-254 - Sample192.168.0-16,100-116,200-216.1-254 - Sample..-.-...192.168.0,10-20,30-40.1-254 - Samplecdn14.mylanviewer.comWindows Shares\\%ipWeb Browserhttp://%ipFTPftp://%ipPingcmd.exe/K ping %ip -n 10Trace routcmd.exe/K tracert %ipTelnetcmd.exe/K telnet %ipRebootcmd.exe/K shutdown -r -m \\%ipShutdowncmd.exe/K shutdown -s -m \\%ipUnknownIP AddressMAC AddressNIC VendorDNS NameFriendly NameRTTTTLHost NameWork GroupOS VersionTime of DaySystem LoadedTime ZoneLogged UsersShared ResourcesPorts\MyLanViewer\44
Source: Setup.exe	String found in binary or memory: Use %ip as IP-address; %t as Time; %d as Date
Source: Setup.exe	String found in binary or memory: Use %ip as IP-address; %hn as Host name; %mac as MAC-address;
Source: Setup.exe	String found in binary or memory: Use %mac as MAC-address; %nic as NIC vendor; %fn as friendly name;
Source: Setup.exe	String found in binary or memory: %ip as IP-address; %ip4 as IP4-address; %ip6 as IP6-address;
Source: Setup.exe	String found in binary or memory: hOkCancelUse %sr as scann result; %asr as attached file with scann result; %t as Time; %d as DateUse %ip as IP-address; %t as Time; %d as DateUse %ip as IP-address; %hn as Host name; %mac as MAC-address;
Source: Setup.exe	String found in binary or memory: %t as Time; %d as DateUse %mac as MAC-address; %nic as NIC vendor; %fn as friendly name;
Source: Setup.exe	String found in binary or memory: Use %ip as current external IP-address;
Source: Setup.exe	String found in binary or memory: Use %ipold as old external IP-address; %ipnew as new external IP-Address;
Source: Setup.exe	String found in binary or memory: hOkCancelUse %ip as current external IP-address;
Source: Setup.exe	String found in binary or memory: %t as Time; %d as DateUse %ipold as old external IP-address; %ipnew as new external IP-Address;
Source: Setup.exe	String found in binary or memory: Use %ip as IP-address; %t as Time; %d as Date.
Source: Setup.exe	String found in binary or memory: Use %mac as MAC-address; %ip4 as IP4-address; %ip6 as IP6-address; %t as Time; %d as Date.
Source: Setup.exe	String found in binary or memory: ...OkCancelUse %fp as Path to the file result; %t as Time; %d as Date.Use %ip as IP-address; %t as Time; %d as Date.Use %mac as MAC-address; %ip4 as IP4-address; %ip6 as IP6-address; %t as Time; %d as Date.ArialExecute Applicationq
Source: Setup.exe	String found in binary or memory: Use %mac as MAC-address; %nic as NIC vendor; %fn as friendly name; %ip as IP-address; %ip4 as IP4-address; %ip6 as IP6-address; %hn as Host name; %hn4 as Host name by IP4; %hn6 as host name by IP6; %t as Time; %d as Date.
Source: Setup.exe	String found in binary or memory: aUse %ipold as old external IP-address; %ipnew as new external IP-Address; %t as Time; %d as Date.

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Users\user\AppData\Local\Temp\Gosse.com C:\Users\user~1\AppData\Local\Temp\Gosse.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 340
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Users\user\AppData\Local\Temp\Gosse.com C:\Users\user~1\AppData\Local\Temp\Gosse.com	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: shdocvw.dll	Jump to behavior

Source: Setup.exe

Static PE information: More than 322 > 100 exports found

Source: Setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Setup.exe

Static file information: File size 17103832 > 1048576

Source: Setup.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2fd000
Source: Setup.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x110600
Source: Setup.exe	Static PE information: Raw size of _RDATA0 is bigger than: 0x100000 < 0x426c00
Source: Setup.exe	Static PE information: Raw size of _RDATA2 is bigger than: 0x100000 < 0x459800
Source: Setup.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x3b8800

Source:	Binary string: wntdll.pdbUGP source: Setup.exe, 00000000.00000002.1394975504.0000000006C1C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1399354158.00000000071C0000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000006.00000002.2547493779.0000000004B15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2548312860.0000000005060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Setup.exe, 00000000.00000002.1394975504.0000000006C1C000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1399354158.00000000071C0000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000006.00000002.2547493779.0000000004B15000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2548312860.0000000005060000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005EC00E RegConnectRegistryW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,RegCloseKey,LoadLibraryA,GetProcAddress,RegDeleteKeyW,FreeLibrary,RegCloseKey,

8_2_005EC00E

Source: initial sample

Static PE information: section where entry point is pointing to: _RDATA2

Source: Setup.exe	Static PE information: section name: _RDATA0
Source: Setup.exe	Static PE information: section name: _RDATA1
Source: Setup.exe	Static PE information: section name: _RDATA2
Source: xwharpgq.6.dr	Static PE information: section name: xibp

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_00581046 push ecx; ret

8_2_00581059

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\Gosse.com

Jump to dropped file

Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\Gosse.com			Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\xwharpgq			Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\xwharpgq

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005F2558 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		8_2_005F2558
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00575D03 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		8_2_00575D03

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Setup.exe	API/Special instruction interceptor: Address: 1361D02
Source: C:\Users\user\Desktop\Setup.exe	API/Special instruction interceptor: Address: 14FA8E8
Source: C:\Users\user\Desktop\Setup.exe	API/Special instruction interceptor: Address: 156A906
Source: C:\Users\user\Desktop\Setup.exe	API/Special instruction interceptor: Address: 117B469
Source: C:\Users\user\Desktop\Setup.exe	API/Special instruction interceptor: Address: 769C7C44
Source: C:\Users\user\Desktop\Setup.exe	API/Special instruction interceptor: Address: 769C7945
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 769C3B54

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Setup.exe	RDTSC instruction interceptor: First address: 769CF3E1 second address: 769CF3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Setup.exe	RDTSC instruction interceptor: First address: 769CF3FD second address: 769CF3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007FAC35238205h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007FAC35238290h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\more.com

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xwharpgq

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_0059C0D2 FindFirstFileExW,	8_2_0059C0D2
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005DA187 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_005DA187
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005CE180 GetFileAttributesW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_005CE180
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005DA2E4 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_005DA2E4
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005DA66E FindFirstFileW,Sleep,FindNextFileW,FindClose,	8_2_005DA66E
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005D686D FindFirstFileW,FindNextFileW,FindClose,	8_2_005D686D
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005CE9BA GetFileAttributesW,FindFirstFileW,FindClose,	8_2_005CE9BA
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005D74F0 FindFirstFileW,FindClose,	8_2_005D74F0
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005D7591 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	8_2_005D7591
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005CDE32 GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,DeleteFileW,CompareStringW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_005CDE32

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_0057310D GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_0057310D

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Setup.exe, 00000000.00000002.1363731118.0000000001CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.11.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\more.com	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005DF607 BlockInput,

8_2_005DF607

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_00592446 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00592446

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005EC00E RegConnectRegistryW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,RegCloseKey,LoadLibraryA,GetProcAddress,RegDeleteKeyW,FreeLibrary,RegCloseKey,

8_2_005EC00E

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00407E3F mov eax, dword ptr fs:[00000030h]		0_2_00407E3F
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00584BF4 mov eax, dword ptr fs:[00000030h]		8_2_00584BF4

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005C20BE GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

8_2_005C20BE

Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00592446 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00592446
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00580E4D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00580E4D
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_00580F9F SetUnhandledExceptionFilter,	8_2_00580F9F
Source: C:\Users\user\AppData\Local\Temp\Gosse.com	Code function: 8_2_005811EE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_005811EE

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\Setup.exe	NtProtectVirtualMemory: Direct from: 0x6D452AF4	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	NtSetInformationThread: Direct from: 0x408AE0	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	NtQuerySystemInformation: Direct from: 0x6F81FF	Jump to behavior

LummaC encrypted strings found

Source: more.com, 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: more.com, 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: more.com, 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: more.com, 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: more.com, 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs
Source: more.com, 00000006.00000002.2547321084.0000000003290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: s1gn1fyh0se.cyou

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Setup.exe

Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

8_2_005C230F

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_00572D33 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

8_2_00572D33

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005CC078 SendInput,keybd_event,

8_2_005CC078

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005E2E89 GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

8_2_005E2E89

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Users\user\AppData\Local\Temp\Gosse.com C:\Users\user~1\AppData\Local\Temp\Gosse.com			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005C1C68 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

8_2_005C1C68

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005C2777 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

8_2_005C2777

Source: Setup.exe, 00000000.00000002.1401884047.0000000007737000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004FE2000.00000004.00000800.00020000.00000000.sdmp, Gosse.com, 00000008.00000000.1398108112.0000000000621000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Gosse.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_00580CA4 cpuid

8_2_00580CA4

Source: C:\Users\user\Desktop\Setup.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\7ee79492 VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005D8C58 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

8_2_005D8C58

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_005A59C7 GetUserNameW,

8_2_005A59C7

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_0059B782 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

8_2_0059B782

Source: C:\Users\user\AppData\Local\Temp\Gosse.com

Code function: 8_2_0057310D GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_0057310D

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Source: Gosse.com	Binary or memory string: WIN_81
Source: Gosse.com	Binary or memory string: WIN_XP
Source: Gosse.com	Binary or memory string: WIN_XPe
Source: Gosse.com	Binary or memory string: WIN_VISTA
Source: Gosse.com.6.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 15, 1USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Gosse.com	Binary or memory string: WIN_7
Source: Gosse.com	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	2 Obfuscated Files or Information	NTDS	225 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	112 Process Injection	111 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	24%	ReversingLabs	Win32.PUA.Generic
Setup.exe	100%	Avira	TR/Crypt.XPACK.Gen2

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Gosse.com	0%	ReversingLabs

Source	Detection	Scanner	Label
http://%ipFTPftp://%ipPingcmd.exe/K	0%	Avira URL Cloud	safe
http://www.mylanviewer.com/version2.txt	0%	Avira URL Cloud	safe
https://www.mylanviewer.com/home.html	0%	Avira URL Cloud	safe
http://www.mylanviewer.com/myshowip.phpMyLanViewerhttp://www.mylanviewer.com/myshowip.php0	0%	Avira URL Cloud	safe
s1gn1fyh0se.cyou	0%	Avira URL Cloud	safe
https://www.mylanviewer.com/registers.htmlArialRegistration	0%	Avira URL Cloud	safe
http://www.mylanviewer.com/showip.php	0%	Avira URL Cloud	safe
https://www.mylanviewer.com/registers.html	0%	Avira URL Cloud	safe
http://www.mylanviewer.com/myshowip.php	0%	Avira URL Cloud	safe
http://www.mylanviewer.com/showip.phpl	0%	Avira URL Cloud	safe
https://www.mylanviewer.com/home.htmlopenhttps://www.mylanviewer.com/registers.htmlhttps://www.mylan	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
p10tgrace.sbs	false		high
s1gn1fyh0se.cyou	true	Avira URL Cloud: safe	unknown
p3ar11fter.sbs	false		high
peepburry828.sbs	false		high
processhol.sbs	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mylanviewer.com/version2.txt	Setup.exe	false	Avira URL Cloud: safe	unknown
https://www.mylanviewer.com/home.html	Setup.exe	false	Avira URL Cloud: safe	unknown
https://www.mylanviewer.com/registers.htmlArialRegistration	Setup.exe	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mylanviewer.com/registers.html	Setup.exe	false	Avira URL Cloud: safe	unknown
http://www.mylanviewer.com/showip.php	Setup.exe	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	Setup.exe, 00000000.00000002.1401884047.0000000007432000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004E70000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.vmware.com/0/	Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://%ipFTPftp://%ipPingcmd.exe/K	Setup.exe	false	Avira URL Cloud: safe	unknown
http://www.mylanviewer.com/myshowip.php	Setup.exe	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.11.dr	false		high
http://www.autoitscript.com/autoit3/X	Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com, 00000008.00000000.1398291303.0000000000635000.00000002.00000001.01000000.00000008.sdmp, Gosse.com.6.dr	false		high
http://www.mylanviewer.com/myshowip.phpMyLanViewerhttp://www.mylanviewer.com/myshowip.php0	Setup.exe	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Setup.exe, 00000000.00000002.1401884047.0000000007745000.00000004.00000020.00020000.00000000.sdmp, Gosse.com.6.dr	false		high
http://www.symauth.com/cps0(	Setup.exe, 00000000.00000002.1401884047.000000000760D000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000006.00000002.2547875820.0000000004EB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mylanviewer.com/showip.phpl	Setup.exe	false	Avira URL Cloud: safe	unknown
https://www.mylanviewer.com/home.htmlopenhttps://www.mylanviewer.com/registers.htmlhttps://www.mylan	Setup.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562442
Start date and time:	2024-11-25 15:33:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/9@0/0
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 320
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Gosse.com, PID 3452 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
09:34:24	API Interceptor	1x Sleep call for process: Setup.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Gosse.com	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse
	ExL4unch#U20ac#U00ae.exe	Get hash	malicious	LummaC	Browse
	AI_ChainedPackageFile.VistaSoftware.exe	Get hash	malicious	PureCrypter	Browse
	AaronGiles(1).exe	Get hash	malicious	PureCrypter	Browse
	740d3a.msi	Get hash	malicious	Unknown	Browse
	AI_ChainedPackageFile.VistaSoftware.exe	Get hash	malicious	PureCrypter	Browse
	Reminder.exe	Get hash	malicious	PureCrypter	Browse
	KEFttAEb.vbs	Get hash	malicious	PureCrypter	Browse
	AaronGiles(1).exe	Get hash	malicious	PureCrypter	Browse
	740d3a.msi	Get hash	malicious	PureCrypter	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_more.com_372e469ceb5bfc6b28195017a428fae683e4_8dec09d6_f736110d-adc2-45c8-961e-ed549c5547ba\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7005080617230985
Encrypted:	false
SSDEEP:	96:6btDgswiy6kPsJs5zFXefBQXIDcQxc6/cE3cw3P6T+HbHgSXVG4rmMOycAS/ZAXh:ctDgs/HkPTd0/7trjWazuiFjZ24IO8K
MD5:	FFF0D81E1370D6B9CC4B2C748651A760
SHA1:	8E4FF2934609E1E819FD25B9040E080E3C9ED72B
SHA-256:	DE7F3B235E3FB627657D684EF23012D57DE9676AE7E94445B65165015B59419E
SHA-512:	F9D15FB666C658E36D348A285830C9B196859F8C9D9609EFF12B555E8BDDC8961EDDFC1C70B4A668C565F5992E11FBC9FE21D6EDE8A2F826C378E0F648BF926D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.0.1.8.8.7.1.4.8.3.4.4.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.7.3.6.1.1.0.d.-.a.d.c.2.-.4.5.c.8.-.9.6.1.e.-.e.d.5.4.9.c.5.5.4.7.b.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.3.0.c.4.e.2.e.-.1.1.4.b.-.4.e.9.9.-.8.b.2.9.-.f.5.2.b.9.a.1.7.f.5.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.o.r.e...c.o.m.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.O.R.E...C.O.M.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.c.4.-.0.0.0.1.-.0.0.1.4.-.9.1.8.2.-.e.2.1.f.4.7.3.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.0.4.d.d.9.4.0.5.e.6.4.4.6.e.b.2.a.9.5.f.d.9.1.8.3.5.d.8.4.0.9.b.6.3.7.d.9.b.!.m.o.r.e...c.o.m.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.9.2././.0.9././.2.1.:.0.9.:.4.5.:.3.9.!.a.f.1.4.!.m.o.r.e...c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE90D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 25 14:34:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33618
Entropy (8bit):	2.644913701834248
Encrypted:	false
SSDEEP:	192:KNsNwVjOQRzzYUka4acZynuGSIvb6bKimhtknydSnhgQnwSYtAKI59Hd:1NwVaeYdU6mimhtjdSnOQnPYtGH
MD5:	30C6825CB381F107ECEE73ACB44B2FBF
SHA1:	B3F91422E91C4B0C0E3BAA7C9D177A387CDF4DF6
SHA-256:	58BA891FA1427DEA03B5DCA1CCCB0EA0861C5D658A566C4DF1F30618AC4BBF8F
SHA-512:	84DEC8A33690A5E293049833B83EFF8147B6C48744ADC9B9D6E201823FF581F914F7122C681E89C5768019B871C6808F928B810505E713E3495DA323449AACB1
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........Dg............4...............<...........z...........T.......8...........T...........p....t......................................................................................................eJ..............GenuineIntel............T.............Dg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE99B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8288
Entropy (8bit):	3.698436785854429
Encrypted:	false
SSDEEP:	192:R6l7wVeJBI6o6YhK68gmfbd0i+pBt89bZDsfnCTm:R6lXJu6o6Yc68gmfbd0izZofP
MD5:	ADB16A094A3D03C440C26C4E87A8590F
SHA1:	6D57A84F294AD8D8FF4B1F64E393470212CBD858
SHA-256:	9C4B23C3DCF29037314BA23B26C09BD860F0B1D9EC161EF91EF66FC52F4FB4BC
SHA-512:	6ABC1422203B967497A5253481D938F8D9FCE50381015ABFE11635EAD7829A7E2307051B5FC6471310DA969F6EEFB4B78940B3AE9216CF0DCAD787920401B5D3
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9CA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4633
Entropy (8bit):	4.46559007344394
Encrypted:	false
SSDEEP:	48:cvIwWl8zsBJg77aI9RWWpW8VYAYm8M4J1XFt+q8f7Qheg1+d:uIjfTI7D37VIJVGQheg1+d
MD5:	4DF3A43068036CEB2D15DE0A72CC3464
SHA1:	DB3BC3605B697A4F67D2BC4FA1C7DFB12409A19D
SHA-256:	577F1C78D825D96CECC1CC61FFC1AA1532ED6E2558C348514872EC730C0D2A50
SHA-512:	62AEE59BE6954931C4BEFA1DCF352595762BA89D5FBE833210A9999331DB460DA64397E83CF796F77E8E505E12B3BF3D71D483285959A6476F9A949DF0B56FE9
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="603697" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\7ee79492

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PNG image data, 3936 x 925, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	2095201
Entropy (8bit):	7.994644769346261
Encrypted:	true
SSDEEP:	49152:j6ulxJo2pZymGpwAwTJWkkN3epgbWbAdH/Y2QnRzfYnVBE:j6qxGIZymGpwAEWksCgqaSh6VBE
MD5:	A26B6D242E662ADA90B5E40D29901CE9
SHA1:	F39DEC1F81A74FD0A8CFB0FA2F1FCAC32F262348
SHA-256:	154F03633CFD760DD9DC8D078A7ECE574688F0B8A77E6E6A02BFB6F181E9BBD6
SHA-512:	BB7A612F543070AA2879FD54EFB5A6F21AD6DCB4052413168DF2C4912607A987510F4AED3692D62B06B6D3F105700332127C9B35F7DB9F3AA3B1D792D98CB209
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...`.........f..... .IDATx..;.$....+.U.{...}...[....;.."`...\aH.....U..1.;..g...zW...^..k....DdUVWwWw.g..c:.2......}.....p%..~.....W.....p......5......[.\|.\.\|.s..4MC..?R.5...H.4.RB......q..M=.............#.ssw....4TUE..?RU...../E.....e.T]....Ki......UY...R....+..A...B...}).T..t.krw%.c........,#.]7.>H...z.#.....~@@..G...L...C.\|.....Z.o..\|.../....!..jn!.....!...U}wH>...wo.y.............-....(...g.1.[i...............`.....&...-..}....3.p.K/%8......{..>.o....\|.8g..d....]....I.6n.#.o/........-.l1...um..R...K....jx).T.@7MSW.e..#.#.<G..?.B......p"...4........_'..1..;.`..M....H..M~D..."...\|..@....?..0.p.... A...M6.>..H.],.L-4.....,_..\|.g...#..+...cxX>h..J1..tY.j!.cT.'..a............Y..N......?cl.'..?....\|K...3..........9.....,.H.-.-.oj.;....{.\|.$c\|..J.L$.. .J.)Qi=....A.d..h.V.....`Z.j.AB.....M.p .Z....\.....SM.0.......\|.%`..}...K...O..K...zH>.\....=....=$.0s.....(..I>#.jtC68RI...[.(...ZHv...9B...}.... ......>..j....

C:\Users\user\AppData\Local\Temp\7fda8a8e

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	modified
Size (bytes):	1995074
Entropy (8bit):	7.439322540940035
Encrypted:	false
SSDEEP:	24576:k/RG3tvIGNZjBZq5d0T4w1Y74EJYo5ytzG87WKJiXQzOJ9JboAZ2fLht3i4gz60s:SROIAnqY/c8iUehoLhxgz6h6o9KC
MD5:	047D3B958ECDA8FB1B94D5CF47F5FD79
SHA1:	663B0BEE20ACC7B659D161B7B0DB1F5579A40F58
SHA-256:	CB810AFBAC98D6B3E1DE137488EB5F0D7C748E08FFCAF583321D0BE895464F34
SHA-512:	04CF449249D5E4B6890E39E9F3FBDBB26C82E52557366200D2622EA67C837596CCC57620056F700263B7275D690AC0DF0D89E17D71FB53C1B4BF493AAF509CD6
Malicious:	false
Reputation:	low
Preview:	...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U.........<...&.......1.......'...0.......'.......'...U...U...U...U...U...U...U...U...U...U...U...U...;...4...0...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...'...0...!...0...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U......p...6...:...........0...>...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...U...e...b...U...U...U...U...U...U...U...U...U...U...U

C:\Users\user\AppData\Local\Temp\Gosse.com

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	943784
Entropy (8bit):	6.621472142472864
Encrypted:	false
SSDEEP:	24576:MghN1a6pzWZ12+f+Qa7N4nEIRQ1hOOLkF6av8uh:vhN1aQzJD4BuTxavfh
MD5:	3F58A517F1F4796225137E7659AD2ADB
SHA1:	E264BA0E9987B0AD0812E5DD4DD3075531CFE269
SHA-256:	1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48
SHA-512:	ACF740AAFCE390D06C6A76C84E7AE7C0F721731973AADBE3E57F2EB63241A01303CC6BF11A3F9A88F8BE0237998B5772BDAF569137D63BA3D0F877E7D27FC634
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SeT_up.exe, Detection: malicious, Browse Filename: ExL4unch#U20ac#U00ae.exe, Detection: malicious, Browse Filename: AI_ChainedPackageFile.VistaSoftware.exe, Detection: malicious, Browse Filename: AaronGiles(1).exe, Detection: malicious, Browse Filename: 740d3a.msi, Detection: malicious, Browse Filename: AI_ChainedPackageFile.VistaSoftware.exe, Detection: malicious, Browse Filename: Reminder.exe, Detection: malicious, Browse Filename: KEFttAEb.vbs, Detection: malicious, Browse Filename: AaronGiles(1).exe, Detection: malicious, Browse Filename: 740d3a.msi, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......hm..,...,...,.....m.......o.......n.......[.-....h..8....h.......h..>...%t..%...%t......,........h..\|....h..-....hc.-...,........h..-...Rich,...........................PE..L...R..Z.........."...............................@.......................................@...@.......@.........................\|....P..h............J.......0.. v.........................../..........@............................................text............................... ..`.rdata..............................@..@.data...4p.......H..................@....rsrc...h....P......................@..@.reloc.. v...0...x..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xwharpgq

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	6.8247381630250095
Encrypted:	false
SSDEEP:	6144:kScDdfoHvmx1oFT4mKkvzQ8L9ZSwMia5MHdkAPkj7oNzr:/cDqPEu4ys8Z5Mi9zPk4N/
MD5:	8A03328077D30121CB556BE56F95D07D
SHA1:	EC9D352BB026D7995653F9E08CC7EFE444626BB5
SHA-256:	8AA6EC6AD92B5BA62086C0A6DCBE46C0A000EA69A876CF3A14DF06E7E9E3CBF3
SHA-512:	5EEB728C82E79A542484BCCEAACB41884F77ABB36FFCB6475D3DA4C6EDD5EF6971C4C63E95147D53348C2C9C77CB598C152BEB19059A39C16680B83F7A9FECEA
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....S..........................................@.......................................@..................................K...............................p...=...................................................M...............................text............................... ..`.rdata... ...0..."..................@..@.data...D....`...X...8..............@....CRT.........`......................@..@.reloc...=...p...>..................@..Bxibp................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.413971632375733
Encrypted:	false
SSDEEP:	6144:7cifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNb5+:gi58oSWIZBk2MM6AFBZo
MD5:	A594F6FF1D72C2B60D9BC6D5F81E7A84
SHA1:	6FD3858EF705FA8965F776EBDF2C52303FC00CA5
SHA-256:	BC8B0FA00F8CBEC529DBC55D93E76C03280CAF62A5AC82DEFB2FED88C1A68349
SHA-512:	8ED26E418C9061BE190615C246F5D5323F9DE38BBF6A36A181571FB638D33ABE9584F54249E7D951CD122503910F707B5DE0BEBF82152C7EC93F83DAE9DF5D86
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm&S.#G?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.3581510631363445
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	17'103'832 bytes
MD5:	0694a17da60d94bc3309098b233aef78
SHA1:	c5c79592819ea20caf0d2223b4404283fd32c702
SHA256:	881fb060bd03a238a1c2b9221d15d28df8705870680c17ac5070510ec6355e2d
SHA512:	c2ac25d98ba05ff72468154656e40af5a44b8d94bc6da21b4a65a00ec211ee8f65f033639eabf9f0129817e0aeb371f595fd4077d3e02b57960034c37c793dc0
SSDEEP:	393216:E+KwCY9SPj3CaQ4TmsjZyAeUGIcZfkshF:E+KwCImSsj0AeqctBhF
TLSH:	BE07D006B64AC5F6C08526B8DB1BDBF970313E78FA900883B3A47E5DF9B1B919465307
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........PE..L....`.c................../.................../...@...........................T.....N9........ .. ......................./.

File Icon


Icon Hash:	e3d2e3f0ecda8a8c

Static PE Info

General

Entrypoint:	0x12ef3b2
Entrypoint Section:	_RDATA2
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x639C6004 [Fri Dec 16 12:09:40 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	e0dec038b87ebebb3f0c99a4a0b71248

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	18/07/2022 02:00:00 17/05/2025 01:59:59
Subject Chain	CN=ASUSTeK COMPUTER INC., OU=Gaming BU-SW RD Ctr-SW RD Div2-SW RD Dept1, O=ASUSTeK COMPUTER INC., L=Beitou District, S=Taipei City, C=TW, SERIALNUMBER=23638777, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=TW
Version:	3
Thumbprint MD5:	E36602E775A5284B99606B1833F95A08
Thumbprint SHA-1:	D3CB8B17C5512C312FA1E3DB3D1571CF6A390F5B
Thumbprint SHA-256:	B38E96A38EB6CEB8A915618C8E28E5AB9413942788CF5D2B8C8E5829DB88CBF2
Serial:	087FEF2C056BD054663E5ED196BE3565

Entrypoint Preview

Instruction
push ebp
pushfd
mov ebp, 7C38B9BDh
mov ebp, dword ptr [esp+ebp-7C38B9B9h]
mov dword ptr [esp+04h], BEAC5D16h
push dword ptr [esp+00h]
popfd
lea esp, dword ptr [esp+04h]
call 00007FAC34B3A1B5h
call 00007FAC34B21238h
pop edx
adc edx, FFE575EEh
jmp edx
inc eax
inc dh
inc cx
mov dword ptr [esp+esi*8+000689B4h], edx
inc eax
sets bh
inc eax
xor al, bh
dec eax
neg eax
inc ecx
mov cl, byte ptr [ebp+ebx*2-5B299EFAh]
inc dx
add edi, dword ptr [esp+ecx-32EBFFEBh]
push ebx
dec ebp
lea ebp, dword ptr [ebp+ebx-2D94CF79h]
sal word ptr [esp+ebx*2-5B299EFAh], FFACh
inc ecx
xor cl, bl
xor cl, FFFFFFB3h
call 00007FAC34A77D25h
add eax, dword ptr [edi+eax]
neg dx
movzx ecx, byte ptr [esp+04h]
and ecx, 51849409h
mov edx, dword ptr [edi+ecx*2+04h]
sal ecx, FFFFFF9Ah
ror cl, FFFFFF81h
call 00007FAC34DE4A44h
mov ah, byte ptr [ecx]
sub dword ptr [ebx-5Fh], esi
pop ebx
push es
imul ebp, dword ptr [esi+ebx*4-02801859h], 00EEAE80h
out 57h, eax
cmc
sub byte ptr [esi+449B87EEh], FFFFFFD1h
and byte ptr [ebp+10435D41h], dh
in al, 6Bh
jo 00007FAC34B72FDCh
mov fs, word ptr [edx+7F58F2D5h]
jnle 00007FAC34B7302Dh
jnp 00007FAC34B72F80h
scasb

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x910000	0x2fae	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfbbf00	0x154	_RDATA2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1195000	0x3b8709	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x104d200	0x29d8	_RDATA2
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x90b000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd3a000	0x84	_RDATA1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2fd000	0x2fd000	bc6b2d8cdc4fa18530976bf341d34eca	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2fe000	0x60c000	0x110600	5a23d7b74d2b69f28adb6e1971445ee3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x90a000	0x1000	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x90b000	0x1000	0x200	00641d0feaef0b7f9f3b65c67a5ed46a	False	0.052734375	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.idata	0x90c000	0x4000	0x3400	069286ca0f29cc3eaf737d4856d69db8	False	0.9601862980769231	data	7.870266352354726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.edata	0x910000	0x3000	0x3000	d3f0fcbcdd01777d9414bf1e0c8b95e0	False	0.301513671875	data	5.47519440995948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA0	0x913000	0x426a25	0x426c00	f4eb99f1066289f256e8481ca9dd7e40	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
_RDATA1	0xd3a000	0x9c	0x200	6613eff8b8274eadebd09cb43ce17502	False	0.177734375	data	0.9799551862570663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA2	0xd3b000	0x459610	0x459800	a432753b90d26e872d095a2ea43c01af	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1195000	0x3b8709	0x3b8800	f64f381354d1b3a98b45f00bc5a08d17	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
FNDD	0x1197e24	0x1ff861	PNG image data, 3936 x 925, 8-bit/color RGB, non-interlaced	English	United States	0.9947528839111328
RT_CURSOR	0x1397688	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x13977bc	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x13978f0	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x1397a24	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x1397b58	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x1397c8c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x1397dc0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x1397ef4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x13980c4	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x13982a8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x1398478	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x1398648	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x1398818	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x13989e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x1398bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x1398d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x1398f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x1399128	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x1399210	0x3093	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.000884599919582
RT_ICON	0x139c2a4	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	Russian	Russia	0.7173515052888527
RT_ICON	0x139e90c	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	Russian	Russia	0.7602459016393442
RT_ICON	0x139fa34	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.8696808510638298
RT_DIALOG	0x139fe9c	0x52	data			0.7682926829268293
RT_DIALOG	0x139fef0	0x52	data			0.7560975609756098
RT_STRING	0x139ff44	0x384	data			0.35777777777777775
RT_STRING	0x13a02c8	0x32c	data			0.44950738916256155
RT_STRING	0x13a05f4	0xc0	data			0.6041666666666666
RT_STRING	0x13a06b4	0xfc	data			0.5873015873015873
RT_STRING	0x13a07b0	0x248	data			0.4845890410958904
RT_STRING	0x13a09f8	0x408	data			0.36143410852713176
RT_STRING	0x13a0e00	0x1f8	data			0.4603174603174603
RT_STRING	0x13a0ff8	0xec	data			0.5550847457627118
RT_STRING	0x13a10e4	0x198	data			0.5171568627450981
RT_STRING	0x13a127c	0x3b4	data			0.33649789029535865
RT_STRING	0x13a1630	0x37c	data			0.4080717488789238
RT_STRING	0x13a19ac	0x2a0	data			0.4017857142857143
RT_STRING	0x13a1c4c	0x434	data			0.3587360594795539
RT_STRING	0x13a2080	0x380	data			0.3549107142857143
RT_STRING	0x13a2400	0x454	data			0.37906137184115524
RT_RCDATA	0x13a2854	0x10	data			1.5
RT_RCDATA	0x13a2864	0xf000f	Delphi compiled form 'TForm1'			0.24657114810463301
RT_RCDATA	0x1492874	0x871	Delphi compiled form 'TFormAbout'			0.4197130957889866
RT_RCDATA	0x14930e8	0xa39	Delphi compiled form 'TFormAddApplication'			0.3584256782575468
RT_RCDATA	0x1493b24	0x85c	Delphi compiled form 'TFormAddContact'			0.3719626168224299
RT_RCDATA	0x1494380	0x674	Delphi compiled form 'TFormAddFavorit'			0.437046004842615
RT_RCDATA	0x14949f4	0x977	Delphi compiled form 'TFormAddFriendlyName'			0.39991745769706977
RT_RCDATA	0x149536c	0x71d	Delphi compiled form 'TFormAddToList'			0.39978034047226796
RT_RCDATA	0x1495a8c	0x788	Delphi compiled form 'TFormAddWmiQuery'			0.4066390041493776
RT_RCDATA	0x1496214	0xecb	Delphi compiled form 'TFormChat'			0.30974386057565356
RT_RCDATA	0x14970e0	0xbbb	Delphi compiled form 'TFormChatDownload'			0.4901764901764902
RT_RCDATA	0x1497c9c	0x6e8	Delphi compiled form 'TFormChatDownloadAction'			0.3942307692307692
RT_RCDATA	0x1498384	0xbc1	Delphi compiled form 'TFormChatUpload'			0.5014955134596212
RT_RCDATA	0x1498f48	0x644	Delphi compiled form 'TFormDeleteComputersInRange'			0.442643391521197
RT_RCDATA	0x149958c	0xa31	Delphi compiled form 'TFormDhcp'			0.34610962054426986
RT_RCDATA	0x1499fc0	0x2b75	Delphi compiled form 'TFormDiapasons'			0.15280898876404495
RT_RCDATA	0x149cb38	0xd55	Delphi compiled form 'TFormEditApplications'			0.25607969528274244
RT_RCDATA	0x149d890	0x883	Delphi compiled form 'TFormEmailText'			0.413951353832033
RT_RCDATA	0x149e114	0x8a1	Delphi compiled form 'TFormEmailTextAndCaption'			0.3879583521955636
RT_RCDATA	0x149e9b8	0x75e	Delphi compiled form 'TFormEnterCode'			0.41039236479321317
RT_RCDATA	0x149f118	0x95e	Delphi compiled form 'TFormExcludedIP'			0.3286071726438699
RT_RCDATA	0x149fa78	0xb02	Delphi compiled form 'TFormExecute'			0.3765081618168914
RT_RCDATA	0x14a057c	0xc47	Delphi compiled form 'TFormExternalIp'			0.30957683741648107
RT_RCDATA	0x14a11c4	0x665	Delphi compiled form 'TFormFavoriteAddGroup'			0.43494196701282833
RT_RCDATA	0x14a182c	0xc58	Delphi compiled form 'TFormFavorites'			0.29335443037974684
RT_RCDATA	0x14a2484	0x6f2	Delphi compiled form 'TFormFind'			0.39707536557930256
RT_RCDATA	0x14a2b78	0x102e	Delphi compiled form 'TFormFindContacts'			0.2747464992757122
RT_RCDATA	0x14a3ba8	0xeb0	Delphi compiled form 'TFormFriendlyNames'			0.2422872340425532
RT_RCDATA	0x14a4a58	0xd3c	Delphi compiled form 'TFormHostsList'			0.31995277449822906
RT_RCDATA	0x14a5794	0x58c	Delphi compiled form 'TFormHostToIP'			0.44577464788732396
RT_RCDATA	0x14a5d20	0x83c	Delphi compiled form 'TFormIpWhois'			0.4055977229601518
RT_RCDATA	0x14a655c	0x578	Delphi compiled form 'TFormMessage'			0.43714285714285717
RT_RCDATA	0x14a6ad4	0xb14	Delphi compiled form 'TFormNetStat'			0.34520451339915376
RT_RCDATA	0x14a75e8	0x1b5e	Delphi compiled form 'TFormNetwork'			0.34798743933771054
RT_RCDATA	0x14a9148	0xa0b	Delphi compiled form 'TFormNetworkInfo'			0.36678335278101903
RT_RCDATA	0x14a9b54	0x625	Delphi compiled form 'TFormNickName'			0.4405594405594406
RT_RCDATA	0x14aa17c	0x6e8	Delphi compiled form 'TFormNotification'			0.3829185520361991
RT_RCDATA	0x14aa864	0x1335	Delphi compiled form 'TFormPinger'			0.4299369534268863
RT_RCDATA	0x14abb9c	0x61a	Delphi compiled form 'TFormQuestion'			0.4148527528809219
RT_RCDATA	0x14ac1b8	0x785	Delphi compiled form 'TFormRegistrationLink'			0.4072727272727273
RT_RCDATA	0x14ac940	0xa4a	Delphi compiled form 'TFormSearchSetup'			0.32687927107061504
RT_RCDATA	0x14ad38c	0x1859	Delphi compiled form 'TFormSetup'			0.20471682977699343
RT_RCDATA	0x14aebe8	0xae1	Delphi compiled form 'TFormStart'			0.34470377019748655
RT_RCDATA	0x14af6cc	0x7ba	Delphi compiled form 'TFormTestWmiQuery'			0.37967644084934277
RT_RCDATA	0x14afe88	0x210	Delphi compiled form 'TFormTopSearch'			0.6022727272727273
RT_RCDATA	0x14b0098	0x2702	Delphi compiled form 'TFormWakeOnLan'			0.259062687762868
RT_RCDATA	0x14b279c	0x221e	Delphi compiled form 'TFrameAddWmiQuery'			0.15697275017174261
RT_RCDATA	0x14b49bc	0x1a87	Delphi compiled form 'TFrameAdminScanner'			0.17140332793403035
RT_RCDATA	0x14b6444	0x189	Delphi compiled form 'TFrameButton'			0.49872773536895676
RT_RCDATA	0x14b65d0	0x427	Delphi compiled form 'TFrameChat'			0.37723424270931327
RT_RCDATA	0x14b69f8	0x3d6	Delphi compiled form 'TFrameChatDownloadA'			0.4134419551934827
RT_RCDATA	0x14b6dd0	0x40b	Delphi compiled form 'TFrameChatDownloadB'			0.3748792270531401
RT_RCDATA	0x14b71dc	0x83e	Delphi compiled form 'TFrameChatMemo'			0.32701421800947866
RT_RCDATA	0x14b7a1c	0x187	Delphi compiled form 'TFrameChatMessage'			0.6061381074168798
RT_RCDATA	0x14b7ba4	0x29e	Delphi compiled form 'TFrameChatUploadA'			0.4582089552238806
RT_RCDATA	0x14b7e44	0x379	Delphi compiled form 'TFrameChatUploadB'			0.4049493813273341
RT_RCDATA	0x14b81c0	0x4e8e	Delphi compiled form 'TFrameFavorites'			0.10183988065638985
RT_RCDATA	0x14bd050	0x2145	Delphi compiled form 'TFrameFavoritesActions'			0.16343783022190914
RT_RCDATA	0x14bf198	0x289c	Delphi compiled form 'TFrameFolders'			0.12629857637552905
RT_RCDATA	0x14c1a34	0x4b5e	Delphi compiled form 'TFrameHistory'			0.10417746449673473
RT_RCDATA	0x14c6594	0x516	Delphi compiled form 'TFrameHostByIp'			0.2995391705069124
RT_RCDATA	0x14c6aac	0x164e	Delphi compiled form 'TFrameMain'			0.21663747810858144
RT_RCDATA	0x14c80fc	0x279a8	Delphi compiled form 'TFrameMain2'			0.3001800069043744
RT_RCDATA	0x14efaa4	0xc52b	Delphi compiled form 'TFrameMainMenu'			0.10498266468548786
RT_RCDATA	0x14fbfd0	0x46a	Delphi compiled form 'TFrameMemo'			0.4168141592920354
RT_RCDATA	0x14fc43c	0xdb0	Delphi compiled form 'TFrameMessanger'			0.2360159817351598
RT_RCDATA	0x14fd1ec	0x763	Delphi compiled form 'TFrameNetwork'			0.3484928609201481
RT_RCDATA	0x14fd950	0x235	Delphi compiled form 'TFrameNetworkButtons'			0.3256637168141593
RT_RCDATA	0x14fdb88	0x18c	Delphi compiled form 'TFramePages'			0.5909090909090909
RT_RCDATA	0x14fdd14	0x96a	Delphi compiled form 'TFramePingerOptions'			0.3107883817427386
RT_RCDATA	0x14fe680	0x30ab	Delphi compiled form 'TFramePrivateNetwork'			0.13235412151858095
RT_RCDATA	0x150172c	0x43ec	Delphi compiled form 'TFrameScanner'			0.11042097998619738
RT_RCDATA	0x1505b18	0x18da	Delphi compiled form 'TFrameSearch'			0.17007230430682174
RT_RCDATA	0x15073f4	0x405	Delphi compiled form 'TFrameSearchMemo'			0.39067055393586003
RT_RCDATA	0x15077fc	0x14bc	Delphi compiled form 'TFrameSearchSetup'			0.19103240391861342
RT_RCDATA	0x1508cb8	0xfbd	Delphi compiled form 'TFrameSetupAdminScanner'			0.22263588979895757
RT_RCDATA	0x1509c78	0x58c	Delphi compiled form 'TFrameSetupAuthorization'			0.3528169014084507
RT_RCDATA	0x150a204	0x1c41	Delphi compiled form 'TFrameSetupDetails'			0.15705792893681736
RT_RCDATA	0x150be48	0x1291	Delphi compiled form 'TFrameSetupEmail'			0.19861140332421628
RT_RCDATA	0x150d0dc	0x53f	Delphi compiled form 'TFrameSetupEmailSubject'			0.3432613551749814
RT_RCDATA	0x150d61c	0xfc6	Delphi compiled form 'TFrameSetupFavorites'			0.2157008420009906
RT_RCDATA	0x150e5e4	0x8bd	Delphi compiled form 'TFrameSetupFolders'			0.3102369244523916
RT_RCDATA	0x150eea4	0x590	Delphi compiled form 'TFrameSetupGenerals'			0.3167134831460674
RT_RCDATA	0x150f434	0x1106	Delphi compiled form 'TFrameSetupHistory'			0.21156493804497475
RT_RCDATA	0x151053c	0x766	Delphi compiled form 'TFrameSetupHistoryView'			0.324181626187962
RT_RCDATA	0x1510ca4	0x262f	Delphi compiled form 'TFrameSetupInterface'			0.13810741687979539
RT_RCDATA	0x15132d4	0xce5	Delphi compiled form 'TFrameSetupLaunch'			0.19933353529233566
RT_RCDATA	0x1513fbc	0x2686	Delphi compiled form 'TFrameSetupLookup'			0.12340296085986616
RT_RCDATA	0x1516644	0x18b4	Delphi compiled form 'TFrameSetupMessenger'			0.1937065148640101
RT_RCDATA	0x1517ef8	0xcbb	Delphi compiled form 'TFrameSetupNotifications'			0.2138692850567659
RT_RCDATA	0x1518bb4	0x9d0	Delphi compiled form 'TFrameSetupNotificationsFavorites'			0.2806528662420382
RT_RCDATA	0x1519584	0x1234	Delphi compiled form 'TFrameSetupNotificationsFolders'			0.19334763948497855
RT_RCDATA	0x151a7b8	0x21f0	Delphi compiled form 'TFrameSetupNotificationsHistory'			0.14652394106813996
RT_RCDATA	0x151c9a8	0xd74	Delphi compiled form 'TFrameSetupNotificationsScanner'			0.2665505226480836
RT_RCDATA	0x151d71c	0x519	Delphi compiled form 'TFrameSetupNotificationsSearch'			0.40229885057471265
RT_RCDATA	0x151dc38	0x2814	Delphi compiled form 'TFrameSetupNotificationsSubnetMonitor'			0.13567251461988303
RT_RCDATA	0x152044c	0x571	Delphi compiled form 'TFrameSetupOptimizations'			0.3137114142139268
RT_RCDATA	0x15209c0	0x10c3	Delphi compiled form 'TFrameSetupScanner'			0.21044045676998369
RT_RCDATA	0x1521a84	0x766	Delphi compiled form 'TFrameSetupScannerView'			0.3215417106652587
RT_RCDATA	0x15221ec	0x695	Delphi compiled form 'TFrameSetupSearch'			0.3649851632047478
RT_RCDATA	0x1522884	0x149f	Delphi compiled form 'TFrameSetupSubnetMonitor'			0.19871187724947906
RT_RCDATA	0x1523d24	0x594	Delphi compiled form 'TFrameSetupSubnetMonitorAdditions'			0.32072829131652664
RT_RCDATA	0x15242b8	0x26b1	Delphi compiled form 'TFrameSubTools'			0.12912670368500756
RT_RCDATA	0x152696c	0x25471	Delphi compiled form 'TFrameTools'			0.3111291579616082
RT_RCDATA	0x154bde0	0xda5	Delphi compiled form 'TFrameWakeOnLan'			0.24992842828514172
RT_RCDATA	0x154cb88	0x5f5	Delphi compiled form 'TVTreeView'			0.3619672131147541
RT_GROUP_CURSOR	0x154d180	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x154d194	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x154d1a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154d1bc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154d1d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154d1e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154d1f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x154d20c	0x3e	data	Russian	Russia	0.8225806451612904
RT_VERSION	0x154d24c	0x340	data			0.43990384615384615
RT_MANIFEST	0x154d58c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.DLL	shutdown
IPHLPAPI.DLL	GetAdaptersInfo
SHELL32.DLL	Shell_NotifyIconA
WININET.DLL	FtpFindFirstFileA
ADVAPI32.DLL	AdjustTokenPrivileges
KERNEL32.DLL	GetVersion, GetVersionExA
MPR.DLL	WNetAddConnection2A
NETAPI32.DLL	NetApiBufferFree
VERSION.DLL	GetFileVersionInfoA
COMCTL32.DLL	ImageList_Add
COMDLG32.DLL	ChooseColorA
GDI32.DLL	BitBlt
USER32.DLL	ActivateKeyboardLayout
WINMM.DLL	PlaySoundA
OLE32.DLL	CLSIDFromString
OLEAUT32.DLL	GetErrorInfo

Exports

Name	Ordinal	Address
@@Unit1@Finalize	3	0x4d85a8
@@Unit1@Initialize	2	0x4d8590
@@Unit2@Finalize	5	0x4dccc0
@@Unit2@Initialize	4	0x4dccb0
@@Unitabout@Finalize	7	0x4dedf8
@@Unitabout@Initialize	6	0x4dede8
@@Unitaddfavorite@Finalize	9	0x4e0ed8
@@Unitaddfavorite@Initialize	8	0x4e0ec8
@@Unitchatdownloadaction@Finalize	11	0x4e2930
@@Unitchatdownloadaction@Initialize	10	0x4e2920
@@Unitchatprotocol@Finalize	13	0x4e9ed8
@@Unitchatprotocol@Initialize	12	0x4e9ec8
@@Unitdeletecomputersinrange@Finalize	15	0x4ec6c0
@@Unitdeletecomputersinrange@Initialize	14	0x4ec6b0
@@Unitdiapasons@Finalize	17	0x4f39f4
@@Unitdiapasons@Initialize	16	0x4f39e4
@@Unitentercode@Finalize	19	0x4f5990
@@Unitentercode@Initialize	18	0x4f5980
@@Unitexcludedip@Finalize	21	0x4f7bd0
@@Unitexcludedip@Initialize	20	0x4f7bc0
@@Unitfavorites@Finalize	23	0x4ffb38
@@Unitfavorites@Initialize	22	0x4ffb28
@@Unitformaddapplication@Finalize	25	0x501cd0
@@Unitformaddapplication@Initialize	24	0x501cc0
@@Unitformaddcontact@Finalize	27	0x503984
@@Unitformaddcontact@Initialize	26	0x503974
@@Unitformaddfriendlyname@Finalize	29	0x506f74
@@Unitformaddfriendlyname@Initialize	28	0x506f64
@@Unitformaddtolist@Finalize	31	0x5089e4
@@Unitformaddtolist@Initialize	30	0x5089d4
@@Unitformaddwmiquery@Finalize	33	0x50f014
@@Unitformaddwmiquery@Initialize	32	0x50f004
@@Unitformchat@Finalize	35	0x5127c4
@@Unitformchat@Initialize	34	0x5127b4
@@Unitformchatdownload@Finalize	37	0x5191d0
@@Unitformchatdownload@Initialize	36	0x5191c0
@@Unitformchatupload@Finalize	39	0x51f548
@@Unitformchatupload@Initialize	38	0x51f538
@@Unitformdhcp@Finalize	41	0x524454
@@Unitformdhcp@Initialize	40	0x524444
@@Unitformeditapplications@Finalize	43	0x52773c
@@Unitformeditapplications@Initialize	42	0x52772c
@@Unitformemailtext@Finalize	45	0x5293e0
@@Unitformemailtext@Initialize	44	0x5293d0
@@Unitformemailtextandcaption@Finalize	47	0x52b20c
@@Unitformemailtextandcaption@Initialize	46	0x52b1fc
@@Unitformexecute@Finalize	49	0x52d8b8
@@Unitformexecute@Initialize	48	0x52d8a8
@@Unitformexternalip@Finalize	51	0x530500
@@Unitformexternalip@Initialize	50	0x5304f0
@@Unitformfavoriteaddgroup@Finalize	53	0x531dcc
@@Unitformfavoriteaddgroup@Initialize	52	0x531dbc
@@Unitformfind@Finalize	55	0x534a74
@@Unitformfind@Initialize	54	0x534a64
@@Unitformfindcontacts@Finalize	57	0x537cd0
@@Unitformfindcontacts@Initialize	56	0x537cc0
@@Unitformhostslist@Finalize	59	0x53a858
@@Unitformhostslist@Initialize	58	0x53a848
@@Unitformhosttoip@Finalize	61	0x53cdc4
@@Unitformhosttoip@Initialize	60	0x53cdb4
@@Unitformipwhois@Finalize	63	0x541088
@@Unitformipwhois@Initialize	62	0x541078
@@Unitformnetwork@Finalize	65	0x54f4b4
@@Unitformnetwork@Initialize	64	0x54f4a4
@@Unitformnetworkinfo@Finalize	67	0x55aa8c
@@Unitformnetworkinfo@Initialize	66	0x55aa7c
@@Unitformnickname@Finalize	69	0x55c32c
@@Unitformnickname@Initialize	68	0x55c31c
@@Unitformnotification@Finalize	71	0x55edc0
@@Unitformnotification@Initialize	70	0x55edb0
@@Unitformpinger@Finalize	73	0x57d2e0
@@Unitformpinger@Initialize	72	0x57d2c8
@@Unitformquestion@Finalize	75	0x57ed80
@@Unitformquestion@Initialize	74	0x57ed70
@@Unitformregistrationlink@Finalize	77	0x5807bc
@@Unitformregistrationlink@Initialize	76	0x5807ac
@@Unitformsearchsetup@Finalize	79	0x583258
@@Unitformsearchsetup@Initialize	78	0x583248
@@Unitformsetup@Finalize	81	0x59370c
@@Unitformsetup@Initialize	80	0x5936fc
@@Unitformtestwmiquery@Finalize	83	0x595168
@@Unitformtestwmiquery@Initialize	82	0x595158
@@Unitformtopsearch@Finalize	85	0x5960fc
@@Unitformtopsearch@Initialize	84	0x5960ec
@@Unitframeaddwmiquery@Finalize	87	0x597a70
@@Unitframeaddwmiquery@Initialize	86	0x597a60
@@Unitframeadminscanner@Finalize	89	0x59ac48
@@Unitframeadminscanner@Initialize	88	0x59ac38
@@Unitframebutton@Finalize	91	0x59b8f8
@@Unitframebutton@Initialize	90	0x59b8e8
@@Unitframechat@Finalize	93	0x59ba90
@@Unitframechat@Initialize	92	0x59ba80
@@Unitframechatdownloada@Finalize	95	0x59bc34
@@Unitframechatdownloada@Initialize	94	0x59bc24
@@Unitframechatdownloadb@Finalize	97	0x59c2cc
@@Unitframechatdownloadb@Initialize	96	0x59c2bc
@@Unitframechatmemo@Finalize	99	0x5a5430
@@Unitframechatmemo@Initialize	98	0x5a5420
@@Unitframechatmessage@Finalize	101	0x5a5670
@@Unitframechatmessage@Initialize	100	0x5a5660
@@Unitframechatuploada@Finalize	103	0x5a580c
@@Unitframechatuploada@Initialize	102	0x5a57fc
@@Unitframechatuploadb@Finalize	105	0x5a5e9c
@@Unitframechatuploadb@Initialize	104	0x5a5e8c
@@Unitframefavorites@Finalize	107	0x5af15c
@@Unitframefavorites@Initialize	106	0x5af14c
@@Unitframefavoritesactions@Finalize	109	0x5b1714
@@Unitframefavoritesactions@Initialize	108	0x5b1704
@@Unitframefolders@Finalize	111	0x5b4ff4
@@Unitframefolders@Initialize	110	0x5b4fe4
@@Unitframehistory@Finalize	113	0x5be194
@@Unitframehistory@Initialize	112	0x5be184
@@Unitframehostbyip@Finalize	115	0x5be9dc
@@Unitframehostbyip@Initialize	114	0x5be9cc
@@Unitframemain2@Finalize	119	0x5bfeec
@@Unitframemain2@Initialize	118	0x5bfedc
@@Unitframemain@Finalize	117	0x5be9fc
@@Unitframemain@Initialize	116	0x5be9ec
@@Unitframemainmenu@Finalize	121	0x5c76e0
@@Unitframemainmenu@Initialize	120	0x5c76d0
@@Unitframemessanger@Finalize	123	0x5ca12c
@@Unitframemessanger@Initialize	122	0x5ca11c
@@Unitframenetwork@Finalize	125	0x5ca290
@@Unitframenetwork@Initialize	124	0x5ca280
@@Unitframenetworkbuttons@Finalize	127	0x5ca2b0
@@Unitframenetworkbuttons@Initialize	126	0x5ca2a0
@@Unitframepages@Finalize	129	0x5cbd1c
@@Unitframepages@Initialize	128	0x5cbd0c
@@Unitframepingeroptions@Finalize	131	0x5cc524
@@Unitframepingeroptions@Initialize	130	0x5cc514
@@Unitframeprivatenetwork@Finalize	133	0x5d1da0
@@Unitframeprivatenetwork@Initialize	132	0x5d1d90
@@Unitframescanner@Finalize	135	0x5db070
@@Unitframescanner@Initialize	134	0x5db060
@@Unitframesearch@Finalize	137	0x5de0ac
@@Unitframesearch@Initialize	136	0x5de09c
@@Unitframesearchmemo@Finalize	139	0x5e1f24
@@Unitframesearchmemo@Initialize	138	0x5e1f14
@@Unitframesearchsetup@Finalize	141	0x5e32d8
@@Unitframesearchsetup@Initialize	140	0x5e32c8
@@Unitframesetupadminscanner@Finalize	143	0x5e48b8
@@Unitframesetupadminscanner@Initialize	142	0x5e48a8
@@Unitframesetupauthorization@Finalize	145	0x5e5a54
@@Unitframesetupauthorization@Initialize	144	0x5e5a44
@@Unitframesetupdetails@Finalize	147	0x5e75e4
@@Unitframesetupdetails@Initialize	146	0x5e75d4
@@Unitframesetupemail@Finalize	149	0x5e8d64
@@Unitframesetupemail@Initialize	148	0x5e8d54
@@Unitframesetupemailsubject@Finalize	151	0x5e9d98
@@Unitframesetupemailsubject@Initialize	150	0x5e9d88
@@Unitframesetupfavorites@Finalize	153	0x5eb30c
@@Unitframesetupfavorites@Initialize	152	0x5eb2fc
@@Unitframesetupfolders@Finalize	155	0x5ec57c
@@Unitframesetupfolders@Initialize	154	0x5ec56c
@@Unitframesetupgenerals@Finalize	157	0x5ed714
@@Unitframesetupgenerals@Initialize	156	0x5ed704
@@Unitframesetuphistory@Finalize	159	0x5eed1c
@@Unitframesetuphistory@Initialize	158	0x5eed0c
@@Unitframesetuphistoryview@Finalize	161	0x5efe34
@@Unitframesetuphistoryview@Initialize	160	0x5efe24
@@Unitframesetupinterface@Finalize	163	0x5f1fd8
@@Unitframesetupinterface@Initialize	162	0x5f1fc8
@@Unitframesetuplaunch@Finalize	165	0x5f3b3c
@@Unitframesetuplaunch@Initialize	164	0x5f3b2c
@@Unitframesetuplookup@Finalize	167	0x5f5a48
@@Unitframesetuplookup@Initialize	166	0x5f5a38
@@Unitframesetupmessenger@Finalize	169	0x5f7a68
@@Unitframesetupmessenger@Initialize	168	0x5f7a58
@@Unitframesetupnotifications@Finalize	171	0x5f9014
@@Unitframesetupnotifications@Initialize	170	0x5f9004
@@Unitframesetupnotificationsfavorites@Finalize	173	0x5fa5b0
@@Unitframesetupnotificationsfavorites@Initialize	172	0x5fa5a0
@@Unitframesetupnotificationsfolders@Finalize	177	0x5fd588
@@Unitframesetupnotificationsfolders@Initialize	176	0x5fd578
@@Unitframesetupnotificationshistory@Finalize	179	0x5ff700
@@Unitframesetupnotificationshistory@Initialize	178	0x5ff6f0
@@Unitframesetupnotificationsscanner@Finalize	181	0x600eb8
@@Unitframesetupnotificationsscanner@Initialize	180	0x600ea8
@@Unitframesetupnotificationssearch@Finalize	183	0x602240
@@Unitframesetupnotificationssearch@Initialize	182	0x602230
@@Unitframesetupnotificationssubnetmonitor@Finalize	185	0x604584
@@Unitframesetupnotificationssubnetmonitor@Initialize	184	0x604574
@@Unitframesetupoptimizations@Finalize	187	0x60566c
@@Unitframesetupoptimizations@Initialize	186	0x60565c
@@Unitframesetupscanner@Finalize	175	0x5fbba8
@@Unitframesetupscanner@Initialize	174	0x5fbb98
@@Unitframesetupscannerview@Finalize	189	0x606784
@@Unitframesetupscannerview@Initialize	188	0x606774
@@Unitframesetupsearch@Finalize	191	0x607904
@@Unitframesetupsearch@Initialize	190	0x6078f4
@@Unitframesetupsubnetmonitor@Finalize	193	0x60911c
@@Unitframesetupsubnetmonitor@Initialize	192	0x60910c
@@Unitframesetupsubnetmonitoradditions@Finalize	195	0x60a2b0
@@Unitframesetupsubnetmonitoradditions@Initialize	194	0x60a2a0
@@Unitframesubtools@Finalize	197	0x60ad90
@@Unitframesubtools@Initialize	196	0x60ad80
@@Unitframetools@Finalize	199	0x60d1d4
@@Unitframetools@Initialize	198	0x60d1c4
@@Unitframevtreeview@Finalize	201	0x6213a4
@@Unitframevtreeview@Initialize	200	0x621394
@@Unitframewakeonlan@Finalize	203	0x6224e0
@@Unitframewakeonlan@Initialize	202	0x6224d0
@@Unitfriendlynames@Finalize	205	0x627738
@@Unitfriendlynames@Initialize	204	0x627728
@@Unitmessage@Finalize	207	0x629080
@@Unitmessage@Initialize	206	0x629070
@@Unitnetstat@Finalize	209	0x62f468
@@Unitnetstat@Initialize	208	0x62f458
@@Unitrescanthread@Finalize	211	0x64c4e4
@@Unitrescanthread@Initialize	210	0x64c4d4
@@Unitsearchthread@Finalize	213	0x650604
@@Unitsearchthread@Initialize	212	0x6505f4
@@Unitstart@Finalize	215	0x652fc4
@@Unitstart@Initialize	214	0x652fb4
@@Unitwakeonlan@Finalize	217	0x667fc0
@@Unitwakeonlan@Initialize	216	0x667fb0
_Form1	219	0x80e6e4
_FormAbout	221	0xcddae0
_FormAddApplication	229	0xcddb24
_FormAddContact	230	0xcddb2c
_FormAddFavorit	222	0xcddae8
_FormAddFriendlyName	231	0xcddb34
_FormAddToList	232	0xcddb3c
_FormAddWmiQuery	233	0xcddb44
_FormChat	234	0xcddb4c
_FormChatDownload	235	0xcddb54
_FormChatDownloadAction	223	0xcddaf0
_FormChatUpload	236	0xcddb5c
_FormDeleteComputersInRange	224	0xcddafc
_FormDhcp	237	0xcddb64
_FormDiapasons	225	0xcddb04
_FormEditApplications	238	0xcddb70
_FormEmailText	239	0xcddb78
_FormEmailTextAndCaption	240	0xcddb80
_FormEnterCode	226	0xcddb0c
_FormExcludedIP	227	0xcddb14
_FormExecute	241	0xcddb88
_FormExternalIp	242	0xcddb90
_FormFavoriteAddGroup	243	0xcddb9c
_FormFavorites	228	0xcddb1c
_FormFind	244	0xcddba4
_FormFindContacts	245	0xcddbac
_FormFriendlyNames	319	0xce645c
_FormHostToIP	247	0xcddbc0
_FormHostsList	246	0xcddbb8
_FormIpWhois	248	0xcddbd0
_FormMessage	320	0xce6464
_FormNetStat	321	0xce646c
_FormNetwork	249	0xcddbdc
_FormNetworkInfo	250	0xcddd74
_FormNickName	251	0xcddd7c
_FormNotification	252	0xcddd84
_FormPinger	253	0xcddd8c
_FormQuestion	254	0xce6254
_FormRegistrationLink	255	0xce625c
_FormSearchSetup	256	0xce6264
_FormSetup	257	0xce626c
_FormStart	322	0xcecbc4
_FormTestWmiQuery	258	0xce6274
_FormTopSearch	259	0xce627c
_FormWakeOnLan	323	0xcecbcc
_FrameAddWmiQuery	260	0xce6284
_FrameAdminScanner	261	0xce628c
_FrameButton	262	0xce6294
_FrameChat	263	0xce629c
_FrameChatDownloadA	264	0xce62a4
_FrameChatDownloadB	265	0xce62ac
_FrameChatMemo	266	0xce62b4
_FrameChatMessage	267	0xce62bc
_FrameChatUploadA	268	0xce62c4
_FrameChatUploadB	269	0xce62cc
_FrameFavorites	270	0xce62d4
_FrameFavoritesActions	271	0xce62dc
_FrameFolders	272	0xce62e4
_FrameHistory	273	0xce62ec
_FrameHostByIp	274	0xce62f4
_FrameMain	275	0xce62fc
_FrameMain2	276	0xce6304
_FrameMainMenu	277	0xce630c
_FrameMemo	220	0xcddad8
_FrameMessanger	278	0xce6314
_FrameNetwork	279	0xce631c
_FrameNetworkButtons	280	0xce6324
_FramePages	281	0xce632c
_FramePingerOptions	282	0xce6334
_FramePrivateNetwork	283	0xce633c
_FrameScanner	284	0xce6344
_FrameSearch	285	0xce634c
_FrameSearchMemo	286	0xce6354
_FrameSearchSetup	287	0xce635c
_FrameSetupAdminScanner	288	0xce6364
_FrameSetupAuthorization	289	0xce636c
_FrameSetupDetails	290	0xce6374
_FrameSetupEmail	291	0xce637c
_FrameSetupEmailSubject	292	0xce6384
_FrameSetupFavorites	293	0xce638c
_FrameSetupFolders	294	0xce6394
_FrameSetupGenerals	295	0xce639c
_FrameSetupHistory	296	0xce63a4
_FrameSetupHistoryView	297	0xce63ac
_FrameSetupInterface	298	0xce63b4
_FrameSetupLaunch	299	0xce63bc
_FrameSetupLookup	300	0xce63c4
_FrameSetupMessenger	301	0xce63cc
_FrameSetupNotifications	302	0xce63d4
_FrameSetupNotificationsFavorites	303	0xce63dc
_FrameSetupNotificationsFolders	305	0xce63ec
_FrameSetupNotificationsHistory	306	0xce63f4
_FrameSetupNotificationsScanner	307	0xce63fc
_FrameSetupNotificationsSearch	308	0xce6404
_FrameSetupNotificationsSubnetMonitor	309	0xce640c
_FrameSetupOptimizations	310	0xce6414
_FrameSetupScanner	304	0xce63e4
_FrameSetupScannerView	311	0xce641c
_FrameSetupSearch	312	0xce6424
_FrameSetupSubnetMonitor	313	0xce642c
_FrameSetupSubnetMonitorAdditions	314	0xce6434
_FrameSubTools	315	0xce643c
_FrameTools	316	0xce6444
_FrameWakeOnLan	318	0xce6454
_VTreeView	317	0xce644c
__GetExceptDLLinfo	1	0x4019a9
___CPPdebugHook	218	0x6fe08c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Target ID:	0
Start time:	09:34:20
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	17'103'832 bytes
MD5 hash:	0694A17DA60D94BC3309098B233AEF78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:34:24
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x850000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:34:25
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	09:34:30
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\Gosse.com
Wow64 process (32bit):	false
Commandline:	C:\Users\user~1\AppData\Local\Temp\Gosse.com
Imagebase:	0x560000
File size:	943'784 bytes
MD5 hash:	3F58A517F1F4796225137E7659AD2ADB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:34:30
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 340
Imagebase:	0x4f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	149
Total number of Limit Nodes:	7

Executed Functions

Function 0040776F Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040770F: GlobalAlloc.KERNEL32(00000000,00000000,00000000), ref: 0040773F

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 004077D3

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
Instruction ID: 03524519066ab66380ecbdf984077dc0787cf4149a756cb5b344f163c456cec1
Opcode Fuzzy Hash: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
Instruction Fuzzy Hash: 71510D75D04109EFCB04DF94C894AEEB7B5BF48304F10856AE915BB380D778AE41CBA6

Function 00407E8F Relevance: 5.5, APIs: 3, Instructions: 995
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(?,00000A46), ref: 00407F73

Part of subcall function 0040770F: GlobalAlloc.KERNEL32(00000000,00000000,00000000), ref: 0040773F

Part of subcall function 00406C7F: LoadLibraryW.KERNEL32(?), ref: 00406CB0

VirtualProtect.KERNEL32(?,00000000,?,00000000), ref: 00408A64
VirtualProtect.KERNEL32(?,00000000,00000000,00000000), ref: 00408A97

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID: AllocGlobalProtectVirtual$LibraryLoad
String ID:
API String ID: 1966084984-0
Opcode ID: 240aa55989c54137efdc20a0ee1ae1ca480df6d3202c4e1da627c4bf8a4fd026
Instruction ID: ffbc487f99c0a8ac10794f2bfb82874873ef3a5219f1d42633b8ce8ba29e633f
Opcode Fuzzy Hash: 240aa55989c54137efdc20a0ee1ae1ca480df6d3202c4e1da627c4bf8a4fd026
Instruction Fuzzy Hash: 7E92E6B5E00208EFCB14DB99C991EEEB7B5BF88304F2481ADE509AB341D635AE41DF54

Function 0040704F Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 00407071

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
Instruction ID: ebf1ab169aa65ce7b25b2d41517a6a6d60beae227778e022459172ed27128525
Opcode Fuzzy Hash: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
Instruction Fuzzy Hash: 8131F075A04108FFCB04DF98C891F9EB7B5EF88310F20C599E918AB391D635AE42DB95

Function 0040763F Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00407661
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000), ref: 0040768F

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction ID: d9989f9fd0eed4b373e691c40e5552d5e68f1ee4f0b1f6b38608a3341f5c551b
Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction Fuzzy Hash: D5012D74A04108BBDB10EE58CD41F9AB3B9AF88314F208155FA19AB3D1D671FE02DBA5

Function 0040770F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000000,00000000,00000000), ref: 0040773F

Strings

b@, xrefs: 00407713

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID: AllocGlobal
String ID: b@
API String ID: 3761449716-3515329064
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: e1bad053ceb743e31e0d6dfb34053f85395c269681c8cbcc2dbd008c16bec6bf
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: ADF09278A04208EFCB44DF58D480959B7A5EB48360F10C299ED198B341D630EE82CB94

Function 00406C7F Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040770F: GlobalAlloc.KERNEL32(00000000,00000000,00000000), ref: 0040773F

LoadLibraryW.KERNEL32(?), ref: 00406CB0

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
Instruction ID: 8c31eaea6dc6eaa0a7381939c9b8295f9fb0dfd82a50cac5d02d9821466ecf05
Opcode Fuzzy Hash: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
Instruction Fuzzy Hash: EEE0E575E0410CBFCB40DFA8DD5295D7BB89F48201F1081A9F908AB340E531AA1187D1

Function 00408C9F Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction ID: b3edd68bbd45488733e48e5c8918cd6a7dcf83e1a7908e62120753995bdbe5b8
Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction Fuzzy Hash: 9D91F8B5D04208EFCB08CF98D980AEEBBB5BF88300F108159E555BB391D734AA45CFA5

Non-executed Functions

Function 00407E3F Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

_n@, xrefs: 00407E4C

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID:
String ID: _n@
API String ID: 0-352565030
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Function 0040B1FD Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa78199abb1e5984f9f6272ba491194ad922472c3f6f19ab7874f3778982a97b
Instruction ID: 87603172a10afce256a0dd87adda0fecf86c0a47b68516225d87ffa747c73b1e
Opcode Fuzzy Hash: aa78199abb1e5984f9f6272ba491194ad922472c3f6f19ab7874f3778982a97b
Instruction Fuzzy Hash: D69190DD4227D325C91A0E3AED01AE2FB516F118DD7229B68ECE0B94E8D753D34B0D90

Function 0040A375 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1342080482.0000000000406000.00000020.00000001.01000000.00000003.sdmp, Offset: 00406000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_406000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98432229629a42418ef7100e1eb3a31b3f63d6720f9efc5953ff097066c1125
Instruction ID: a154d402be91653938ccc42e68613c75d6134d705f0daee81e5d179c75231d23
Opcode Fuzzy Hash: a98432229629a42418ef7100e1eb3a31b3f63d6720f9efc5953ff097066c1125
Instruction Fuzzy Hash: BA417AD81033D73A890F19BAEDB1EE1AF424E928C8711979CECD1B95B0EB478B030D50

Analysis Process: Gosse.comPID: 3452, Parent PID: 6596COMMON

Non-executed Functions

Function 005F9FB4 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 636windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 005FA058
SendMessageW.USER32(?,0000130B,00000000,00000000,?,?,?), ref: 005FA099
GetWindowLongW.USER32(FFFFFDD9,000000F0,?,?,?), ref: 005FA0DD
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005FA107
SendMessageW.USER32 ref: 005FA130
GetKeyState.USER32(00000011,?,?,?), ref: 005FA1C9
GetKeyState.USER32(00000009), ref: 005FA1D6
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005FA1EC
GetKeyState.USER32(00000010), ref: 005FA1F6
SendMessageW.USER32(?,0000110A,00000009,00000000,?,?,?), ref: 005FA227
SendMessageW.USER32 ref: 005FA24E
SendMessageW.USER32(?,00001030,?,005F8851,?,00000000,?,?,?,?,?,?), ref: 005FA358
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 005FA36E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 005FA381
SetCapture.USER32(?), ref: 005FA38A
ClientToScreen.USER32(?,?,?,?,00000001,@GUI_DRAGID), ref: 005FA3EF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 005FA3FC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005FA416
ReleaseCapture.USER32(?,?,?), ref: 005FA421
GetCursorPos.USER32(?,?,00000001,?,?,?), ref: 005FA45B
ScreenToClient.USER32(?,?), ref: 005FA468
SendMessageW.USER32(?,00001012,00000000,?,?), ref: 005FA4C4
SendMessageW.USER32 ref: 005FA4EF
SendMessageW.USER32(?,00001111,00000000,?,?), ref: 005FA52C
SendMessageW.USER32 ref: 005FA55B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 005FA57C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 005FA58B
GetCursorPos.USER32(?,?,00000001,?,?,?), ref: 005FA5AB
ScreenToClient.USER32(?,?), ref: 005FA5B8
GetParent.USER32(?,?), ref: 005FA5D8
SendMessageW.USER32(?,00001012,00000000,?,?), ref: 005FA641
SendMessageW.USER32 ref: 005FA66F
ClientToScreen.USER32(?,?), ref: 005FA6CD
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 005FA6FD
SendMessageW.USER32(?,00001111,00000000,?,?), ref: 005FA727
SendMessageW.USER32 ref: 005FA74A
ClientToScreen.USER32(?,?), ref: 005FA799
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 005FA7CD

Part of subcall function 00574E23: GetWindowLongW.USER32(?,000000EB,?,00000003,?,005B913F,?), ref: 00574E34

GetWindowLongW.USER32(?,000000F0,?,?,?,?,?,?,?), ref: 005FA860

Strings

F, xrefs: 005FA750
P3c, xrefs: 005FA3D0
@GUI_DRAGID, xrefs: 005FA3BD

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$P3c
API String ID: 3429851547-1295901150
Opcode ID: 76c43a6a77a13ab8f4959c3c5c0401aebd0cce19a2ef10281e3baf4f11a71695
Instruction ID: 7d075adc9415ffb1b1090543c34a97cb7f5a57b26aea0494d3abca5bbe69a570
Opcode Fuzzy Hash: 76c43a6a77a13ab8f4959c3c5c0401aebd0cce19a2ef10281e3baf4f11a71695
Instruction Fuzzy Hash: 6C42B0B4604205AFD724CF24D848A7ABFEAFF48710F104A19F659C72A1DB79E844DB63

Function 00575D03 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00575D0D
FindWindowW.USER32(Shell_TrayWnd,00000000,000000FF), ref: 005B9CD1
IsIconic.USER32(00000000,000000FF), ref: 005B9CDA
ShowWindow.USER32(00000000,00000009), ref: 005B9CE7
SetForegroundWindow.USER32(00000000), ref: 005B9CF1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 005B9D07
GetCurrentThreadId.KERNEL32 ref: 005B9D0E
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 005B9D1A
AttachThreadInput.USER32(?,00000000,00000001), ref: 005B9D2B
AttachThreadInput.USER32(?,00000000,00000001), ref: 005B9D33
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 005B9D3B
SetForegroundWindow.USER32(00000000), ref: 005B9D3E
MapVirtualKeyW.USER32(00000012,00000000,00000000,00000000), ref: 005B9D53
keybd_event.USER32(00000012,00000000), ref: 005B9D5E
MapVirtualKeyW.USER32(00000012,00000000,00000002,00000000), ref: 005B9D68
keybd_event.USER32(00000012,00000000), ref: 005B9D6D
MapVirtualKeyW.USER32(00000012,00000000,00000000,00000000), ref: 005B9D76
keybd_event.USER32(00000012,00000000), ref: 005B9D7B
MapVirtualKeyW.USER32(00000012,00000000,00000002,00000000), ref: 005B9D85
keybd_event.USER32(00000012,00000000), ref: 005B9D8A
SetForegroundWindow.USER32(00000000), ref: 005B9D8D
AttachThreadInput.USER32(?,000000FF,00000000), ref: 005B9DB4

Strings

Shell_TrayWnd, xrefs: 005B9CCC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 4f52a20954c7f9f9b59aceb9d212ba7ea053ad4741ba1f5290d40461723f2b8d
Instruction ID: 3cf160586f9fce542befb0a6044032e5845fea255132bcd7801e988ce954bde3
Opcode Fuzzy Hash: 4f52a20954c7f9f9b59aceb9d212ba7ea053ad4741ba1f5290d40461723f2b8d
Instruction Fuzzy Hash: 1C314F71A40218BEEB206BA29C4AFBE7E7DEB54B50F100055FA04EA1D1C6B56D10EAB1

Function 005C230F Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 005C27D9: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005C2823
Part of subcall function 005C27D9: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005C2850
Part of subcall function 005C27D9: GetLastError.KERNEL32 ref: 005C2860

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 005C2394
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 005C23B6
CloseHandle.KERNEL32(?), ref: 005C23C7
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005C23DF
GetProcessWindowStation.USER32 ref: 005C23F8
SetProcessWindowStation.USER32(00000000), ref: 005C2402
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 005C241E

Part of subcall function 005C21C9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005C2308), ref: 005C21DE
Part of subcall function 005C21C9: CloseHandle.KERNEL32(?,?,005C2308), ref: 005C21F3

Strings

, xrefs: 005C2368
winsta0, xrefs: 005C23DA
4ib, xrefs: 005C24A0
default, xrefs: 005C2419

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $4ib$default$winsta0
API String ID: 22674027-1008199622
Opcode ID: 0359eeceba85dc98b0c07502cbc79ec5984170930e8eb2f0ab6e21df2ad1d0f7
Instruction ID: 7e08808947cbe6cfa01e2129f8d8c96a5e6cb8e4492b02c97e69dcc1035dbf2c
Opcode Fuzzy Hash: 0359eeceba85dc98b0c07502cbc79ec5984170930e8eb2f0ab6e21df2ad1d0f7
Instruction Fuzzy Hash: C68154B2901209AFDF119FA4DC49FAE7FB9BF48700F14402DF914EA1A0D7758A49DB60

Function 005C1C68 Relevance: 31.7, APIs: 21, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C2203: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C221E
Part of subcall function 005C2203: GetLastError.KERNEL32(?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C222A
Part of subcall function 005C2203: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2239
Part of subcall function 005C2203: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2240
Part of subcall function 005C2203: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2257

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005C1CD2
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005C1D06
GetLengthSid.ADVAPI32(?), ref: 005C1D1D
GetAce.ADVAPI32(?,00000000,?), ref: 005C1D57
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005C1D73
GetLengthSid.ADVAPI32(?), ref: 005C1D8A
GetProcessHeap.KERNEL32(00000008,00000008), ref: 005C1D92
HeapAlloc.KERNEL32(00000000), ref: 005C1D99
GetLengthSid.ADVAPI32(?,00000008,?), ref: 005C1DBA
CopySid.ADVAPI32(00000000), ref: 005C1DC1
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005C1DF0
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005C1E12
SetUserObjectSecurity.USER32(?,00000004,?), ref: 005C1E24
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C1E4B
HeapFree.KERNEL32(00000000), ref: 005C1E52
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C1E5B
HeapFree.KERNEL32(00000000), ref: 005C1E62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C1E6B
HeapFree.KERNEL32(00000000), ref: 005C1E72
GetProcessHeap.KERNEL32(00000000,?), ref: 005C1E7E
HeapFree.KERNEL32(00000000), ref: 005C1E85

Part of subcall function 005C229F: GetProcessHeap.KERNEL32(00000008,005C1CB7,?,00000000,?,005C1CB7,?), ref: 005C22AD
Part of subcall function 005C229F: HeapAlloc.KERNEL32(00000000,?,00000000,?,005C1CB7,?), ref: 005C22B4
Part of subcall function 005C229F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,005C1CB7,?), ref: 005C22C3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: e562cbdc0963d3f2d6b53552fd78ad81f7dddde1ca7207ab0314f41cc68b791e
Instruction ID: c2d4b4fe460b95bc8cac390f90546c01ba96f47def85c403b82b54cb15a1791a
Opcode Fuzzy Hash: e562cbdc0963d3f2d6b53552fd78ad81f7dddde1ca7207ab0314f41cc68b791e
Instruction Fuzzy Hash: 5B7159B290020AAFDB109FA5DC48FEEBFBDBF15310F148119E915E7291DB359A05DBA0

Function 005DF664 Relevance: 30.2, APIs: 20, Instructions: 189clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 005DF68E
IsClipboardFormatAvailable.USER32(0000000D), ref: 005DF69C
GetClipboardData.USER32(0000000D), ref: 005DF6A8
CloseClipboard.USER32 ref: 005DF6B4
GlobalLock.KERNEL32(00000000), ref: 005DF6EC
CloseClipboard.USER32 ref: 005DF6F6
GlobalUnlock.KERNEL32(00000000), ref: 005DF721
IsClipboardFormatAvailable.USER32(00000001), ref: 005DF72E
GetClipboardData.USER32(00000001), ref: 005DF736
GlobalLock.KERNEL32(00000000), ref: 005DF747
GlobalUnlock.KERNEL32(00000000), ref: 005DF787
IsClipboardFormatAvailable.USER32(0000000F), ref: 005DF79D
GetClipboardData.USER32(0000000F), ref: 005DF7A9
GlobalLock.KERNEL32(00000000), ref: 005DF7BA
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 005DF7DC
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 005DF7F9
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 005DF837
GlobalUnlock.KERNEL32(00000000,?), ref: 005DF858
CountClipboardFormats.USER32 ref: 005DF879
CloseClipboard.USER32 ref: 005DF8C2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 9dbf785b5ffed73980faa1e961f91de4dc852b8782234665ae40769ebda20888
Instruction ID: 59f8ff40f2626d7fe003a64c7c80ca15e6cba0d5195182fdcfc1f8a76a1ee43e
Opcode Fuzzy Hash: 9dbf785b5ffed73980faa1e961f91de4dc852b8782234665ae40769ebda20888
Instruction Fuzzy Hash: 62619E352042029FD320EF28E888F6A7BB5BF94704F14842AF456C73A2DB35DD49DB62

Function 0057310D Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 220libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0057313C

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

GetCurrentProcess.KERNEL32(?,005FD9B8,00000000,?,?), ref: 00573253
IsWow64Process.KERNEL32(00000000,?,?), ref: 0057325A
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00573285
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo,?,?), ref: 00573297
FreeLibrary.KERNEL32(00000000,?,?), ref: 005732AC
GetSystemInfo.KERNEL32(?,?,?), ref: 005732D3

Strings

l#c, xrefs: 0057318D
`#c, xrefs: 005732BD
GetNativeSystemInfo, xrefs: 00573291
l#c, xrefs: 00573117
kernel32.dll, xrefs: 00573280

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LibraryProcess$AddressCurrentFreeInfoLoadProcSystemVersionWow64_wcslen
String ID: GetNativeSystemInfo$`#c$kernel32.dll$l#c$l#c
API String ID: 299785327-2249475131
Opcode ID: dcef3861b0c8eb16b8124415588fd54f45a53c1cc635d21b04f05dfb3b8f9611
Instruction ID: a9622e38fe6221ae8b09b83dedd81e99e94e13cb067972877938f5c878c09a24
Opcode Fuzzy Hash: dcef3861b0c8eb16b8124415588fd54f45a53c1cc635d21b04f05dfb3b8f9611
Instruction Fuzzy Hash: AA91B43680A3D7DBEB11C77C7CA55E93F677B7A710B149898D084D7222D6284A0CFBA1

Function 00572D33 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 148windowCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00572D63
IsDebuggerPresent.KERNEL32 ref: 00572D76
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00572DE2

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

Part of subcall function 0056A65C: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0056A69D

SetCurrentDirectoryW.KERNEL32(?,00000001), ref: 00572E63
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 005B7988
SetCurrentDirectoryW.KERNEL32(?), ref: 005B79C9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00621E24), ref: 005B7A52
ShellExecuteW.SHELL32(00000000), ref: 005B7A59

Part of subcall function 00572C51: GetSysColorBrush.USER32(0000000F), ref: 00572C5C
Part of subcall function 00572C51: LoadCursorW.USER32(00000000,00007F00), ref: 00572C6B
Part of subcall function 00572C51: LoadIconW.USER32(00000063), ref: 00572C81
Part of subcall function 00572C51: LoadIconW.USER32(000000A4), ref: 00572C93
Part of subcall function 00572C51: LoadIconW.USER32(000000A2), ref: 00572CA5
Part of subcall function 00572C51: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00572CBD
Part of subcall function 00572C51: RegisterClassExW.USER32(?), ref: 00572D0E

Part of subcall function 0057FBB7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001,00633370,00572E27), ref: 0057FBE5
Part of subcall function 0057FBB7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0057FC06
Part of subcall function 0057FBB7: ShowWindow.USER32(00000000), ref: 0057FC1A
Part of subcall function 0057FBB7: ShowWindow.USER32(00000000), ref: 0057FC23

Part of subcall function 005734C7: Shell_NotifyIconW.SHELL32(00000000,?,?,?,00632B10), ref: 00573598

Strings

p3c, xrefs: 00572D86
AutoIt, xrefs: 005B797D
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 005B7982
p)c, xrefs: 00572E2E
runas, xrefs: 005B7A4D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$p)c$p3c$runas
API String ID: 683915450-1997057470
Opcode ID: 7694e933fe12a5b726eeb3497504a78f47c84791258bd6c382e77c7f0634ff90
Instruction ID: 7907d71ee2c1f9c5cd3705c173ab2321c00b63db30ccd34bb3a9333886c36363
Opcode Fuzzy Hash: 7694e933fe12a5b726eeb3497504a78f47c84791258bd6c382e77c7f0634ff90
Instruction Fuzzy Hash: 42512C3150C346AAD701EF60FC599BE7FBAFFD4700F00582DF585531A2CA289949E7A2

Function 005EC00E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005ED398: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EC0AE,?,?), ref: 005ED3B5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED3F5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED456

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EC0F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005EC172
RegDeleteValueW.ADVAPI32(?,?), ref: 005EC20A
RegCloseKey.ADVAPI32(?), ref: 005EC27E
RegCloseKey.ADVAPI32(?), ref: 005EC29C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 005EC2F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 005EC304
RegDeleteKeyW.ADVAPI32(?,?), ref: 005EC322
FreeLibrary.KERNEL32(00000000), ref: 005EC383
RegCloseKey.ADVAPI32(00000000), ref: 005EC394

Strings

advapi32.dll, xrefs: 005EC2ED
RegDeleteKeyExW, xrefs: 005EC2FE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Close_wcslen$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2820899670-4033151799
Opcode ID: 6e2ec82d7e19c3ea30193d02b19692a60ed0c4c1ad9fbf0fa29560ba1e67ae06
Instruction ID: a5f79388b5a1093b42fc7c91c64e869aa006910f53542ff41c525e1cbe997b3e
Opcode Fuzzy Hash: 6e2ec82d7e19c3ea30193d02b19692a60ed0c4c1ad9fbf0fa29560ba1e67ae06
Instruction Fuzzy Hash: 58C17235204242AFD714DF25C498F2ABFE5BF88314F14895CE49A8B3A2CB75ED46CB91

Function 005DA187 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,000CA9A2,?,00000000), ref: 005DA1A8
GetFileAttributesW.KERNEL32(?), ref: 005DA1E6
SetFileAttributesW.KERNEL32(?,?), ref: 005DA200
FindNextFileW.KERNEL32(00000000,?), ref: 005DA218
FindClose.KERNEL32(00000000), ref: 005DA223
FindFirstFileW.KERNEL32(*.*,?), ref: 005DA23F
SetCurrentDirectoryW.KERNEL32(?), ref: 005DA28F
SetCurrentDirectoryW.KERNEL32(006279A0), ref: 005DA2AD
FindNextFileW.KERNEL32(00000000,00000010), ref: 005DA2B7
FindClose.KERNEL32(00000000), ref: 005DA2C4
FindClose.KERNEL32(00000000), ref: 005DA2D6

Strings

*.*, xrefs: 005DA23A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: eadeaa9bd3dd104a9b68e516e1ead62198e95954008df75345e87a353120bd73
Instruction ID: 7e23a89ebe8073cbbbd65125879b845bb021f40c4c63cb7e8a37696bdd18bc1a
Opcode Fuzzy Hash: eadeaa9bd3dd104a9b68e516e1ead62198e95954008df75345e87a353120bd73
Instruction Fuzzy Hash: AF31F4355012196EDB20AFA9DC4DEEF7BADAF45320F000157E814E3290EB35DA84DB65

Function 005CDE32 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 181fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0056119F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00561192,?), ref: 005611BF

Part of subcall function 005CEF9B: CompareStringW.KERNEL32(00000400,00000001,?,?,005CDE7E,?,?,?,?,?,?,00000000), ref: 005CEFED

GetFileAttributesW.KERNEL32(?), ref: 005CDE8A
GetFileAttributesW.KERNEL32(?), ref: 005CDEA6
FindFirstFileW.KERNEL32(?,?), ref: 005CDEE8
CompareStringW.KERNEL32(00000400,00000001,?,?,?,?,?,?,?), ref: 005CDF9E
DeleteFileW.KERNEL32(?), ref: 005CDFB0
MoveFileW.KERNEL32(?,?,?,?,?), ref: 005CDFC3
DeleteFileW.KERNEL32(?,?,?,?), ref: 005CDFE0
FindNextFileW.KERNEL32(00000000,00000010), ref: 005CE00A
FindClose.KERNEL32(00000000,?,?,?), ref: 005CE026
FindClose.KERNEL32(00000000), ref: 005CE037

Strings

\*.*, xrefs: 005CDE8C, 005CDE9A, 005CDEB1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: File$Find$AttributesCloseCompareDeleteString$FirstFullMoveNameNextPath
String ID: \*.*
API String ID: 2348776734-1173974218
Opcode ID: a5799118d88e61c718f7e1368f721b225b456f89d74c55efade38fbd0e81acea
Instruction ID: 9e0c6ac3e5534e9a6d0974ef856703e5ce0e85992107ae52239138efa4df79f1
Opcode Fuzzy Hash: a5799118d88e61c718f7e1368f721b225b456f89d74c55efade38fbd0e81acea
Instruction Fuzzy Hash: 2E616A31C0110AAECF11EBE4D99AEEDBBB5BF54300F204169E416B31A1EB746E49CB60

Function 005D8C58 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 189timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005D8D1A
SystemTimeToFileTime.KERNEL32(?,?), ref: 005D8D2A
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005D8D36
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005D8DD3
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8DE7
GetFileAttributesW.KERNEL32(?), ref: 005D8DF2
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8E20
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005D8E56
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8E5F

Strings

*.*, xrefs: 005D8E65

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$AttributesSystem
String ID: *.*
API String ID: 2554310696-438819550
Opcode ID: b16d63b971c2a7aa44917b477ac7160c39552f8e5dd18ad93bfb4e8e3adeff7f
Instruction ID: db24e9c63cbf1087735496b8b292b8c75c9937cd580c15002d9eded355f6f45c
Opcode Fuzzy Hash: b16d63b971c2a7aa44917b477ac7160c39552f8e5dd18ad93bfb4e8e3adeff7f
Instruction Fuzzy Hash: 9F616B715042069FC720EF24C8499AEBBE9FF88320F04491AF989D7351DB35EE49CB92

Function 005DA2E4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,000CA9A2,?,00000000), ref: 005DA305
FindNextFileW.KERNEL32(00000000,?), ref: 005DA360
FindClose.KERNEL32(00000000), ref: 005DA36B
FindFirstFileW.KERNEL32(*.*,?), ref: 005DA387
SetCurrentDirectoryW.KERNEL32(?), ref: 005DA3D7
SetCurrentDirectoryW.KERNEL32(006279A0), ref: 005DA3F5
FindNextFileW.KERNEL32(00000000,00000010), ref: 005DA3FF
FindClose.KERNEL32(00000000), ref: 005DA40C
FindClose.KERNEL32(00000000), ref: 005DA41E

Part of subcall function 005CE8E1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 005CE8FC

Strings

*.*, xrefs: 005DA382

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: f04d830cf7db9efe725df0296a75cc9338f0d4749765dff416cb41011faefd86
Instruction ID: 08ea7d4d2c4f972b9dc68ee75ff1f9d2de874e70c91d5d88ec2d6d1703135f24
Opcode Fuzzy Hash: f04d830cf7db9efe725df0296a75cc9338f0d4749765dff416cb41011faefd86
Instruction Fuzzy Hash: B631D5325016196ACF20AFA8EC4CEEF7B6DBF45320F140557E814E3290EB74DA85DB65

Function 005EC844 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005ED398: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EC0AE,?,?), ref: 005ED3B5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED3F5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED456

RegConnectRegistryW.ADVAPI32(?,?,?,?,?), ref: 005EC93E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 005EC9A9
RegCloseKey.ADVAPI32(00000000), ref: 005EC9CD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 005ECA2C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 005ECAE7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 005ECB54
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 005ECBE9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 005ECC3A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 005ECCE3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 005ECD82
RegCloseKey.ADVAPI32(00000000), ref: 005ECD8F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: QueryValue$Close$_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 1076607710-0
Opcode ID: 1d1248610bc398bfb7532fea9c6ee4db61a16732ee69a3626523b108153832dc
Instruction ID: 9d85c59f79999eb75a9eaf5489c297ceac4639cb287f142ef8c635a64ea68bfb
Opcode Fuzzy Hash: 1d1248610bc398bfb7532fea9c6ee4db61a16732ee69a3626523b108153832dc
Instruction Fuzzy Hash: 8F024E716042419FC714DF25C895E2ABFE5FF89314F1884ADE88ACB2A2D731ED46CB51

Function 005CAA95 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 005CAABD
GetAsyncKeyState.USER32(000000A0), ref: 005CAB3E
GetKeyState.USER32(000000A0), ref: 005CAB59
GetAsyncKeyState.USER32(000000A1), ref: 005CAB73
GetKeyState.USER32(000000A1), ref: 005CAB88
GetAsyncKeyState.USER32(00000011), ref: 005CABA0
GetKeyState.USER32(00000011), ref: 005CABB2
GetAsyncKeyState.USER32(00000012), ref: 005CABCA
GetKeyState.USER32(00000012), ref: 005CABDC
GetAsyncKeyState.USER32(0000005B), ref: 005CABF4
GetKeyState.USER32(0000005B), ref: 005CAC06

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6bfc51fc943d87ca6857a914386020034db747e366c3d47be942d2b2c50a3fa3
Instruction ID: df6866bf3a47d135e7e9b1de16627cd336e3af51ae510cbb416efa0da5f587f7
Opcode Fuzzy Hash: 6bfc51fc943d87ca6857a914386020034db747e366c3d47be942d2b2c50a3fa3
Instruction Fuzzy Hash: 054174346047CD6EFF359AE48904BB5BEB2BB1134CF04805DD6C6565C2DA949DC8C763

Function 0059B782 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0059B804
_free.LIBCMT ref: 0059B828
_free.LIBCMT ref: 0059B9AF
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00604560), ref: 0059B9C1
WideCharToMultiByte.KERNEL32(00000000,00000000,006321DC,000000FF,00000000,0000003F,00000000,?,?), ref: 0059BA39
WideCharToMultiByte.KERNEL32(00000000,00000000,00632230,000000FF,?,0000003F,00000000,?), ref: 0059BA66
_free.LIBCMT ref: 0059BB7B

Strings

`E`, xrefs: 0059BADE
`E`, xrefs: 0059B96A, 0059B970

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID: `E`$`E`
API String ID: 314583886-2001098328
Opcode ID: 9868c59495e905dd9771b49af0e5efae3cc199377ec04694dc2f409e75335ac1
Instruction ID: 8fb261e052b438417be9696610c4e10ca5b1265599a5ae17db1e8f08ebd58d6a
Opcode Fuzzy Hash: 9868c59495e905dd9771b49af0e5efae3cc199377ec04694dc2f409e75335ac1
Instruction Fuzzy Hash: 7FC12771900206ABFF249F78EE55AAA7FBAFF85310F14419AE58497291E7308E42C790

Function 005D7591 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 286timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005D75BD
FindClose.KERNEL32(00000000), ref: 005D760E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005D763A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005D7651

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

FileTimeToSystemTime.KERNEL32(?,?), ref: 005D7678

Strings

%02d, xrefs: 005D774C, 005D7756, 005D77A4, 005D77F3, 005D7842, 005D7891
%4d%02d%02d%02d%02d%02d, xrefs: 005D76BE
%4d, xrefs: 005D76FE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FileTime$FindLocal$CloseFirstSystem_wcslen
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 409396820-2428617273
Opcode ID: b9fb993c04d48695c155f1eda41eee89ce5cebb4be232f532cb17f4180f2ee8a
Instruction ID: 0468e04090a2738b248141c4c6ebce15f16f0785ef8de5266f3c57ac7c7ef5ad
Opcode Fuzzy Hash: b9fb993c04d48695c155f1eda41eee89ce5cebb4be232f532cb17f4180f2ee8a
Instruction Fuzzy Hash: D5A14C72508205AFC710EFA4C899DAFBBECBF88300F40491EF595C7191EA74DA49CB62

Function 005DF8D3 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 005DF8FA
EmptyClipboard.USER32 ref: 005DF900
GlobalAlloc.KERNEL32(00000002,?), ref: 005DF915
CloseClipboard.USER32 ref: 005DFA0C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: cb3ae50525c9f008f157a458766da4030def91fd185195093f09f0a15de8063e
Instruction ID: afb58b45efa289e3f0127312c08093b9f9d9c1f28676b3c1039fe0c936af6d5a
Opcode Fuzzy Hash: cb3ae50525c9f008f157a458766da4030def91fd185195093f09f0a15de8063e
Instruction Fuzzy Hash: 25418B35604612AFD320CF19E498B297FE1BF54328F15C4AAE85ACB762C739ED45CB90

Function 005CE180 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0056119F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00561192,?), ref: 005611BF

GetFileAttributesW.KERNEL32(?), ref: 005CE1C0
FindFirstFileW.KERNEL32(?,?), ref: 005CE1FD
DeleteFileW.KERNEL32(?,?,?,?), ref: 005CE24D
FindNextFileW.KERNEL32(00000000,00000010), ref: 005CE25E
FindClose.KERNEL32(00000000), ref: 005CE275
FindClose.KERNEL32(00000000), ref: 005CE27E

Strings

\*.*, xrefs: 005CE1CF

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 9ddb60496a8c0ce6b61bc36d458c526295f1e9231ddf0a60878dbd3a3b1bc77c
Instruction ID: f88de344a713fbc68fa07ce0c01c71a12a9d9c6a5bcd55aa4d9357d9a428a8af
Opcode Fuzzy Hash: 9ddb60496a8c0ce6b61bc36d458c526295f1e9231ddf0a60878dbd3a3b1bc77c
Instruction Fuzzy Hash: B33194314083459FC705EF64E859DAFBBB9BE95300F440E2DF4E5831A1EB24DA09D762

Function 005CF76E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 005C27D9: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005C2823
Part of subcall function 005C27D9: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005C2850
Part of subcall function 005C27D9: GetLastError.KERNEL32 ref: 005C2860

ExitWindowsEx.USER32(?,00000000), ref: 005CF7AA

Strings

, xrefs: 005CF798
, xrefs: 005CF7D4
@, xrefs: 005CF79D
SeShutdownPrivilege, xrefs: 005CF77A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 27889e14c6b0dcf6bfb4a27b0e2a243c9be22025774085235fe88d4838f7a405
Instruction ID: 920d2f061d0d50bb1d9a3869331bc645b1e55844bee9848652e74fc2554faed9
Opcode Fuzzy Hash: 27889e14c6b0dcf6bfb4a27b0e2a243c9be22025774085235fe88d4838f7a405
Instruction Fuzzy Hash: 8D01F2726102256FE72463E8AC89FBBBBEDF744350F54083AFC02E21D2D9684C44D3A0

Function 005D3DBD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,005B7707,?,?,00000000,00000000), ref: 005D3DCD
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005B7707,?,?,00000000,00000000), ref: 005D3DE4
LoadResource.KERNEL32(?,00000000,?,?,005B7707,?,?,00000000,00000000,?,?,?,?,?,?,0057281F), ref: 005D3DF4
SizeofResource.KERNEL32(?,00000000,?,?,005B7707,?,?,00000000,00000000,?,?,?,?,?,?,0057281F), ref: 005D3E05
LockResource.KERNEL32(005B7707,?,?,005B7707,?,?,00000000,00000000,?,?,?,?,?,?,0057281F,?), ref: 005D3E14

Strings

SCRIPT, xrefs: 005D3DDA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 98f78cab7a09c37da680b89df80d726a0a8331d76e5b9e2da86bef604c675297
Instruction ID: 69fbca4263c2618416c4f511ad772b9ed381627e4bc21e2126ae027f512043c6
Opcode Fuzzy Hash: 98f78cab7a09c37da680b89df80d726a0a8331d76e5b9e2da86bef604c675297
Instruction Fuzzy Hash: D0115A75200601AFD7209B29DC48F277BBEEBC5B51F10416AB815D6290DB71DC04EA71

Function 005E2E89 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 005E2E97

Part of subcall function 005DF035: GetWindowRect.USER32(?,?), ref: 005DF04D

GetDesktopWindow.USER32(?,?,?,00000000), ref: 005E2EC1
GetWindowRect.USER32(00000000,?,?,00000000), ref: 005E2EC8
mouse_event.USER32(00008001,?,?,?,?,?,?,?,?,00000000), ref: 005E2EFA

Part of subcall function 005CF7F5: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF86D

GetCursorPos.USER32(?,?,?,?,?,00000000), ref: 005E2F26
mouse_event.USER32(00008001,?,?,00000000,00000000,?,?,?,00000000), ref: 005E2F84

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 7c3f346b2e22bf635b7bc6d755c402ad84cabbfe2f4b86db78a507d8294a59a7
Instruction ID: 48467bd2ed48039b4205b7434127a50f0056c48bde8c9d5bac6ee56619f1d5ee
Opcode Fuzzy Hash: 7c3f346b2e22bf635b7bc6d755c402ad84cabbfe2f4b86db78a507d8294a59a7
Instruction Fuzzy Hash: 1631C272505306ABD710DF55C849FABBBFAFB88314F00091AF499E7191CA34E909CBA2

Function 005C8056 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005C80BE
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 005C80F4
GetProcAddress.KERNEL32(?,DllGetClassObject,?,?,?,?,?,?,?,?,?), ref: 005C8105
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005C8187

Strings

DllGetClassObject, xrefs: 005C80FA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: c1fe1a616d07f0bf8257fff3bd3f1fc2a45ed2cd2e8f4e0d924347beb258a946
Instruction ID: 50fc992c901efd97c40246f654745dfd3ad14d1d75f5815c5c9015f152163ca1
Opcode Fuzzy Hash: c1fe1a616d07f0bf8257fff3bd3f1fc2a45ed2cd2e8f4e0d924347beb258a946
Instruction Fuzzy Hash: A2415971600604AFDB05CF94C888BAA7FFAFF44710F1980ADA905AF206DBB5DD45DBA0

Function 005DA66E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 005DA6BB
Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 005DA6EB
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 005DA7B8
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 005DA7CE

Strings

*.*, xrefs: 005DA6A0

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Find$File$CloseFirstNextSleep_wcslen
String ID: *.*
API String ID: 2693929171-438819550
Opcode ID: 7d28747b5b858e036b8c3ba2da726e7c08d304d3bc083c325b94d48419dff758
Instruction ID: f3bcf9021d1111738f303cc8c321ce2fa1a810a5f6d1d5f665cfc6b9f78a0313
Opcode Fuzzy Hash: 7d28747b5b858e036b8c3ba2da726e7c08d304d3bc083c325b94d48419dff758
Instruction Fuzzy Hash: F3415D7190021AABDF24DF68D949AEEBFB5FF45310F144466E805A3291EB309E84CB61

Function 00573AD9 Relevance: 7.9, APIs: 5, Instructions: 373COMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

DefDlgProcW.USER32(?,?,?,?,?), ref: 00574273
GetSysColor.USER32(0000000F,?,?), ref: 005742C5
SetBkColor.GDI32(?,00000000), ref: 005742D8

Part of subcall function 00573AE2: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00573B2A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: ed8675cf08ebbc70daf3ade8fe101bcad5925a3be959ae9421fe90a1b1919e19
Instruction ID: 773def542fedff3230b19939e22e92559e3667d5980a8cf1a5e9cdea4e475e08
Opcode Fuzzy Hash: ed8675cf08ebbc70daf3ade8fe101bcad5925a3be959ae9421fe90a1b1919e19
Instruction Fuzzy Hash: 64A12974104505BEE739AE38AC9CEBF3E9DFB82310F158509F50AC61D2CB25AD11EA76

Function 005CE2AB Relevance: 7.6, APIs: 5, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 005CE2D0
Process32FirstW.KERNEL32(00000000,?), ref: 005CE2DE
Process32NextW.KERNEL32(00000000,?), ref: 005CE2FE
CompareStringW.KERNEL32(00000400,00000001,?,?,?,00000000,?,?,00000000,00000000), ref: 005CE376
CloseHandle.KERNEL32(00000000), ref: 005CE3BC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
String ID:
API String ID: 2000298826-0
Opcode ID: 7354241cfa08785831d48789eb27371c19a57c4a51bd90067fcd4e85cfe62140
Instruction ID: 98c7cf0b533b207e6a27d5d61dc556d48ff57b037afac173fd9ce1587d10bc6f
Opcode Fuzzy Hash: 7354241cfa08785831d48789eb27371c19a57c4a51bd90067fcd4e85cfe62140
Instruction Fuzzy Hash: FA3180715083419FD300DF90D88AFAABFE8BFD8740F44092DF592871A1EB71A949CB52

Function 005F2558 Relevance: 7.6, APIs: 5, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005F3353: IsWindow.USER32(00000000,?,000CB88A,00000000,?,005AA532,00000001), ref: 005F3384

IsWindowVisible.USER32(?,00000001,?), ref: 005F25D0
IsWindowEnabled.USER32(?,?,00000001,?), ref: 005F25DE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 005F25EB
IsIconic.USER32(?,?,?,00000001,?), ref: 005F25F9
IsZoomed.USER32(?,?,?,?,00000001,?), ref: 005F2607

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c00020d727b85f51fa30dabd17b4f010a41424a1eba8817a271598d409beb0b1
Instruction ID: 5b51a7ec00a5f56d42abd5953ee207285e704e5daeb9d77fca1f7f3df63fbcaa
Opcode Fuzzy Hash: c00020d727b85f51fa30dabd17b4f010a41424a1eba8817a271598d409beb0b1
Instruction Fuzzy Hash: EE21F1756042155FE7209F26C858B3A7FA9FF94324F448058E50ACF652CB79ED42CBA0

Function 005C20BE Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005C20D4
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005C20E0
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005C20EF
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005C20F6
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005C210C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 86646962d52d98a93d9c738529be391cbe2347eda9e319af02ff1e588e8afc70
Instruction ID: 59ac525d10e75371cdf724767efd5d6cf8c85036a95dd832f53ddde9e08eaa42
Opcode Fuzzy Hash: 86646962d52d98a93d9c738529be391cbe2347eda9e319af02ff1e588e8afc70
Instruction Fuzzy Hash: 87F03775200301ABDB110BA69C4EF663BBEFF89760F140814FA45C72A1DA75D804DA70

Function 005DD935 Relevance: 6.1, APIs: 4, Instructions: 76filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?,00000000,?,00000000), ref: 005DD97A
GetLastError.KERNEL32(?,00000000), ref: 005DD9DB
SetEvent.KERNEL32(?,?,00000000), ref: 005DD9EF

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 0200d458508f969e5d0c2ba0c8e5a65aab2ed1dbb0b3c3b4b66da056cc7c5a5e
Instruction ID: 1e1de35c039581319a38f5fedfda245268ba16a1edd87006d19a2ebcde9b74a4
Opcode Fuzzy Hash: 0200d458508f969e5d0c2ba0c8e5a65aab2ed1dbb0b3c3b4b66da056cc7c5a5e
Instruction Fuzzy Hash: F621AE715003059BDB30AF69C849BAABBFCFB40314F10441BE545A2251E735EA44DBA0

Function 005D686D Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005D6897
FindNextFileW.KERNEL32(00000000,?), ref: 005D68ED
FindClose.KERNEL32(?), ref: 005D6935

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8711a14a0e3e0d84bc730dc88d66087f67fc917613dfb7583c29a96472bf9670
Instruction ID: a79751387490ebf2a205d1b64ed831b6ee59117fc9e7153206af8a014d054256
Opcode Fuzzy Hash: 8711a14a0e3e0d84bc730dc88d66087f67fc917613dfb7583c29a96472bf9670
Instruction Fuzzy Hash: 36519C746046029FD714DF28C4A4E96BBE4FF49320F14455EE56A8B3A2DB30FD0ACB91

Function 00592446 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0059253E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00592548
UnhandledExceptionFilter.KERNEL32(00561221,?,?,?,?,?,?), ref: 00592555

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a013d307e3347a3385fcb081d3ffa477cae3a2b35763f9f6134d9ea593d17630
Instruction ID: 21611ede94b023d78d8e4647c0400fcf39f05e7c0b05ff48e770320bc67a346f
Opcode Fuzzy Hash: a013d307e3347a3385fcb081d3ffa477cae3a2b35763f9f6134d9ea593d17630
Instruction Fuzzy Hash: 5C31B374941219ABCB21DF64D889B9DBBB8BF58310F5042DAE81CA72A0E7349F85CF45

Function 005D5D7E Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D5D8B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 005D5DE9
SetErrorMode.KERNEL32(00000000), ref: 005D5E52

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c94c2961307ba3526be69f7028687bfb0f5576e9af1352cefc1757d523a17c69
Instruction ID: 5308a2a88ef104b0d6f54a1c88cd12405033685995d32beef0d224415d796c35
Opcode Fuzzy Hash: c94c2961307ba3526be69f7028687bfb0f5576e9af1352cefc1757d523a17c69
Instruction Fuzzy Hash: F1314F75A00619DFDB10DF54D888EADBBB5FF48314F04809AE8059B352DB36ED5ACB90

Function 005C27D9 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0058042B: __CxxThrowException@8.LIBVCRUNTIME ref: 00580C74
Part of subcall function 0058042B: __CxxThrowException@8.LIBVCRUNTIME ref: 00580C91

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005C2823
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005C2850
GetLastError.KERNEL32 ref: 005C2860

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 91f57e6ee5742880a9afa6a1e9ad3ed811a01feea6ba0ed38428d35469046f46
Instruction ID: a365310074f71fd098888eb609be10241cb69242654fefc650df16162e9905c9
Opcode Fuzzy Hash: 91f57e6ee5742880a9afa6a1e9ad3ed811a01feea6ba0ed38428d35469046f46
Instruction Fuzzy Hash: 121190B1544305AFD718EF54EC8AE6ABBBDFB44710B20852EF84593291EB70AC458B60

Function 005CE3CB Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005CE3E8
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005CE429
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005CE434

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: cc1bc729b8fb233de1a9cafb475b56ac03594c8544e5fee92d6c054febd53195
Instruction ID: 83127de4f8724946112b935b1d5e5aa81215b9b994509b31abf4d67573864b90
Opcode Fuzzy Hash: cc1bc729b8fb233de1a9cafb475b56ac03594c8544e5fee92d6c054febd53195
Instruction Fuzzy Hash: ED117075E01228BFDB108F959C45FAFBFBCEB45B60F108555FD04E7280D6745A049BA1

Function 005C2777 Relevance: 4.5, APIs: 3, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 005C27A0
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005C27B5
FreeSid.ADVAPI32(?), ref: 005C27C5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: dc2a4bd7096a6b11cd92fb6408fbf1c3cc5b3a5276d641df7b9860ac3613c728
Instruction ID: 73577c85b82fa4c11db70b572087481c112bec26bf94465482c81e044182dab2
Opcode Fuzzy Hash: dc2a4bd7096a6b11cd92fb6408fbf1c3cc5b3a5276d641df7b9860ac3613c728
Instruction Fuzzy Hash: E5F0F97195030DFBDB00DFE49C89EADBBBDFB04241F5044A5E900E2181EB35AA48DB64

Function 005CE9BA Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,005B6A2B), ref: 005CE9CA
FindFirstFileW.KERNEL32(?,?), ref: 005CE9DB
FindClose.KERNEL32(00000000), ref: 005CE9EB

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 169c5adc5c65e858d91303bca8822de093db53e53ab8283c6202bdafca576ac0
Instruction ID: 61861ba9dcd1bf32c76f6fe9c44c7ff7e04a40c0db27978ca2037739599aa8af
Opcode Fuzzy Hash: 169c5adc5c65e858d91303bca8822de093db53e53ab8283c6202bdafca576ac0
Instruction Fuzzy Hash: 51E0DF3A8105116B8310A778EC0E8FA7B6DAB16335F100B09F936C30E0EBB49D44A6E6

Function 0059C0D2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0059C19C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 95f23ccfc787ff9a5cdf40d61da841dca7fd9200005745b777d8de21540a57a5
Instruction ID: c3a6a2b9ebb282393210068c0a67b49983c25ae075aef820e92ae18d67621364
Opcode Fuzzy Hash: 95f23ccfc787ff9a5cdf40d61da841dca7fd9200005745b777d8de21540a57a5
Instruction Fuzzy Hash: BC411176900219ABCF209FB9CC8DEAB7FB8FB84714F204669F905D7181E6309E81CB54

Function 005D74F0 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005D751A
FindClose.KERNEL32(00000000), ref: 005D7563

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0475bbcdace052353a6368f68146cdc19d9cc2c82591cce7a4b99d1fc7b2d77f
Instruction ID: 24ddebebec3cd66479a2574168c3c968f91df9f8e3359e47a5e69e0807f1e453
Opcode Fuzzy Hash: 0475bbcdace052353a6368f68146cdc19d9cc2c82591cce7a4b99d1fc7b2d77f
Instruction Fuzzy Hash: C111B2356086059FC720DF29D888A15BBE5FF89324F14C69AE4698F3A2D734ED09CB91

Function 005D4573 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,005E548F,?,?,005E5FF9,?), ref: 005D45A2
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,005E548F,?,?,005E5FF9,?), ref: 005D45B2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: f29a4b927d5b3103ae690b55cfda945c7606aef923eb520d47e0bcd394536081
Instruction ID: b28177fb0c90278b39b8f44c63956e8001a3a1ae70332399a2dbeaa70dbaa538
Opcode Fuzzy Hash: f29a4b927d5b3103ae690b55cfda945c7606aef923eb520d47e0bcd394536081
Instruction Fuzzy Hash: D4F0A7756042192BD72056A99C4DFBB7E6EFFC5761F000266F908D3281D9605805DBF1

Function 005CC078 Relevance: 3.0, APIs: 2, Instructions: 30keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 005CC0AF
keybd_event.USER32(?,000CB67E,?,00000000,?,?,00000002,?,000CB67E,?,00008000), ref: 005CC0C2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 0e16e4ab05cad2e97fe2a07b331162093455ac3431aae5ee63c15a09624afd75
Instruction ID: e5d48346a04a1959b823ace6e61366553f7bccb8cbb4d58c3df7ec3b1810da14
Opcode Fuzzy Hash: 0e16e4ab05cad2e97fe2a07b331162093455ac3431aae5ee63c15a09624afd75
Instruction Fuzzy Hash: 57F0497180424DABDB019FA4C805BBEBFB4FF18315F00804AF955AA291D3798615EBA5

Function 005C21C9 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005C2308), ref: 005C21DE
CloseHandle.KERNEL32(?,?,005C2308), ref: 005C21F3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: d80a4595c05a3236b515e51cb04c38c199dfe9080091f85dc2e8e9a98d6c480e
Instruction ID: 3c532179c8a5f898017a284bec52661c51c7862e7f9bc62f7f3e4ed8894b8c0c
Opcode Fuzzy Hash: d80a4595c05a3236b515e51cb04c38c199dfe9080091f85dc2e8e9a98d6c480e
Instruction Fuzzy Hash: 62E04F72004601AEFB252B10FC0AF727BA9FB04310F14882DFAA5804B1DB62AC94EB10

Function 00580CA4 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00580CBD

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 78a495222afe50b1f90fd9392f6a5404063ffa3a0473db0d2cb815e2c801394b
Instruction ID: 1d068d1bd282ba911f381da46f87aa705c34c490f7875f40f23833a8129e7d53
Opcode Fuzzy Hash: 78a495222afe50b1f90fd9392f6a5404063ffa3a0473db0d2cb815e2c801394b
Instruction Fuzzy Hash: D041D2B1902605CFDB64DFA8D98669EBFF5FB05310F24946AC815EB2A0D330AD44CF90

Function 005DF607 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 005DF622

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 0d26fd68dd3366eb56e150a4d276292d8e2f2d52d4ac59edf242fe05944fad34
Instruction ID: 2dc5f9177bf67c2b5888fe7ea14d26fa8bd6cdd60f48b29a5412a583956595ea
Opcode Fuzzy Hash: 0d26fd68dd3366eb56e150a4d276292d8e2f2d52d4ac59edf242fe05944fad34
Instruction Fuzzy Hash: 0AE0ED752001056FD710AF59D404A5ABBECAB98760F008426A849C7351DA70E944CB94

Function 005A59C7 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005A59D9

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 08f8bf4189d0acb841fd306ed9d0f3005148724a0a8a003895dff5989653a6b1
Instruction ID: 0b98b8a0c36704e725d5818708e4e77f6f9fb73312c0598667a1bc163a81a599
Opcode Fuzzy Hash: 08f8bf4189d0acb841fd306ed9d0f3005148724a0a8a003895dff5989653a6b1
Instruction Fuzzy Hash: 01C04CF5811118ABCF40CFA0EC8CDED77BCBB04304F104956F501E2100EB7495489B10

Function 00580F9F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020FAB,00580A05), ref: 00580FA4

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 77ff4cc37bb98a94bbff188fc8c6a82867c40fdcfb62a042babb8e8ca91cd88c
Instruction ID: ce2889cd61d85f1cc807927ca4f4a4c69aae9758b520dc0327fcb43213d2aaa9
Opcode Fuzzy Hash: 77ff4cc37bb98a94bbff188fc8c6a82867c40fdcfb62a042babb8e8ca91cd88c
Instruction Fuzzy Hash:

Function 005E3622 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 487filememorywindowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 005E3674
DeleteObject.GDI32(?), ref: 005E3687
DestroyWindow.USER32 ref: 005E3696
GetDesktopWindow.USER32(?), ref: 005E36B1
GetWindowRect.USER32(00000000), ref: 005E36B8
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 005E37E7
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 005E37F5
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E383C
GetClientRect.USER32(00000000,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E3848
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000,?,88C00000,000000FF,000000FF,?), ref: 005E3884
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38A6
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38B9
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38C4
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38CD
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38DC
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38E5
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38EC
GlobalFree.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E38F7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E3909
#418.OLEAUT32(?,00000000,00000000,00600BEC,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E391F
GlobalFree.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E392F
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E3955
SendMessageW.USER32(00000000,00000172,00000000,00000007,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E3974
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E3996
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005E3B83

Strings

, xrefs: 005E3B09
AutoIt v3, xrefs: 005E3836
static, xrefs: 005E387E, 005E39D5
DISPLAY, xrefs: 005E39E6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$#418AdjustAllocClientCloseCopyDesktopDestroyHandleImageLockMessageReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2158968032-2373415609
Opcode ID: 9af8a9450d43c2634bf1328901e9ef66634023532435773a31e833135d6841bb
Instruction ID: 21eec1d2c246c3e04df9fdbc81cf8f6a9ae762ac4cce1445fce38c8a526c3779
Opcode Fuzzy Hash: 9af8a9450d43c2634bf1328901e9ef66634023532435773a31e833135d6841bb
Instruction Fuzzy Hash: 89025A71A00205AFDB14DF65CC8DEAE7BBAFB48710F148558F905AB2A1CB74AE05DB60

Function 005F0198 Relevance: 58.2, APIs: 10, Strings: 23, Instructions: 479windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005F0288
_wcslen.LIBCMT ref: 005F029D
IsWindowVisible.USER32(?), ref: 005F02DF
_wcslen.LIBCMT ref: 005F02F5
IsWindowEnabled.USER32(?), ref: 005F0331
_wcslen.LIBCMT ref: 005F0347
_wcslen.LIBCMT ref: 005F0394

Part of subcall function 0058014F: _wcslen.LIBCMT ref: 0058015A

Part of subcall function 005C2E91: SendMessageW.USER32(?,00000188,00000000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C2F15
Part of subcall function 005C2E91: SendMessageW.USER32(?,0000018A,00000000,00000000,?,00000188,00000000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C2F28
Part of subcall function 005C2E91: SendMessageW.USER32(?,00000189,?,00000000,?,0000018A,00000000,00000000,?,00000188,00000000,00000000,?,?,ListBox,?), ref: 005C2F58

Part of subcall function 005C2A02: SendMessageW.USER32(?,000000F0,00000000,00000000,005C29DE), ref: 005C2A0D

Strings

GETLINE, xrefs: 005F0744
DELSTRING, xrefs: 005F04D4
HIDEDROPDOWN, xrefs: 005F0464
GETSELECTED, xrefs: 005F0641
SHOWDROPDOWN, xrefs: 005F042E
FINDSTRING, xrefs: 005F0501
GETCURRENTCOL, xrefs: 005F06CE
ISCHECKED, xrefs: 005F05CC
EDITPASTE, xrefs: 005F0705
TABLEFT, xrefs: 005F0342, 005F0359
SETCURRENTSELECTION, xrefs: 005F0541
ISVISIBLE, xrefs: 005F0294, 005F02AF
SELECTSTRING, xrefs: 005F0599
GETLINECOUNT, xrefs: 005F066C
ISENABLED, xrefs: 005F02F0, 005F0307
CHECK, xrefs: 005F0601
TABRIGHT, xrefs: 005F038F, 005F03A4
GETCURRENTLINE, xrefs: 005F0693
ADDSTRING, xrefs: 005F04A1
CURRENTTAB, xrefs: 005F03DB
UNCHECK, xrefs: 005F0621
GETCURRENTSELECTION, xrefs: 005F056E
SENDCOMMANDID, xrefs: 005F0787

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$MessageSend$Window$BuffCharEnabledUpperVisible
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 37000740-45149045
Opcode ID: 0a15d1241b84441e2878fbd1bf1e16587b433aa6a32a93f6c23f67e65b240f0d
Instruction ID: 751b5358c469fbbfede77f4587236ef063bd47d7b208b29481edee9b72bbefe0
Opcode Fuzzy Hash: 0a15d1241b84441e2878fbd1bf1e16587b433aa6a32a93f6c23f67e65b240f0d
Instruction Fuzzy Hash: 62025D342042168FCB14EF14C858A7A7FA2BF94354F18545CE94A9B3E3DB39ED4ACB51

Function 005F7A98 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 005F7AF2
GetSysColorBrush.USER32(0000000F,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF,?,?), ref: 005F7B23
GetSysColor.USER32(0000000F,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF,?,?), ref: 005F7B2F
SetBkColor.GDI32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF,?), ref: 005F7B49
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF,?), ref: 005F7B58
InflateRect.USER32(?,000000FF,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF), ref: 005F7B83
GetSysColor.USER32(00000010,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF,?,?), ref: 005F7B8B
CreateSolidBrush.GDI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF,?,?), ref: 005F7B92
FrameRect.USER32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF), ref: 005F7BA1
DeleteObject.GDI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF,?,?), ref: 005F7BA8
InflateRect.USER32(?,000000FE,000000FE,?,?,?,?,?,?,?,?,?,?,?,?,005B84EF), ref: 005F7BF3
FillRect.USER32(?,?,?), ref: 005F7C25
GetWindowLongW.USER32(?,000000F0,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F7C47

Part of subcall function 005F7DAB: GetSysColor.USER32(00000012,00000000,?,?,?,?,?,?,?,?,?,?,?,005F7AB8,?,?), ref: 005F7DE4
Part of subcall function 005F7DAB: SetTextColor.GDI32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,005F7AB8,?), ref: 005F7DE8
Part of subcall function 005F7DAB: GetSysColorBrush.USER32(0000000F,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?,?), ref: 005F7DFE
Part of subcall function 005F7DAB: GetSysColor.USER32(0000000F,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?,?), ref: 005F7E09
Part of subcall function 005F7DAB: GetSysColor.USER32(00000011,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?,?), ref: 005F7E26
Part of subcall function 005F7DAB: CreatePen.GDI32(00000000,00000001,00743C00,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000), ref: 005F7E34
Part of subcall function 005F7DAB: SelectObject.GDI32(?,00000000,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E45
Part of subcall function 005F7DAB: SetBkColor.GDI32(?,00000000,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E4E
Part of subcall function 005F7DAB: SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E5B
Part of subcall function 005F7DAB: InflateRect.USER32(?,000000FF,000000FF,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000), ref: 005F7E7A
Part of subcall function 005F7DAB: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005F7E91
Part of subcall function 005F7DAB: GetWindowLongW.USER32(00000000,000000F0,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E9E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: cdc51ad526bb6852085e69735a304b2e77c6eef7df6dcd9bcfaf3c745c08e8a9
Instruction ID: 9ea40dfacda166e94fc3dcb487f86d1c5c9703d1f22482c2ca203a5cb4ce3f00
Opcode Fuzzy Hash: cdc51ad526bb6852085e69735a304b2e77c6eef7df6dcd9bcfaf3c745c08e8a9
Instruction Fuzzy Hash: AFA17D71008309AFD7119F64DC48E7A7BBAFB49321F100A19FA62D61A0D7799948DBA1

Function 005755FB Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00575689
SendMessageW.USER32(?,00001308,?,00000000,?,?), ref: 005B9128
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 005B9161
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 005B958E

Part of subcall function 0057438C: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00575687,?,?,?,?), ref: 005743EF

SendMessageW.USER32(?,00001053), ref: 005B95CA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 005B95E1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 005B95F7
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 005B9602

Strings

0, xrefs: 005B941E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 9df65718496ea35307fa3c4fa52541cd87a8b2de3a637117eec358aaa50ce6eb
Instruction ID: 950f4a64d215d79bca8bbcbe1ec5fc9e1621ff7695fbc3b5ce5dd9c1116ee4e9
Opcode Fuzzy Hash: 9df65718496ea35307fa3c4fa52541cd87a8b2de3a637117eec358aaa50ce6eb
Instruction Fuzzy Hash: A2128E30604602EFDB21CF24D888BA9BFA5BF44300F548569E699CB262D771FC46EF91

Function 005E32BC Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 289windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 005E32EF
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 005E33BA
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 005E33F8
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 005E3408
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 005E344E
GetClientRect.USER32(00000000,?,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 005E345A
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?), ref: 005E34A1
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF), ref: 005E34B0
GetStockObject.GDI32(00000011,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 005E34C0
SelectObject.GDI32(00000000,00000000,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?), ref: 005E34C4
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 005E34D4
GetDeviceCaps.GDI32(00000000,0000005A,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?), ref: 005E34DD
DeleteDC.GDI32(00000000,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 005E34E6
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?,?,50000000), ref: 005E3512
SendMessageW.USER32(00000030,00000000,00000001,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 005E3529
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000,?,50000000,?,00000004,00000500), ref: 005E3564
SendMessageW.USER32(00000000,00000401,00000000,00640000,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF), ref: 005E3578
SendMessageW.USER32(00000404,00000001,00000000,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 005E3589
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000,?,50000000,?,00000004,00000500), ref: 005E35B9
GetStockObject.GDI32(00000011,00000001,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?), ref: 005E35C4
SendMessageW.USER32(00000030,00000000,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?), ref: 005E35CF
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 005E35D9

Strings

AutoIt v3, xrefs: 005E3446
DISPLAY, xrefs: 005E34A6
static, xrefs: 005E349B, 005E35B3
msctls_progress32, xrefs: 005E355A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 75baaff533215bb2fd6a57374c4f6e4fd116488085c723aee48a4cfb42054bf1
Instruction ID: 82cc0d4d53017881e86b769bc75d684b83394013d174a7a0945aac1a3218d344
Opcode Fuzzy Hash: 75baaff533215bb2fd6a57374c4f6e4fd116488085c723aee48a4cfb42054bf1
Instruction Fuzzy Hash: 13A13C71A40215BFEB14DB65DC4AFAE7BBAEB48710F008114FA15EB2D1DA74AA04CB64

Function 005D5681 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 193COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D568F
GetDriveTypeW.KERNEL32(?,?,PhysicalDrive,\\.\), ref: 005D576F
SetErrorMode.KERNEL32(00000000,?,PhysicalDrive,\\.\), ref: 005D58DB

Strings

ATA, xrefs: 005D583D
SCSI, xrefs: 005D582F
SSD, xrefs: 005D57EF
Fibre, xrefs: 005D5852
Removable, xrefs: 005D57B5, 005D57BA
RAMDisk, xrefs: 005D5799
FileBackedVirtual, xrefs: 005D5891
ATAPI, xrefs: 005D5836
Virtual, xrefs: 005D588A
SATA, xrefs: 005D5875
Unknown, xrefs: 005D5792, 005D5828
iSCSI, xrefs: 005D5867
RAID, xrefs: 005D5860
1394, xrefs: 005D5844
MMC, xrefs: 005D5883
PhysicalDrive, xrefs: 005D573E
CDROM, xrefs: 005D57A0
Fixed, xrefs: 005D57AE
SSA, xrefs: 005D584B
Network, xrefs: 005D57A7
SAS, xrefs: 005D586E
\\.\, xrefs: 005D56E1
USB, xrefs: 005D5859

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ac28e1503e10ceb3dd1ad53b535a572751382ec771b4791707c3a4f88144fb2a
Instruction ID: 7220f0c54e10b890b466a4bd58efcc6dd78c117f5533a8016000b4c030f492fb
Opcode Fuzzy Hash: ac28e1503e10ceb3dd1ad53b535a572751382ec771b4791707c3a4f88144fb2a
Instruction Fuzzy Hash: 78618F30A08A05DBC720DF2DD996C787FA2FB44742B348467E41AAB391E631ED45EF51

Function 005F6EBD Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 463windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 005F6F72
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 005F702B
SendMessageW.USER32(?,00001102,00000002,?), ref: 005F7047

Strings

0, xrefs: 005F7084

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 221ba092fdab47f981c1146a2c538423a81e1bf752c617eb9bcdf7856d6af67f
Instruction ID: 599d558f7e305c5bc96c2bf0c4132f34ea28a8c223b27fcea0959265e4952be3
Opcode Fuzzy Hash: 221ba092fdab47f981c1146a2c538423a81e1bf752c617eb9bcdf7856d6af67f
Instruction Fuzzy Hash: CF02D275108309AFD7158F24C848BBBBFE6FF89314F048A19F698D62A1C778D948DB91

Function 005F5E68 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158,?,?,?,?,?), ref: 005F5F58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005F5F69
CharNextW.USER32(00000158), ref: 005F5F98
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 005F5FD9
SendMessageW.USER32(?,00000158,000000FF,0000014E,?,00000158,006328A4), ref: 005F5FEF
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005F6000
SendMessageW.USER32(?,000000C2,00000001,00000158,?,?,?,?,?), ref: 005F601D
SetWindowTextW.USER32(?,00000158,?,?,?,?,?), ref: 005F6069
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 005F607F
SendMessageW.USER32(?,00001002,00000000,?), ref: 005F60B0
SendMessageW.USER32(00000000,00001060,00000001,00000004,00000000,00000158,006328A4), ref: 005F611E
_wcslen.LIBCMT ref: 005F6130
_wcslen.LIBCMT ref: 005F613B
SendMessageW.USER32(?,00001053,000000FF,?), ref: 005F61A7
SendMessageW.USER32(?,00001074,?,00000001,00000000,00000158,006328A4), ref: 005F61FF
_wcslen.LIBCMT ref: 005F6211
_wcslen.LIBCMT ref: 005F621C
SendMessageW.USER32(?,0000133D,?,?), ref: 005F62AC
InvalidateRect.USER32(?,00000000,00000001), ref: 005F62CE
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 005F6318
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 005F6345
DrawMenuBar.USER32(?), ref: 005F6354
SetWindowTextW.USER32(?,00000158,?,?,?,?,?), ref: 005F637C

Strings

0, xrefs: 005F62E6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$_wcslen$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID: 0
API String ID: 3953536602-4108050209
Opcode ID: 8e19f4f236c14f7a6eb42e2d7d558fea86e54116c02489cb8d2effc6aed7ee37
Instruction ID: dc895bb0c2f001b2e08fc833ef51c763612e3cdad8c842bbdc614cf7f5537411
Opcode Fuzzy Hash: 8e19f4f236c14f7a6eb42e2d7d558fea86e54116c02489cb8d2effc6aed7ee37
Instruction Fuzzy Hash: CAE16A74900219ABDF209F54CC88AFE7FBABF05710F108595FA19AB291DB789A44DF60

Function 005F7DAB Relevance: 39.2, APIs: 26, Instructions: 202windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012,00000000,?,?,?,?,?,?,?,?,?,?,?,005F7AB8,?,?), ref: 005F7DE4
SetTextColor.GDI32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,005F7AB8,?), ref: 005F7DE8
GetSysColorBrush.USER32(0000000F,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?,?), ref: 005F7DFE
GetSysColor.USER32(0000000F,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?,?), ref: 005F7E09
CreateSolidBrush.GDI32(?,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?,?), ref: 005F7E0E
GetSysColor.USER32(00000011,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?,?), ref: 005F7E26
CreatePen.GDI32(00000000,00000001,00743C00,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000), ref: 005F7E34
SelectObject.GDI32(?,00000000,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E45
SetBkColor.GDI32(?,00000000,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E4E
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E5B
InflateRect.USER32(?,000000FF,000000FF,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000), ref: 005F7E7A
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005F7E91
GetWindowLongW.USER32(00000000,000000F0,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000,?), ref: 005F7E9E
SendMessageW.USER32(00000000,0000000E,00000000,00000000,?,?,?,?,?,?,?,?,?,005F7AB8,?,?), ref: 005F7EED
GetWindowTextW.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,005F7AB8,?,?,00000000), ref: 005F7F17
InflateRect.USER32(?,000000FD,000000FD,?,?,?,?,?,?,?,?,?,005F7AB8,?), ref: 005F7F35
DrawFocusRect.USER32(?,?,?,?,?,?,?,?,?,?,?,005F7AB8,?), ref: 005F7F40
GetSysColor.USER32(00000011,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F51
SetTextColor.GDI32(?,00000000,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F59
DrawTextW.USER32(?,005F7AB8,000000FF,?,00000000,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F6B
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F82
DeleteObject.GDI32(?,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F8D
SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F93
DeleteObject.GDI32(?,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F98
SetTextColor.GDI32(?,?,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7F9E
SetBkColor.GDI32(?,?,?,?,?,?,?,?,?,?,?,005F7AB8), ref: 005F7FA8

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: b16ff894dd207c313ac1ef3bb2b225c05dbe94bf317e72abdd2347fa2851ebed
Instruction ID: e5c165fb4ec860fa1ac4efe0d53f1c00a2ac2958ce56c3ab15ef09be655f4db0
Opcode Fuzzy Hash: b16ff894dd207c313ac1ef3bb2b225c05dbe94bf317e72abdd2347fa2851ebed
Instruction Fuzzy Hash: 1B615B72900218AFDB109FA4DC49EBEBF7AFB08320F114555FA15EB2A0D7799944DBA0

Function 005F0C42 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 354windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005F0CF0
_wcslen.LIBCMT ref: 005F0D27
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005F0D68
_wcslen.LIBCMT ref: 005F0D78
_wcslen.LIBCMT ref: 005F0DBF
_wcslen.LIBCMT ref: 005F0E31
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 005F0E72
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005F0EA4

Part of subcall function 0058014F: _wcslen.LIBCMT ref: 0058015A

Part of subcall function 005C3498: SendMessageW.USER32(?,0000102B,?,00000000,?,00000000,00000034,00000034), ref: 005C34F8

Strings

GETSELECTEDCOUNT, xrefs: 005F0E2C, 005F0E3D
SELECTINVERT, xrefs: 005F0F3D
VIEWCHANGE, xrefs: 005F102D
SELECTCLEAR, xrefs: 005F0ED9
GETSELECTED, xrefs: 005F0F9B
ISSELECTED, xrefs: 005F0E7D
SELECT, xrefs: 005F0EFD
FINDITEM, xrefs: 005F0FE1
DESELECT, xrefs: 005F0F5B
GETTEXT, xrefs: 005F0DBA, 005F0DCD
SELECTALL, xrefs: 005F0EB5
GETSUBITEMCOUNT, xrefs: 005F0D73, 005F0D86
GETITEMCOUNT, xrefs: 005F0D22, 005F0D35

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: ed05f4abd7e4121bdf3bdea00048ef73238882221a622350ff9d54f90c9ce931
Instruction ID: a06f597c8bf64ead13262e99a37ba03690cbc5a50d42eeb70621e6945c255771
Opcode Fuzzy Hash: ed05f4abd7e4121bdf3bdea00048ef73238882221a622350ff9d54f90c9ce931
Instruction Fuzzy Hash: B3D1BE306042069FCB14EF28C859A7ABFA6BF84314F04496CF9569B3A3DB35ED49CB41

Function 005751FB Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 283windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000,?,00000000,?,?,?,?,?), ref: 005752D2
GetSystemMetrics.USER32(00000007,?,?,?,?,?), ref: 005752DA
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000,?,00000000,?,?,?), ref: 00575305
GetSystemMetrics.USER32(00000008,?,?,?), ref: 0057530D
GetSystemMetrics.USER32(00000004,?,?,?), ref: 00575332
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF,?,00000000,?,?,?), ref: 0057534F
AdjustWindowRectEx.USER32(000000FF,?,00000000,?,?,?,?), ref: 0057535F
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000,?,?,?), ref: 00575392
SetWindowLongW.USER32(00000000,000000EB,00000000,?,?,?), ref: 005753A6
GetClientRect.USER32(00000000,000000FF,?,?,?), ref: 005753C4
GetStockObject.GDI32(00000011,00000000,?,?,?), ref: 005753E0
SendMessageW.USER32(00000000,00000030,00000000,?,?,?), ref: 005753EB

Part of subcall function 00574B74: GetCursorPos.USER32(?,?,00000000,00000000,?,005753FE,00000000,000000FF,?,?,?), ref: 00574B88
Part of subcall function 00574B74: ScreenToClient.USER32(00000000,?,?,005753FE,00000000,000000FF,?,?,?), ref: 00574BA5
Part of subcall function 00574B74: GetAsyncKeyState.USER32(?,?,005753FE), ref: 00574BCE
Part of subcall function 00574B74: GetAsyncKeyState.USER32(?,?,005753FE), ref: 00574BE8

SetTimer.USER32(00000000,00000000,00000028,00573AA8,00000000,000000FF,?,?,?), ref: 00575412

Strings

(c, xrefs: 005B8DA2
(c, xrefs: 00575236
AutoIt v3 GUI, xrefs: 0057538A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI$(c$(c
API String ID: 1458621304-1965237024
Opcode ID: 0a27cbd58ba62772ccc9099989e343ad009a9cf8c8c6316e6c0347de5aa36955
Instruction ID: 5a308cc8230d119dcfb182cb2b083106a2556e16aad62e570ea2e67342f2c5ef
Opcode Fuzzy Hash: 0a27cbd58ba62772ccc9099989e343ad009a9cf8c8c6316e6c0347de5aa36955
Instruction Fuzzy Hash: E4B15D35A0020AAFDB14DFA8DC59BEE3BB6FB58310F104219FA19E7290DB74A844DB51

Function 005F1934 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 282windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 005F1A60
GetDesktopWindow.USER32(?), ref: 005F1A75
GetWindowRect.USER32(00000000), ref: 005F1A7C
GetWindowLongW.USER32(?,000000F0), ref: 005F1AD5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 005F1B0E
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005F1B2C
DestroyWindow.USER32(?), ref: 005F1B4A
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 005F1B6C
SendMessageW.USER32(?,00000421,?,?), ref: 005F1B81
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 005F1B94
IsWindowVisible.USER32(?), ref: 005F1BB4
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 005F1BCF
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 005F1BE3
GetWindowRect.USER32(?,?), ref: 005F1BFB
MonitorFromPoint.USER32(00000000,00000000,00000002), ref: 005F1C21
GetMonitorInfoW.USER32(00000000,?), ref: 005F1C3B
CopyRect.USER32(?,?), ref: 005F1C52
SendMessageW.USER32(?,00000412,00000000), ref: 005F1CBD

Strings

(, xrefs: 005F1C2E
tooltips_class32, xrefs: 005F1B07
0, xrefs: 005F1A0B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 18653c7a4d63f7dce17a07eb864352eead1c33ff62c2754260c59f596eb7c1c1
Instruction ID: 4c06831a1dbcaf3c9e5f68e51793ace5a0625838596c6ffcd92a74315998355d
Opcode Fuzzy Hash: 18653c7a4d63f7dce17a07eb864352eead1c33ff62c2754260c59f596eb7c1c1
Instruction Fuzzy Hash: B8B17A70604745EFC714CF24C988A6ABBE5FF99310F04891CF5899B261DB78ED48CB99

Function 005C4198 Relevance: 33.6, APIs: 8, Strings: 11, Instructions: 362COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005C423F
_wcslen.LIBCMT ref: 005C42AC
_wcslen.LIBCMT ref: 005C4310

Strings

<jb, xrefs: 005C443E
(jb, xrefs: 005C4397
@jb, xrefs: 005C446C
Hjb, xrefs: 005C44CE
REGEXPCLASS, xrefs: 005C430B, 005C431E
INSTANCE, xrefs: 005C44FF
CLASS, xrefs: 005C423A, 005C4256
NAME, xrefs: 005C43D9, 005C43EC
CLASSNN, xrefs: 005C42A7, 005C42BA
TEXT, xrefs: 005C452D
Djb, xrefs: 005C449D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen
String ID: (jb$<jb$@jb$CLASS$CLASSNN$Djb$Hjb$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-207477615
Opcode ID: a6a1dd218a89b45f0432049c8b2b86ea4e02d9a8b37af5f6b52c125f7e76fa04
Instruction ID: 88cb19dac0061129aaec54a40c1d9e1e10aa40bed3ce4f862a1440a7f0d9297c
Opcode Fuzzy Hash: a6a1dd218a89b45f0432049c8b2b86ea4e02d9a8b37af5f6b52c125f7e76fa04
Instruction Fuzzy Hash: 9DD19E75E006069FCB18EFA4D496FEEBF65BB54304F508129E81AA7241EB30AD59CF60

Function 005C1E93 Relevance: 31.7, APIs: 21, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C2203: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C221E
Part of subcall function 005C2203: GetLastError.KERNEL32(?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C222A
Part of subcall function 005C2203: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2239
Part of subcall function 005C2203: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2240
Part of subcall function 005C2203: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2257

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005C1EFD
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005C1F31
GetLengthSid.ADVAPI32(?), ref: 005C1F48
GetAce.ADVAPI32(?,00000000,?), ref: 005C1F82
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005C1F9E
GetLengthSid.ADVAPI32(?), ref: 005C1FB5
GetProcessHeap.KERNEL32(00000008,00000008), ref: 005C1FBD
HeapAlloc.KERNEL32(00000000), ref: 005C1FC4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 005C1FE5
CopySid.ADVAPI32(00000000), ref: 005C1FEC
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005C201B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005C203D
SetUserObjectSecurity.USER32(?,00000004,?), ref: 005C204F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C2076
HeapFree.KERNEL32(00000000), ref: 005C207D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C2086
HeapFree.KERNEL32(00000000), ref: 005C208D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005C2096
HeapFree.KERNEL32(00000000), ref: 005C209D
GetProcessHeap.KERNEL32(00000000,?), ref: 005C20A9
HeapFree.KERNEL32(00000000), ref: 005C20B0

Part of subcall function 005C229F: GetProcessHeap.KERNEL32(00000008,005C1CB7,?,00000000,?,005C1CB7,?), ref: 005C22AD
Part of subcall function 005C229F: HeapAlloc.KERNEL32(00000000,?,00000000,?,005C1CB7,?), ref: 005C22B4
Part of subcall function 005C229F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,005C1CB7,?), ref: 005C22C3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: a84de6dee81fcc1330bbde45de7802c6521e91df9434560d49b3be45eb4c4733
Instruction ID: ae9ee41037590255b01ed69af032745773d6adf0a873495cc991f0c4b15b94df
Opcode Fuzzy Hash: a84de6dee81fcc1330bbde45de7802c6521e91df9434560d49b3be45eb4c4733
Instruction Fuzzy Hash: 28715AB290020AAFDB109FE5DC48FEEBBB9BF14700F04851AE915E7191DB759905CBB0

Function 005F8D07 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005F8D25
_wcslen.LIBCMT ref: 005F8D39
_wcslen.LIBCMT ref: 005F8D5C
_wcslen.LIBCMT ref: 005F8D7F
LoadImageW.USER32(00000000,?,00000001,?,?,00002010,00000000,?,?,?,?,?,005F665A), ref: 005F8DC1
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,005F665A), ref: 005F8E23
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005F8E5C
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 005F8E9F
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005F8ED6
FreeLibrary.KERNEL32(?), ref: 005F8EE2
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 005F8EF2
DestroyIcon.USER32(?,?,?,?,?,005F665A), ref: 005F8F01
SendMessageW.USER32(?,00000170,00000000,00000000,?,?,?,?,005F665A), ref: 005F8F1E
SendMessageW.USER32(?,00000064,00000172,00000001,?,?,?,?,005F665A), ref: 005F8F2A

Strings

.exe, xrefs: 005F8D53
.dll, xrefs: 005F8D76
.icl, xrefs: 005F8D33
Zf_, xrefs: 005F8D10, 005F8F30, 005F8EB1, 005F8E38

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl$Zf_
API String ID: 799131459-2648583791
Opcode ID: f9d2390c7a4e1881956e0404a76ea6de6502a4ffa5cb347f85a732c69928635f
Instruction ID: 04f0647b49d1744a5579790ad4babd6ad456b110cc2a2a51ad2da3ce7b6152e7
Opcode Fuzzy Hash: f9d2390c7a4e1881956e0404a76ea6de6502a4ffa5cb347f85a732c69928635f
Instruction Fuzzy Hash: 0461D17160021AFBEB24DF64CC4ABBE7BACBF18720F104505FA15D61D0DB789A94DBA0

Function 005ECDB7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005ECEBD
RegCreateKeyExW.ADVAPI32(?,?,00000000,005FD938,00000000,?,00000000,?,?), ref: 005ECF44
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 005ECFA4
_wcslen.LIBCMT ref: 005ECFF4
_wcslen.LIBCMT ref: 005ED06F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 005ED0B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 005ED1C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 005ED24D
RegCloseKey.ADVAPI32(?), ref: 005ED281
RegCloseKey.ADVAPI32(00000000), ref: 005ED28E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 005ED360

Strings

REG_DWORD, xrefs: 005ED204
REG_SZ, xrefs: 005ED044
REG_BINARY, xrefs: 005ED313
REG_QWORD, xrefs: 005ED2C3
REG_MULTI_SZ, xrefs: 005ED0F5
REG_EXPAND_SZ, xrefs: 005ECFCD

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: da0f1e09fdbb27198bc1973438eb3b69d20000fb7ea67dd7aeda2f338d8b1220
Instruction ID: c330cc49b67fbcf7a1fd1fdfa3333798bd63b4d61282402c69e362c32f1fe276
Opcode Fuzzy Hash: da0f1e09fdbb27198bc1973438eb3b69d20000fb7ea67dd7aeda2f338d8b1220
Instruction Fuzzy Hash: BD127B35604202DFCB18DF15C889A2ABBF5BF88724F14845CF9999B3A2CB35ED45CB91

Function 005F12EA Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 324windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005F1398
_wcslen.LIBCMT ref: 005F13CF
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005F1410
_wcslen.LIBCMT ref: 005F1435
_wcslen.LIBCMT ref: 005F1488
_wcslen.LIBCMT ref: 005F14E2

Part of subcall function 0058014F: _wcslen.LIBCMT ref: 0058015A

Part of subcall function 005C3A35: SendMessageW.USER32(?,0000110A,00000001,00000000,?), ref: 005C3A67

Strings

COLLAPSE, xrefs: 005F1483, 005F1496
EXISTS, xrefs: 005F14DD, 005F14EE
SELECT, xrefs: 005F1647
GETTEXT, xrefs: 005F15D7
EXPAND, xrefs: 005F1538
CHECK, xrefs: 005F1430, 005F1443
GETSELECTED, xrefs: 005F1596
GETTOTALCOUNT, xrefs: 005F13CA, 005F13DD
UNCHECK, xrefs: 005F1672
GETITEMCOUNT, xrefs: 005F1568
ISCHECKED, xrefs: 005F1619

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 13c2d2e8139cc2fa0a0a0944bae309585784e62bc0c8e194bd728441f678fb60
Instruction ID: 35579c2c6a7e488d25c602cb19b4b09851f206cb16e85136992a4482d03b28b6
Opcode Fuzzy Hash: 13c2d2e8139cc2fa0a0a0944bae309585784e62bc0c8e194bd728441f678fb60
Instruction Fuzzy Hash: 5DC1D170604606CFCB14EF24C458A7ABFA2BF84314F04886CF9569B792DB35ED4ACB85

Function 005705DB Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 277COMMON

Download Yara Rule

Strings

', xrefs: 005B6968
Cannot parse #include, xrefs: 005B6A82
#include, xrefs: 005706AC
#include-once, xrefs: 00570694
#comments-end, xrefs: 0057073E
#pragma compile, xrefs: 00570638
", xrefs: 005B6952
#ce, xrefs: 00570752
#OnAutoItStartRegister, xrefs: 0057067C
#comments-start, xrefs: 005706C4, 00570716
Bad directive syntax error, xrefs: 005B6999
#cs, xrefs: 005706D8, 0057072A
#requireadmin, xrefs: 00570664
#notrayicon, xrefs: 0057064C
Unterminated group of comments, xrefs: 005B6A95

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 486a6f4d91f66e95edb0fd9787aa26da7c78d94fe393cd414b1c7eb23e806018
Instruction ID: 20ac0eb0053494026638b876e452dc6a46ac6a5c3bc48c6cd7afdd6add5e5583
Opcode Fuzzy Hash: 486a6f4d91f66e95edb0fd9787aa26da7c78d94fe393cd414b1c7eb23e806018
Instruction Fuzzy Hash: E791D37164020AFADF11BF60DC56FAA3FA9BF94340F148424FD09AB1D2EBB4A911D791

Function 005ED398 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 196COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EC0AE,?,?), ref: 005ED3B5
_wcslen.LIBCMT ref: 005ED3F5
_wcslen.LIBCMT ref: 005ED456

Strings

HKEY_LOCAL_MACHINE, xrefs: 005ED451, 005ED462
HKEY_CURRENT_USER, xrefs: 005ED59A
HKEY_USERS, xrefs: 005ED5BC
HKU, xrefs: 005ED5CD
HKCR, xrefs: 005ED500, 005ED511
HKEY_CLASSES_ROOT, xrefs: 005ED4CB, 005ED4DC
HKLM, xrefs: 005ED48E, 005ED49F
HKCU, xrefs: 005ED5AB
HKEY_CURRENT_CONFIG, xrefs: 005ED53A, 005ED54B
HKCC, xrefs: 005ED589

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: a74fe4a419fcd3b14f54e6211653f9593ef21a46d167b9ca7670ebd66600bbbd
Instruction ID: 3b55d6a37927a0402445481a230cbd62a4fb8fcac71093c1b0846032798aff28
Opcode Fuzzy Hash: a74fe4a419fcd3b14f54e6211653f9593ef21a46d167b9ca7670ebd66600bbbd
Instruction Fuzzy Hash: 7961C432D011A78BCF28AF29ED055BB3F72BB60304F004529EC956B294EA71AC45CBA1

Function 005D4A8B Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 177COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 005D4B0A
_wcslen.LIBCMT ref: 005D4B15
_wcslen.LIBCMT ref: 005D4B5C
_wcslen.LIBCMT ref: 005D4B93
GetDriveTypeW.KERNEL32(?), ref: 005D4BC7
mciSendStringW.WINMM(?,00000000,00000000,00000000, type cdaudio alias cd wait,?,open ), ref: 005D4C10
mciSendStringW.WINMM(?,00000000,00000000,00000000, wait,?,set cd door ), ref: 005D4C4A
mciSendStringW.WINMM(?,00000000,00000000,00000000,close cd wait), ref: 005D4C7F

Strings

close, xrefs: 005D4B10, 005D4B23
open, xrefs: 005D4B57, 005D4B6A
closed, xrefs: 005D4B41, 005D4B8E, 005D4BA3
open , xrefs: 005D4BD6
close cd wait, xrefs: 005D4C67
type cdaudio alias cd wait, xrefs: 005D4BF2
set cd door , xrefs: 005D4C16
wait, xrefs: 005D4C32

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 458e8dd714904ced98b5553c24e2e878564c19c37acc10283cbf74aeaac138ca
Instruction ID: 7b2b79d4a304a2422e79b775480d3bb2093593e5f10aa0b98d32ab83af0865f5
Opcode Fuzzy Hash: 458e8dd714904ced98b5553c24e2e878564c19c37acc10283cbf74aeaac138ca
Instruction Fuzzy Hash: 6E618131A042119BD720EF28D846B6ABBE1FF94724F10856EF85597391DB71EE05CF82

Function 005C69F9 Relevance: 27.2, APIs: 18, Instructions: 195windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 005C6A0C
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 005C6A1D
SetWindowTextW.USER32(?,?), ref: 005C6A35
GetDlgItem.USER32(?,000003EA), ref: 005C6A4B
SetWindowTextW.USER32(00000000,?), ref: 005C6A51
GetDlgItem.USER32(?,000003E9), ref: 005C6A61
SetWindowTextW.USER32(00000000,?), ref: 005C6A67
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 005C6A88
SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 005C6AA1
GetWindowRect.USER32(?,?), ref: 005C6AAA
_wcslen.LIBCMT ref: 005C6B0A
GetDesktopWindow.USER32(?), ref: 005C6B48
GetWindowRect.USER32(00000000), ref: 005C6B4F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Item$MessageSendText$Rect$DesktopIconLoad_wcslen
String ID:
API String ID: 2606896325-0
Opcode ID: 4333d2d7a5fd8d74d35f99192e1e02bb84852a9f97b9bf859661d8d6fe5da6be
Instruction ID: cedf3dc8103f795396d377e7ae87e7d71d089136b96da83708f8611f307d3eff
Opcode Fuzzy Hash: 4333d2d7a5fd8d74d35f99192e1e02bb84852a9f97b9bf859661d8d6fe5da6be
Instruction Fuzzy Hash: 64714871A00609AFDB20DFA8CD85FAEBBF6FB48704F10451CE546E61A0D775AE44DB20

Function 005E09D7 Relevance: 27.1, APIs: 18, Instructions: 129COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 005E09F0
LoadCursorW.USER32(00000000,00007F8A), ref: 005E09FB
LoadCursorW.USER32(00000000,00007F00), ref: 005E0A06
LoadCursorW.USER32(00000000,00007F03), ref: 005E0A11
LoadCursorW.USER32(00000000,00007F8B), ref: 005E0A1C
LoadCursorW.USER32(00000000,00007F01), ref: 005E0A27
LoadCursorW.USER32(00000000,00007F81), ref: 005E0A32
LoadCursorW.USER32(00000000,00007F88), ref: 005E0A3D
LoadCursorW.USER32(00000000,00007F80), ref: 005E0A48
LoadCursorW.USER32(00000000,00007F86), ref: 005E0A53
LoadCursorW.USER32(00000000,00007F83), ref: 005E0A5E
LoadCursorW.USER32(00000000,00007F85), ref: 005E0A69
LoadCursorW.USER32(00000000,00007F82), ref: 005E0A74
LoadCursorW.USER32(00000000,00007F84), ref: 005E0A7F
LoadCursorW.USER32(00000000,00007F04), ref: 005E0A8A
LoadCursorW.USER32(00000000,00007F02), ref: 005E0A95
GetCursorInfo.USER32(?), ref: 005E0AA5
GetLastError.KERNEL32 ref: 005E0AE7

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: b43baa9d71dfcd5cffd043e338ca3c654c3200de57155952fda95d5cefbb6747
Instruction ID: 8f797df02ea11d200cfb54b3d376dab2068cd690d5d08dfa09741f8a542f0936
Opcode Fuzzy Hash: b43baa9d71dfcd5cffd043e338ca3c654c3200de57155952fda95d5cefbb6747
Instruction Fuzzy Hash: 6C4176B0D483596ADB10DFBA8C89C6EBFE8FF04754B50452AE11CE7281DB789941CF91

Function 005D50A6 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 259COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 005D510A
_wcslen.LIBCMT ref: 005D5119
_wcslen.LIBCMT ref: 005D515A
_wcslen.LIBCMT ref: 005D519A
_wcslen.LIBCMT ref: 005D51DA
_wcslen.LIBCMT ref: 005D5217
GetDriveTypeW.KERNEL32(?,00627A20,00000061), ref: 005D52A8

Strings

ramdisk, xrefs: 005D524E
network, xrefs: 005D5212, 005D5223
cdrom, xrefs: 005D5155, 005D5166
removable, xrefs: 005D5195, 005D51A6
unknown, xrefs: 005D5267
all, xrefs: 005D5114, 005D5125
fixed, xrefs: 005D51D5, 005D51E6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 83d8fb80aa79a16745cc340937ee106638a6a1e664cb78c08fb3263af148b392
Instruction ID: 9475eecf2a41b5fb17952ed53772501f106a92ddfe8ea160c4526f7be1f7be2e
Opcode Fuzzy Hash: 83d8fb80aa79a16745cc340937ee106638a6a1e664cb78c08fb3263af148b392
Instruction Fuzzy Hash: 7991D1369086118BC320EF6CC885A6ABFA1BB90304F14496FFC9667351FB71DD49CB92

Function 005F9B58 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

DragQueryPoint.SHELL32(?,?,?,?,?,?), ref: 005F9B81

Part of subcall function 005F803B: ClientToScreen.USER32(?,?,?,?,?,?,?,?,?,005F9573,?,?,?), ref: 005F8061
Part of subcall function 005F803B: GetWindowRect.USER32(?,?), ref: 005F80D7
Part of subcall function 005F803B: PtInRect.USER32(?,?,005F9573,?,?), ref: 005F80E7

SendMessageW.USER32(?,000000B0,?,?,?,?,?), ref: 005F9BEA
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 005F9BF5
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 005F9C18
SendMessageW.USER32(?,000000C2,00000001,?), ref: 005F9C5F
SendMessageW.USER32(?,000000B0,?,?), ref: 005F9C78
SendMessageW.USER32(?,000000B1,?,?), ref: 005F9C8F
SendMessageW.USER32(?,000000B1,?,?), ref: 005F9CB1
DragFinish.SHELL32(?), ref: 005F9CB8
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 005F9DAB

Strings

P3c, xrefs: 005F9CF5
@GUI_DRAGFILE, xrefs: 005F9D5A
@GUI_DROPID, xrefs: 005F9CD8
@GUI_DRAGID, xrefs: 005F9D23

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$P3c
API String ID: 221274066-3598534670
Opcode ID: 0bebb29cf1f6e6d14fdf2e480e071a63db72a6437367330ca72d701c113a5936
Instruction ID: 68adf82943b128fee9d34a238ab205bb4405fff5f57982d4a3140fd42e0fb110
Opcode Fuzzy Hash: 0bebb29cf1f6e6d14fdf2e480e071a63db72a6437367330ca72d701c113a5936
Instruction Fuzzy Hash: EB614671508306AFC700EF54D889EABBFF9FFD8750F004919B695931A1DB749A09CB62

Function 00573998 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145windowtimeregistryCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00573992,?,?), ref: 00573A00
KillTimer.USER32(?,00000001,?,?,?,?,?,00573992,?,?), ref: 00573A2C
SetTimer.USER32(?,00000001,000002EE,00000000,?,?,?,?,?,00573992,?,?), ref: 00573A4F
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00573992,?,?), ref: 00573A5A
CreatePopupMenu.USER32(?,?,?,?,?,00573992,?,?), ref: 00573A6E
PostQuitMessage.USER32(00000000,?,?,?,?,?,00573992,?,?), ref: 00573A8F

Strings

p)c, xrefs: 005B8126
p)c, xrefs: 00573A32
p)c, xrefs: 00573A81
p)c, xrefs: 005B80EB
TaskbarCreated, xrefs: 00573A55
p)c, xrefs: 00573A9B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$p)c$p)c$p)c$p)c$p)c
API String ID: 129472671-2233500458
Opcode ID: ee9b451b987a8efa0ae820882101fc09491009360f3015a1552392d26cf0b804
Instruction ID: 2bb77f0416df3ad563117ef6ed90920794ad04651aad2aa3c8c48ef7b0ad6bed
Opcode Fuzzy Hash: ee9b451b987a8efa0ae820882101fc09491009360f3015a1552392d26cf0b804
Instruction Fuzzy Hash: 0D41F371144106ABDB156F3CFC5EBB93F26F740320F108225F68A962A1DAB99A04F6A1

Function 0058071E Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll), ref: 0058073A
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0058074B
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00580761
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0058076F
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0058077D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 005807D3
___scrt_fastfail.LIBCMT ref: 005807E8
DeleteCriticalSection.KERNEL32(006316CC,00000007), ref: 005807F3
CloseHandle.KERNEL32(00000000), ref: 00580803

Strings

SleepConditionVariableCS, xrefs: 00580767
InitializeConditionVariable, xrefs: 0058075B
WakeAllConditionVariable, xrefs: 00580775
kernel32.dll, xrefs: 00580746
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00580735

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AddressHandleProc$Module$CloseCreateCriticalDeleteEventSection___scrt_fastfail
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2238755874-1714406822
Opcode ID: 53a051d8445cc9a61714b07cd82db0f2f745bed452d7d4baaf231ad297401ad6
Instruction ID: 929f32fc3f03d456ea6bf35d501c43058a5d8a95e4076eb89d30c9a36abb3646
Opcode Fuzzy Hash: 53a051d8445cc9a61714b07cd82db0f2f745bed452d7d4baaf231ad297401ad6
Instruction Fuzzy Hash: 0521D872A417126BE7647BF45C4AF3B2A6ABB55B50F162121FD00FB1D0CA749808DBF0

Function 005EBA10 Relevance: 24.4, APIs: 16, Instructions: 412processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005EBB93
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 005EBBAB
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 005EBBCF
_wcslen.LIBCMT ref: 005EBBFB
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 005EBC0F
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 005EBC31
_wcslen.LIBCMT ref: 005EBD34
_wcslen.LIBCMT ref: 005EBD4D
_wcslen.LIBCMT ref: 005EBD68
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005EBDB6
GetLastError.KERNEL32(00000000), ref: 005EBE07
CloseHandle.KERNEL32(?), ref: 005EBE39
CloseHandle.KERNEL32(00000000), ref: 005EBE4A
CloseHandle.KERNEL32(00000000), ref: 005EBE5C
CloseHandle.KERNEL32(00000000), ref: 005EBE6E
CloseHandle.KERNEL32(?), ref: 005EBEE3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseHandle_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 1716816197-0
Opcode ID: 6a3e7f038b1f866f57585937b4b177efcf90a8e74d202c3a338121f3e7970fc6
Instruction ID: 15d57b0f2abb503c098183f0dd15559ecc4a014cc29c9175f8c565d9cbf7f60f
Opcode Fuzzy Hash: 6a3e7f038b1f866f57585937b4b177efcf90a8e74d202c3a338121f3e7970fc6
Instruction Fuzzy Hash: 6CE18C316043429FDB18EF25C985B6ABFE5BF84310F14895DF8898B2A2DB35EC44CB52

Function 005E4BE7 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 479libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 005E4CB9
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 005E4CCB
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?), ref: 005E4CF0
FreeLibrary.KERNEL32(00000000), ref: 005E4D3C
StringFromGUID2.OLE32(?,?,00000028), ref: 005E4DA6
#6.OLEAUT32(00000009), ref: 005E4E60
#164.OLEAUT32(?,?,?,?,?), ref: 005E4EC6
#6.OLEAUT32(?), ref: 005E4EF0

Strings

GetModuleHandleExW, xrefs: 005E4CC5
kernel32.dll, xrefs: 005E4CB4

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Library$#164AddressFileFreeFromLoadModuleNameProcString
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 1769025185-199464113
Opcode ID: b67fe21aded6550072284b7671da0e8c600c1acc791f6a78831aeb3684c94c0f
Instruction ID: e4fe42693e077c4e87c315114a564c2a363e5dca6737135f2bf45cdbc418fa27
Opcode Fuzzy Hash: b67fe21aded6550072284b7671da0e8c600c1acc791f6a78831aeb3684c94c0f
Instruction Fuzzy Hash: DB123A75A00245AFCB18CF55C888EAEBBB9FF44318F248498F9459B251D731EE46CFA0

Function 005736C0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 215windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 005B7E4B
GetMenuItemCount.USER32(?,?,00000003,00000000,?,00000006,00000000,?,00000004,00000000,?,00000005,00000000), ref: 005B7EFB
GetCursorPos.USER32(?,?,?,00000003,00000000,?,00000006,00000000,?,00000004,00000000,?,00000005,00000000), ref: 005B7F3F
SetForegroundWindow.USER32(00000000,?,?,00000003,00000000,?,00000006,00000000,?,00000004,00000000,?,00000005,00000000), ref: 005B7F48
TrackPopupMenuEx.USER32(?,00000000,?,00000000,00000000,00000000,?,?,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 005B7F5B
PostMessageW.USER32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000003,00000000,?,00000006), ref: 005B7F67

Strings

0, xrefs: 005736CE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: b6f926daea1029e8257e6ede0afed8a37eaa0d9c60c0a0a2156a8e54a50954d5
Instruction ID: d56e0b49b006639e0d710c3f3eb3b467aea1d123a7444aeb6ae38724916eb705
Opcode Fuzzy Hash: b6f926daea1029e8257e6ede0afed8a37eaa0d9c60c0a0a2156a8e54a50954d5
Instruction Fuzzy Hash: B87109B164820ABFEB258F64DC49FEABF69FF49364F104205F518A61D1C771AD10E790

Function 005F7695 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 196windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 005F77A8

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 005F781C
SendMessageW.USER32(00000000,00000433,00000000,00000030,?), ref: 005F783E
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005F7851
DestroyWindow.USER32(00000000), ref: 005F7873
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,?,00000000), ref: 005F78A4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005F78BD
GetDesktopWindow.USER32(?,?), ref: 005F78D6
GetWindowRect.USER32(00000000), ref: 005F78DD
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 005F78F5
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 005F790D

Part of subcall function 00574E23: GetWindowLongW.USER32(?,000000EB,?,00000003,?,005B913F,?), ref: 00574E34

Strings

tooltips_class32, xrefs: 005F7815, 005F789D
0, xrefs: 005F774C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: b9864e9631526d74dd18e20af0d69520244e850beb0096653887e53bed36f326
Instruction ID: 9470141817588225d9278d62eadaa335f769016cfba9715c4a53b1ac5f5716ea
Opcode Fuzzy Hash: b9864e9631526d74dd18e20af0d69520244e850beb0096653887e53bed36f326
Instruction Fuzzy Hash: 2B717970104209AFD725DF18CC48F7A7BEAFB8D304F04495DFA89972A1C7B8AA15DB61

Function 00574854 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0057438C: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00575687,?,?,?,?), ref: 005743EF

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0057490C
KillTimer.USER32(00000000,?,?,?,?,00573F4E,00000000,?,?,00574387,?,?), ref: 005749AB
DestroyAcceleratorTable.USER32(00000000,?,00000000,?,?,?,?,00573F4E,00000000,?,?,00574387,?,?), ref: 005B88E4
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00573F4E,00000000,?,?,00574387,?,?), ref: 005B8917
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00573F4E,00000000,?,?,00574387,?,?), ref: 005B892E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00573F4E,00000000,?,?,00574387,?,?), ref: 005B894A
DeleteObject.GDI32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 005B895C

Strings

(c, xrefs: 005749D0

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: (c
API String ID: 641708696-1842809556
Opcode ID: d18ff73cb3c617454d5e5f9ea52084ac1f92f8176e6724fdba52f6bea0b182af
Instruction ID: 5f76762a041cc690ea38720a24abf501a92f8bce80942d366c17fd1017c38c5e
Opcode Fuzzy Hash: d18ff73cb3c617454d5e5f9ea52084ac1f92f8176e6724fdba52f6bea0b182af
Instruction Fuzzy Hash: 52619E30100716DFDB259F14E958B3A7BF6FB84316F10A419E14A97960CB74B894FF92

Function 005DCF5D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 144networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000,?,?,00000003,?,?,?,?,?), ref: 005DCF97
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 005DCFAA
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 005DCFBE
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000,?,00000003,?,?,?,?,?,?), ref: 005DCFD7
InternetQueryOptionW.WININET(00000000,0000001F,?,?,?,00000003,?,?,?,?,?,?), ref: 005DD01A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004,?,00000003,?,?,?,?,?,?), ref: 005DD030
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000,?,00000003,?,?,?,?,?,?), ref: 005DD03B
HttpQueryInfoW.WININET(00000000,00000005,?,?,?,00000000,?,00000003,?,?,?,?,?,?), ref: 005DD06B
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 005DD0C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 005DD0D7
InternetCloseHandle.WININET(00000000,?,00000003,?,?,?,?,?,?), ref: 005DD0E2

Strings

, xrefs: 005DD05C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 2a163a3bf1a193b1d983dc2cbfd800660b8fe4514f5c3e4dafb006520f416598
Instruction ID: 15547e49ef3545965379a7d61c2c182bc137aaee528943e53da49d34bd0a1c3c
Opcode Fuzzy Hash: 2a163a3bf1a193b1d983dc2cbfd800660b8fe4514f5c3e4dafb006520f416598
Instruction Fuzzy Hash: B8515BB5500609AFDB319F68C888ABABFBDFB58354F00441BF945C6250E734E909EBB1

Function 005F8F46 Relevance: 22.6, APIs: 15, Instructions: 133filememorywindowCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,005F669F,?,?), ref: 005F8F69
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8F80
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8F8B
CloseHandle.KERNEL32(00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8F98
GlobalLock.KERNEL32(00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8FA1
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8FB0
GlobalUnlock.KERNEL32(00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8FB9
CloseHandle.KERNEL32(00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8FC0
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8FD1
#418.OLEAUT32(?,00000000,00000000,00600BEC,?,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8FEA
GlobalFree.KERNEL32(00000000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F8FFA
GetObjectW.GDI32(00000000,00000018,?,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F901E
CopyImage.USER32(00000000,00000000,00000000,?,00002000,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F904E
DeleteObject.GDI32(00000000,00000000,?,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F9076
SendMessageW.USER32(?,00000172,00000000,00000000,00000000,?,?,?,?,?,005F669F,?,?,00000000,?), ref: 005F908C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$#418AllocCopyDeleteFreeImageLockMessageReadSendSizeStreamUnlock
String ID:
API String ID: 2779716855-0
Opcode ID: 7ded3db704a668e66b0abb240fe29c61dcf06201f4e07c5a36581f0c5f99fd8f
Instruction ID: d93df6b9b9be1ff84f9e0727da50b78a5295e571a18583318d9c57075a97a724
Opcode Fuzzy Hash: 7ded3db704a668e66b0abb240fe29c61dcf06201f4e07c5a36581f0c5f99fd8f
Instruction Fuzzy Hash: D3414775600208AFDB109F65DC48EBEBBBEFB99711F108058FA05D7260DB39AD05EB60

Function 005D2218 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 362COMMON

Download Yara Rule

APIs

#8.OLEAUT32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 005D225D
#10.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005D2266
#9.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 005D2272
#185.OLEAUT32(?,?,?,?), ref: 005D2358
#220.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005D23B4
#8.OLEAUT32(?,?,?,00000000), ref: 005D2465
#6.OLEAUT32(?,?), ref: 005D24E9
#9.WSOCK32(?,?), ref: 005D2535
#9.WSOCK32(?), ref: 005D2544
#8.OLEAUT32(00000000,00000001,?,?,00000000), ref: 005D2582

Strings

Default, xrefs: 005D240C
%4d%02d%02d%02d%02d%02d, xrefs: 005D2382

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: #185#220
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3286692863-3931177956
Opcode ID: f0c2cd4a21d65a9d78bc69c19983d89742da8ceabed9ed597daf27792fdd7161
Instruction ID: ced208bea20661c671f109ccbbac54a77becbdf5fe3ead1dd873f59054b4591d
Opcode Fuzzy Hash: f0c2cd4a21d65a9d78bc69c19983d89742da8ceabed9ed597daf27792fdd7161
Instruction Fuzzy Hash: 28D1D071600616DBDB209FA9D849B7ABFB4FF58700F108857F845AB290DB74EC44DBA1

Function 005E3105 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 170windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000,00000000,00000001,?), ref: 005E3181
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 005E3191
CreateCompatibleDC.GDI32(?), ref: 005E319D
SelectObject.GDI32(00000000,?), ref: 005E31AA
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 005E3216
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 005E3255
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 005E3279
SelectObject.GDI32(?,?), ref: 005E3281
DeleteObject.GDI32(?), ref: 005E328A
DeleteDC.GDI32(?), ref: 005E3291
ReleaseDC.USER32(00000000,?), ref: 005E329C

Strings

(, xrefs: 005E3236

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: f9248bdc7797f9aa3cc9230588ac42a5c09cee7ad3ca487f4fc8a03b95cd08d4
Instruction ID: 9eb67aebee1e052732c23ee13cf82d850a8885b6f629fcf38eef1c394b1d4f34
Opcode Fuzzy Hash: f9248bdc7797f9aa3cc9230588ac42a5c09cee7ad3ca487f4fc8a03b95cd08d4
Instruction Fuzzy Hash: 8F61E375D00219AFCF08CFA4DC88EAEBBB6FF48310F208519E955A7250D775AA41DF60

Function 0059D88D Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0059D8D1

Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D489
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D49B
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D4AD
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D4BF
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D4D1
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D4E3
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D4F5
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D507
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D519
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D52B
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D53D
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D54F
Part of subcall function 0059D46C: _free.LIBCMT ref: 0059D561

_free.LIBCMT ref: 0059D8C6

Part of subcall function 005927F4: HeapFree.KERNEL32(00000000,00000000,?,0056FC79,?,?,0056111E), ref: 0059280A

_free.LIBCMT ref: 0059D8E8
_free.LIBCMT ref: 0059D8FD
_free.LIBCMT ref: 0059D908
_free.LIBCMT ref: 0059D92A
_free.LIBCMT ref: 0059D93D
_free.LIBCMT ref: 0059D94B
_free.LIBCMT ref: 0059D956
_free.LIBCMT ref: 0059D98E
_free.LIBCMT ref: 0059D995
_free.LIBCMT ref: 0059D9B2
_free.LIBCMT ref: 0059D9CA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$FreeHeap___free_lconv_mon
String ID:
API String ID: 358854727-0
Opcode ID: 75218fba45e32a75840a4a54f026b2dae7592256cd5fc401c4d3e169682136ea
Instruction ID: 5f25813c8bdac205ba51e6a622221a5babdfe9f58d70e3df468e6e220da1a6fa
Opcode Fuzzy Hash: 75218fba45e32a75840a4a54f026b2dae7592256cd5fc401c4d3e169682136ea
Instruction Fuzzy Hash: 80316732608306AFEF24AB79D849B9ABBF9FF40310F144429E559E7191DF31AC85DB20

Function 005C4700 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 274windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 005C473E
_wcslen.LIBCMT ref: 005C4749
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?,00000202,?), ref: 005C4848
GetClassNameW.USER32(?,?,00000400), ref: 005C48B9
GetDlgCtrlID.USER32(?), ref: 005C491D
GetWindowRect.USER32(?,?), ref: 005C4942
GetParent.USER32(?,?), ref: 005C4960
ScreenToClient.USER32(00000000), ref: 005C4967
GetClassNameW.USER32(?,?,00000100), ref: 005C49E1
GetWindowTextW.USER32(?,?,00000400), ref: 005C4A1D

Strings

%s%u, xrefs: 005C47D9

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: fd4550b94cf30c24bfbf831bf08fdfc491395569e5bbbe30c84e2236c313278a
Instruction ID: 2b2d64006a6d23012aed7331b9450e62f3acf7309d0dc29d93a7ae4d6b8c9f2d
Opcode Fuzzy Hash: fd4550b94cf30c24bfbf831bf08fdfc491395569e5bbbe30c84e2236c313278a
Instruction Fuzzy Hash: B8A18B711047069FD724DEA4C8A8FABBBEAFF94344F10492DF99AC2191EB30A945CF51

Function 005C58EC Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 005C5928
GetWindowTextW.USER32(?,?,00000400), ref: 005C596A
_wcslen.LIBCMT ref: 005C597B
CharUpperBuffW.USER32(?,00000000), ref: 005C5987
_wcsstr.LIBVCRUNTIME ref: 005C59BC
GetClassNameW.USER32(00000018,?,00000400), ref: 005C59F4
GetWindowTextW.USER32(?,?,00000400), ref: 005C5A2D
GetClassNameW.USER32(00000018,?,00000400,?), ref: 005C5A87
GetClassNameW.USER32(?,?,00000400), ref: 005C5AB9
GetWindowRect.USER32(?,?), ref: 005C5B31

Strings

ThumbnailClass, xrefs: 005C59FF, 005C5A92

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 926c2c1e23c43407becd11aefad17429ab6394288fc7ae8e132be35bdd0ae86d
Instruction ID: d733e372c802ce0f4447dc6a83c9236d69907f42ce40da92e71f9a37c0cd6989
Opcode Fuzzy Hash: 926c2c1e23c43407becd11aefad17429ab6394288fc7ae8e132be35bdd0ae86d
Instruction Fuzzy Hash: 15918D31104A07AFDB04DFA4C885FAABBA9FF44314F00452DFA9682191EB31FD95CB91

Function 005F9709 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

PostMessageW.USER32(?,00000111,00000000,00000000,00000000,?), ref: 005F9759
GetFocus.USER32(?,?,?,?), ref: 005F9769
GetDlgCtrlID.USER32(00000000), ref: 005F9774
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 005F98CA
GetMenuItemCount.USER32(?), ref: 005F98EA
GetMenuItemID.USER32(?,00000000), ref: 005F98FD
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 005F9933
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 005F997D
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005F99B5
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 005F99EA

Strings

0, xrefs: 005F9897

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 4f27c26a5db41f82f831bb878e970fad7e9c0397b637d002d3db9e72ec660a17
Instruction ID: 5239d8d10ae2fcab790ebb803f3b595f0597e6abe75c3793d4a3efff1b438c55
Opcode Fuzzy Hash: 4f27c26a5db41f82f831bb878e970fad7e9c0397b637d002d3db9e72ec660a17
Instruction Fuzzy Hash: E181AC7010870AAFDB10DF14C988A7BBFE9FB88314F00492DFA9897291D774D905DBA2

Function 00570E5B Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00561155: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF), ref: 00561173

Part of subcall function 0057FD48: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00570F35), ref: 0057FD6A

RegOpenKeyExW.ADVAPI32(?,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00570F78
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 005B6FEF
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 005B7030
RegCloseKey.ADVAPI32(?), ref: 005B7072
_wcslen.LIBCMT ref: 005B70D9
_wcslen.LIBCMT ref: 005B70E8

Strings

\, xrefs: 005B70EE
\Include\, xrefs: 00570F35
p3c, xrefs: 00570F9A
Software\AutoIt v3\AutoIt, xrefs: 00570F6E
Include, xrefs: 005B6FE6, 005B7027

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\$p3c
API String ID: 98802146-2083761968
Opcode ID: 61318170800e9f41fcd91de62fa346936cf67caf640663899d2ffe94d7e4f46f
Instruction ID: 928067b0bc47c586293e2bb7482620962edc5ad551157bc60dee1c6a6a5199d8
Opcode Fuzzy Hash: 61318170800e9f41fcd91de62fa346936cf67caf640663899d2ffe94d7e4f46f
Instruction Fuzzy Hash: AD71BF715083569ED704EF25E8498ABBFE9FF88740F40542EF545C72A0EF309A48CBA1

Function 005CCDE4 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 191windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00632970,000000FF,00000000,00000030,?,000000FF,?,?), ref: 005CCE60
SetMenuItemInfoW.USER32(00632970,00000004,00000000,00000030), ref: 005CCE95
Sleep.KERNEL32(000001F4), ref: 005CCEA7
GetMenuItemCount.USER32(?,?,000000FF,?,?), ref: 005CCEED
GetMenuItemID.USER32(?,00000000), ref: 005CCF0A
GetMenuItemID.USER32(?,-00000001), ref: 005CCF36
GetMenuItemID.USER32(?,?), ref: 005CCF7D
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005CCFC3
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030,?,000000FF,?,?), ref: 005CCFD8
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005CCFF9

Strings

0, xrefs: 005CCDF1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 4e26ed9903bf1696a08b47860eeae41099f4114a6d862565753d47d72e17ccb1
Instruction ID: 3f0dee94dd00fade9de49184d66bdd6ae3e11c101c47eeb360cd619230b38a3b
Opcode Fuzzy Hash: 4e26ed9903bf1696a08b47860eeae41099f4114a6d862565753d47d72e17ccb1
Instruction Fuzzy Hash: 696157B090024AAFDB11DFA8C988FBEBFBAFB45304F04445DE809A3291D735AD15DB60

Function 005CE9FA Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 005CEA0C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 005CEA32
_wcslen.LIBCMT ref: 005CEA3C
_wcsstr.LIBVCRUNTIME ref: 005CEA8C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 005CEAA8

Strings

\VarFileInfo\Translation, xrefs: 005CEAA0
%u.%u.%u.%u, xrefs: 005CEB86
04090000, xrefs: 005CEADE
DefaultLangCodepage, xrefs: 005CEB0B
StringFileInfo\, xrefs: 005CEA7B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: a436812fa1bd962298a037815a4288111161b2f34b45ea5b18d7a566080411a7
Instruction ID: 48801bb09e5abfd76fa66e7a2e39d1bcacae9fdb3910932f103f92818e9ab690
Opcode Fuzzy Hash: a436812fa1bd962298a037815a4288111161b2f34b45ea5b18d7a566080411a7
Instruction Fuzzy Hash: 96410372644216BEEB10BBA49C4BEBF7FADFF81710F000459FD05B6182EB74990197A5

Function 005ED5F3 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 105registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 005ED623
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 005ED64C
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 005ED709

Part of subcall function 005ED5F3: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 005ED669
Part of subcall function 005ED5F3: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 005ED67C
Part of subcall function 005ED5F3: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW,?,?,00000000), ref: 005ED68E
Part of subcall function 005ED5F3: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 005ED6C4
Part of subcall function 005ED5F3: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 005ED6E7

RegDeleteKeyW.ADVAPI32(?,?,?,?,00000000), ref: 005ED6B2

Strings

advapi32.dll, xrefs: 005ED677
RegDeleteKeyExW, xrefs: 005ED688

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 1871ad6bf1d0e36f286f6628fbc96d92080dda6999b8dd7276fbd2b15a384855
Instruction ID: bb0f46e5e4a09ab5239a3d5223b6e60b4e0f8c7ce8a552cd8ed7c1ccbef02e7f
Opcode Fuzzy Hash: 1871ad6bf1d0e36f286f6628fbc96d92080dda6999b8dd7276fbd2b15a384855
Instruction Fuzzy Hash: E0317A71901129BBDB249B92DC88EFFBB7DFF55750F000165E845E3244DA389E49EAB0

Function 005D492E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 005D494E
_wcslen.LIBCMT ref: 005D497C
CreateDirectoryW.KERNEL32(?,00000000), ref: 005D49AD
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 005D49D2
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 005D4A5C
CloseHandle.KERNEL32(00000000), ref: 005D4A67
RemoveDirectoryW.KERNEL32(?), ref: 005D4A70
CloseHandle.KERNEL32(00000000), ref: 005D4A7A

Strings

\, xrefs: 005D4986
:, xrefs: 005D4991
\??\%s, xrefs: 005D496A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: bce903e508179198847f28994f9f2c93788d7f7a7a89595682a25bdde2516945
Instruction ID: e2250aa3af3bc4ed01ce619e6623caa33d636fd565374f79763fb3b7eecb2d8a
Opcode Fuzzy Hash: bce903e508179198847f28994f9f2c93788d7f7a7a89595682a25bdde2516945
Instruction Fuzzy Hash: CA318E7594010A6BDB21DFA4DC49FAB3BBEFF88710F1041A6FA08D21A0EB749644CF64

Function 005CF51C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 005CF521

Part of subcall function 0057FB90: timeGetTime.WINMM(?,000CB88A,0056ABA9), ref: 0057FB94

Sleep.KERNEL32(0000000A), ref: 005CF54D
EnumThreadWindows.USER32(?,Function_0006F4CF,00000000), ref: 005CF571
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 005CF593
SetActiveWindow.USER32 ref: 005CF5B2
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 005CF5C0
SendMessageW.USER32(00000010,00000000,00000000), ref: 005CF5DF
Sleep.KERNEL32(000000FA), ref: 005CF5EA
IsWindow.USER32 ref: 005CF5F6
EndDialog.USER32(00000000), ref: 005CF607

Strings

BUTTON, xrefs: 005CF585

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 78251ba2698baa58fc46aeb751e34a0a1cb6d3fc734943a8913c22b20df0bc89
Instruction ID: c89fa2f15317ffc11ef47873449e28da82b4cce4cf381e530bada9c616003c34
Opcode Fuzzy Hash: 78251ba2698baa58fc46aeb751e34a0a1cb6d3fc734943a8913c22b20df0bc89
Instruction Fuzzy Hash: 242129B1200305AFE701ABA1EC88F7A3F6BFB54794B146129F505C2271DB6A8D44EBA5

Function 005CF878 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000, alias PlayMe,00000022,?,00000022,open ), ref: 005CF8D9
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000,?,00000022,open ), ref: 005CF8EF
mciSendStringW.WINMM(?,00000000,00000000,00000000,?,00000022,open ), ref: 005CF900
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000,?,00000022,open ), ref: 005CF912
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000,?,00000022,open ), ref: 005CF923

Strings

play PlayMe wait, xrefs: 005CF90D
open , xrefs: 005CF888
close PlayMe, xrefs: 005CF8EA, 005CF917
alias PlayMe, xrefs: 005CF8B2
status PlayMe mode, xrefs: 005CF8D4
play PlayMe, xrefs: 005CF91E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: ff8044601ac55361565fefa7e5cffb69dc1b981553e9798417172e90c36cc9d5
Instruction ID: 6472c7acd77c2c0995346480f23f0fe6a82680b0a9d9e8f04a76120104dc290e
Opcode Fuzzy Hash: ff8044601ac55361565fefa7e5cffb69dc1b981553e9798417172e90c36cc9d5
Instruction Fuzzy Hash: DD11547195516A7DDB20A6A5BC5AEFF6E7DFBD1B00F010439B801930D1EA601D45CAB0

Function 0057507A Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F,00000000), ref: 005750AD
RegisterClassExW.USER32(00000030), ref: 005750D7
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005750E8
InitCommonControlsEx.COMCTL32(?), ref: 00575105
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00575115
LoadIconW.USER32(000000A9), ref: 0057512B
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0057513A

Strings

+, xrefs: 00575096
AutoIt v3 GUI, xrefs: 005750C9
0, xrefs: 0057508F
TaskbarCreated, xrefs: 005750DD

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 3743887d4f1ac989ec0c37c9e697fdec2f607e57b9a8f0f67c30d9a90b71f49b
Instruction ID: 197191f72283615033cbb7f2fb97f782513ee8eba8a3c95e98457dd69fd71c95
Opcode Fuzzy Hash: 3743887d4f1ac989ec0c37c9e697fdec2f607e57b9a8f0f67c30d9a90b71f49b
Instruction Fuzzy Hash: 3C21E5B1901319AFDB00DFA4EC89BEDBBB6FB08710F00511AF615E62A0D7B94548DFA4

Function 005CADC0 Relevance: 18.2, APIs: 12, Instructions: 196keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 005CAE4C
SetKeyboardState.USER32(?), ref: 005CAEB7
GetAsyncKeyState.USER32(000000A0), ref: 005CAED6
GetKeyState.USER32(000000A0), ref: 005CAEED
GetAsyncKeyState.USER32(000000A1), ref: 005CAF1C
GetKeyState.USER32(000000A1), ref: 005CAF2D
GetAsyncKeyState.USER32(00000011), ref: 005CAF59
GetKeyState.USER32(00000011), ref: 005CAF67
GetAsyncKeyState.USER32(00000012), ref: 005CAF90
GetKeyState.USER32(00000012), ref: 005CAF9E
GetAsyncKeyState.USER32(0000005B), ref: 005CAFC7
GetKeyState.USER32(0000005B), ref: 005CAFD5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ae142f3c7a044e8e0718ba00cfec64168ff1104e720491de5801e60203917fd2
Instruction ID: f738aa83227017a014e4897f2c728e9cc1bd0dc6a767ca73e8c1973e531176cb
Opcode Fuzzy Hash: ae142f3c7a044e8e0718ba00cfec64168ff1104e720491de5801e60203917fd2
Instruction Fuzzy Hash: 1461F9649087CD1EEB35D7F08855FEAAFB4AF02348F08459DC5C24B1C2DA649A4CC7A3

Function 005C6CAD Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 005C6CC9
GetWindowRect.USER32(00000000,?), ref: 005C6CE2
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 005C6D40
GetDlgItem.USER32(?,00000002), ref: 005C6D50
GetWindowRect.USER32(00000000,?), ref: 005C6D62
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 005C6DB6
GetDlgItem.USER32(?,000003E9), ref: 005C6DC4
GetWindowRect.USER32(00000000,?), ref: 005C6DD6
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 005C6E18
GetDlgItem.USER32(?,000003EA), ref: 005C6E2B
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 005C6E41
InvalidateRect.USER32(?,00000000,00000001), ref: 005C6E4E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 471d8f91f83b81cf2341e5e9b328cb8586c33845c929b55dae62a983617836f6
Instruction ID: 050a7a31c2f70cec02f9d4cebea44726c6abcd92944260a39c8a3708bfaa1cf3
Opcode Fuzzy Hash: 471d8f91f83b81cf2341e5e9b328cb8586c33845c929b55dae62a983617836f6
Instruction Fuzzy Hash: 9F51F2B5B00205AFDB14CFA9DD85BAEBBB6FB58310F108129F515E7290D7749E04CB60

Function 005749E2 Relevance: 18.1, APIs: 12, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 00574E23: GetWindowLongW.USER32(?,000000EB,?,00000003,?,005B913F,?), ref: 00574E34

GetSysColor.USER32(0000000F,?,?,?,?), ref: 00574A11

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 1f0bb564d50b2ffff26d7fe6aafd3637dd8194c74bd2a7a46de77f5dd9b579b1
Instruction ID: 24ea764ebe95a8ee6d38458b7fef25efe415079618dfc57e94e7fba2aa3ccb91
Opcode Fuzzy Hash: 1f0bb564d50b2ffff26d7fe6aafd3637dd8194c74bd2a7a46de77f5dd9b579b1
Instruction Fuzzy Hash: 8041A131544604AFCB219F38AC44BBA3BABBB56331F148615F9AA872E1C7309C45FB65

Function 005A0585 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

Part of subcall function 005A02C4: CreateFileW.KERNEL32(00000000,00000000,?,005A062E,?,?,00000000,?,005A062E,00000000,0000000C), ref: 005A02E1

GetLastError.KERNEL32 ref: 005A0699
__dosmaperr.LIBCMT ref: 005A06A0
GetFileType.KERNEL32(00000000), ref: 005A06AC
GetLastError.KERNEL32 ref: 005A06B6
__dosmaperr.LIBCMT ref: 005A06BF
CloseHandle.KERNEL32(00000000), ref: 005A06DF
CloseHandle.KERNEL32(?), ref: 005A0829
GetLastError.KERNEL32 ref: 005A085B
__dosmaperr.LIBCMT ref: 005A0862

Strings

H, xrefs: 005A07E7

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3ce6c813cedcfb1ee99ec5c3e8745ff6bb2e3290ca272cbffac2a77073288670
Instruction ID: 602c2f56e931539f69c1e9c73b82f5e40d3ee56fade085921bf249203540e644
Opcode Fuzzy Hash: 3ce6c813cedcfb1ee99ec5c3e8745ff6bb2e3290ca272cbffac2a77073288670
Instruction Fuzzy Hash: 16A11032A201159FDF19EF68D895BAE7FA1BB4B320F141159F801EF2D1DB359812CBA1

Function 005C58EA Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 005C5928
GetWindowTextW.USER32(?,?,00000400), ref: 005C596A
_wcslen.LIBCMT ref: 005C597B
CharUpperBuffW.USER32(?,00000000), ref: 005C5987
_wcsstr.LIBVCRUNTIME ref: 005C59BC
GetClassNameW.USER32(00000018,?,00000400), ref: 005C59F4
GetWindowTextW.USER32(?,?,00000400), ref: 005C5A2D
GetClassNameW.USER32(00000018,?,00000400,?), ref: 005C5A87
GetClassNameW.USER32(?,?,00000400), ref: 005C5AB9
GetWindowRect.USER32(?,?), ref: 005C5B31

Strings

ThumbnailClass, xrefs: 005C59FF, 005C5A92

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 116c5acee48ff1a65b8bc3bffd4a28e6e541a181d01b05fe7471be0ae8e0df8a
Instruction ID: 3e707fce43dd90d32b8a535c8eaeef07c17d86402beeb451cc0ba53af86f4548
Opcode Fuzzy Hash: 116c5acee48ff1a65b8bc3bffd4a28e6e541a181d01b05fe7471be0ae8e0df8a
Instruction Fuzzy Hash: 5A819F71104A06AFDB08DFA4C895FAABFA9FF44314F00461DFA9682191EB31FD95CB91

Function 005F94ED Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

Part of subcall function 00574B74: GetCursorPos.USER32(?,?,00000000,00000000,?,005753FE,00000000,000000FF,?,?,?), ref: 00574B88
Part of subcall function 00574B74: ScreenToClient.USER32(00000000,?,?,005753FE,00000000,000000FF,?,?,?), ref: 00574BA5
Part of subcall function 00574B74: GetAsyncKeyState.USER32(?,?,005753FE), ref: 00574BCE
Part of subcall function 00574B74: GetAsyncKeyState.USER32(?,?,005753FE), ref: 00574BE8

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 005F9555
ImageList_EndDrag.COMCTL32 ref: 005F955B
ReleaseCapture.USER32 ref: 005F9561
SetWindowTextW.USER32(?,00000000,?,?,00000000,?,00000000), ref: 005F9609
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 005F961C
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 005F96FB

Strings

@GUI_DRAGFILE, xrefs: 005F9693
@GUI_DROPID, xrefs: 005F9650
P3c, xrefs: 005F96A7
P3c, xrefs: 005F966C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$P3c$P3c
API String ID: 1924731296-520049009
Opcode ID: 0c3a183f19789e4a02cb838162f12130a6ad982164a6f00b52a5c89872496292
Instruction ID: 24ace99743c023be737923f5267b7fd9e1838fbb48f9185a58675792f0b9268b
Opcode Fuzzy Hash: 0c3a183f19789e4a02cb838162f12130a6ad982164a6f00b52a5c89872496292
Instruction Fuzzy Hash: 14519C7020430AAFD704EF24D8AAF7A7BE6FB88714F00491DF655972E1DB74A908CB52

Function 005CA4B0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,?,00000000,?,?,005B6680,?,0000138C,?,?,?,?,005DEFB0,?), ref: 005CA4E5
LoadStringW.USER32(00000000,?,005B6680,?,0000138C,?,?,?,?,005DEFB0,?,?,00000000,005DEFB0,00000000,00000000), ref: 005CA4EE

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,005B6680,?,0000138C,?,?,?,?,005DEFB0,?,?), ref: 005CA510
LoadStringW.USER32(00000000,?,005B6680,?,0000138C,?,?,?,?,005DEFB0,?,?,00000000,005DEFB0,00000000,00000000), ref: 005CA513
MessageBoxW.USER32(00000000,?,?,00011010,?,Error: ,00600B18,?), ref: 005CA634

Strings

%s (%d) : ==> %s: %s %s, xrefs: 005CA618
Line %d (File "%s"):, xrefs: 005CA55D
Error: , xrefs: 005CA5EB
Line %d:, xrefs: 005CA56E
^ ERROR, xrefs: 005CA5C9

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 041f70392787491efca043611d6f357b46c84bf61806f89cb8010f36be005f96
Instruction ID: 68cd8cc4a64ab08d6c59c035854e32c41f332a137f66f6cb92a805cb14a5ead5
Opcode Fuzzy Hash: 041f70392787491efca043611d6f357b46c84bf61806f89cb8010f36be005f96
Instruction Fuzzy Hash: 4E412E72C0411EAACF04EBE0ED9AEEE7B79BF98300F500565F505B3192DA246F49CB61

Function 005C1785 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

WNetAddConnection2W.MPR(?,?,?,00000000,\IPC$,?), ref: 005C1849
RegConnectRegistryW.ADVAPI32(?,?,?,\CLSID,?,SOFTWARE\Classes\), ref: 005C1865
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005C1881
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 005C18AB
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 005C18D3
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005C18DE
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005C18E3

Strings

\IPC$, xrefs: 005C182B
\CLSID, xrefs: 005C17CB
SOFTWARE\Classes\, xrefs: 005C17B5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 35d7322d0b164a0491e182eeef9a3a2dc3fc57904f0ab52a8a28bc1c0b7d3eff
Instruction ID: 726727422b1a62a90f91a42c5900ec4eb995aa9b09553667e3a07331f99d2b59
Opcode Fuzzy Hash: 35d7322d0b164a0491e182eeef9a3a2dc3fc57904f0ab52a8a28bc1c0b7d3eff
Instruction Fuzzy Hash: 2D410872C1062DABDF11EBA4EC99DEDBB79FF58750F004139E801A3161EA349E44CBA0

Function 005F4951 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 005F49F4
CreateCompatibleDC.GDI32(00000000,?,00000000,?), ref: 005F49FB
SendMessageW.USER32(?,00000173,00000000,00000000,?,00000000,?), ref: 005F4A0E
SelectObject.GDI32(00000000,00000000,?,00000000,?), ref: 005F4A16
GetPixel.GDI32(00000000,00000000,00000000,?,00000000,?), ref: 005F4A21
DeleteDC.GDI32(00000000,?,00000000,?), ref: 005F4A2B
GetWindowLongW.USER32(?,000000EC,?,00000000,?), ref: 005F4A35
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 005F4A4B
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 005F4A57

Strings

static, xrefs: 005F498C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 6fbd7f2adaba16692b22e3231907964f2eb905c86392b8c2fcff3fedbace42b7
Instruction ID: c1b550d68c3372a785d70e718f73042c9715f98ce1d89002e9abd11632c96dca
Opcode Fuzzy Hash: 6fbd7f2adaba16692b22e3231907964f2eb905c86392b8c2fcff3fedbace42b7
Instruction Fuzzy Hash: 21313931100219ABDB119F64DC08FEB3FAAFF19324F110211FA68E61A0C779D814EBA4

Function 00572C51 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 64windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00572C5C
LoadCursorW.USER32(00000000,00007F00), ref: 00572C6B
LoadIconW.USER32(00000063), ref: 00572C81
LoadIconW.USER32(000000A4), ref: 00572C93
LoadIconW.USER32(000000A2), ref: 00572CA5
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00572CBD
RegisterClassExW.USER32(?), ref: 00572D0E

Part of subcall function 0057507A: GetSysColorBrush.USER32(0000000F,00000000), ref: 005750AD
Part of subcall function 0057507A: RegisterClassExW.USER32(00000030), ref: 005750D7
Part of subcall function 0057507A: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005750E8
Part of subcall function 0057507A: InitCommonControlsEx.COMCTL32(?), ref: 00575105
Part of subcall function 0057507A: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00575115
Part of subcall function 0057507A: LoadIconW.USER32(000000A9), ref: 0057512B
Part of subcall function 0057507A: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 0057513A

Strings

0, xrefs: 00572CDD
AutoIt v3, xrefs: 00572CFD
#, xrefs: 00572CE4

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: d29c661cd7ae229c4b66753622de8d96a6ee46b742769b17ee816cfb8e6ae0d9
Instruction ID: 4ab01c6cc842d49e3d562b1efa97c5a12d7f5d3b423d4aa37965b9015c4664a9
Opcode Fuzzy Hash: d29c661cd7ae229c4b66753622de8d96a6ee46b742769b17ee816cfb8e6ae0d9
Instruction Fuzzy Hash: 4721FF70D41319AFEB10AFA5EC59B9ABFB6FB48710F00502AF604A62A0D7B91550DFD4

Function 005C291D Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,005C2557,?,?,00000000), ref: 005C2926
HeapAlloc.KERNEL32(00000000,?,005C2557,?,?,00000000), ref: 005C292D
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,005C2557,?,?,00000000), ref: 005C2942
GetCurrentProcess.KERNEL32(?,00000000,?,005C2557,?,?,00000000), ref: 005C294A
DuplicateHandle.KERNEL32(00000000,?,005C2557,?,?,00000000), ref: 005C294D
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,005C2557,?,?,00000000), ref: 005C295D
GetCurrentProcess.KERNEL32(W%\,00000000,?,005C2557,?,?,00000000), ref: 005C2965
DuplicateHandle.KERNEL32(00000000,?,005C2557,?,?,00000000), ref: 005C2968
CreateThread.KERNEL32(00000000,00000000,005C298E,00000000,00000000,00000000,?,005C2557,?,?,00000000), ref: 005C2982

Strings

W%\, xrefs: 005C2960, 005C2963

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID: W%\
API String ID: 1957940570-479996959
Opcode ID: cf515cad1e20b15f7c0acb2e73dfca1c2c013639f49a7cd9a594a7294f6d6576
Instruction ID: 8177f2d3b3bbcc70a6b0e0adddd7ceb9c37e91db3137a5190092ee007d8566c7
Opcode Fuzzy Hash: cf515cad1e20b15f7c0acb2e73dfca1c2c013639f49a7cd9a594a7294f6d6576
Instruction Fuzzy Hash: 9601B6B5240308BFE710ABA5DC4DF6B7BADEB98711F008411FA05DB2A1CA759814DB31

Function 005E47A1 Relevance: 16.8, APIs: 11, Instructions: 345fileCOMMON

Download Yara Rule

APIs

#8.OLEAUT32(?), ref: 005E47E6
CoInitialize.OLE32(00000000), ref: 005E4823
CoUninitialize.OLE32 ref: 005E482E
_wcslen.LIBCMT ref: 005E48CE
GetRunningObjectTable.OLE32(00000000,?), ref: 005E4945
SetErrorMode.KERNEL32(00000001), ref: 005E4A97
CoGetInstanceFromFile.OLE32(00000000,00600B4C,00000000,00000015,?,?,00000002,?,00000001,00600B4C), ref: 005E4AD6
CoGetObject.OLE32(?,00000000,00600B4C,?,?,?,00000002,?,00000001,00600B4C), ref: 005E4AFB
SetErrorMode.KERNEL32(00000000,?,?,00000002,?,00000001,00600B4C), ref: 005E4B12
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,00000002,?,00000001,00600B4C), ref: 005E4BC6
#9.WSOCK32(?,?,?,00000002,?,00000001,00600B4C), ref: 005E4BD6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorMode$Object$FileFromInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 2489810571-0
Opcode ID: 414321b23346f6dcf8e19b1a76b3ffae9cec9817fec1cb6e3bccbe3635b51dfd
Instruction ID: 124633ac36cacbeef03a2b9f975fc582f75ca8b42be6215815b4a8cc0043584c
Opcode Fuzzy Hash: 414321b23346f6dcf8e19b1a76b3ffae9cec9817fec1cb6e3bccbe3635b51dfd
Instruction Fuzzy Hash: E9D174716043419FD314DF69C884B2ABBE9BB89714F10495CF989EB291DBB1EC05CF52

Function 005D854F Relevance: 16.8, APIs: 11, Instructions: 299comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 005D85AC
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 005D8648
SHGetDesktopFolder.SHELL32(?), ref: 005D865C
CoCreateInstance.OLE32(00600CBC,00000000,00000001,00627C9C,?), ref: 005D86A8
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 005D872D
CoTaskMemFree.OLE32(?), ref: 005D8785
SHBrowseForFolderW.SHELL32(?), ref: 005D8810
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 005D8833
CoTaskMemFree.OLE32(00000000), ref: 005D883A
CoTaskMemFree.OLE32(00000000), ref: 005D888F
CoUninitialize.OLE32 ref: 005D8895

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: c6b2fdda6acf6e564f3fb03c4669f1e438da86a7ebcd50ad381fbc475494dca5
Instruction ID: 18366d022b4e8317528cb5607fdbded50f6768fda88051c0821a592d5b0cee5c
Opcode Fuzzy Hash: c6b2fdda6acf6e564f3fb03c4669f1e438da86a7ebcd50ad381fbc475494dca5
Instruction Fuzzy Hash: 64C11B75A00109EFCB14DFA8C888DAEBBB5FF48314B148599E519DB362DB31EE45CB90

Function 005C0B44 Relevance: 16.6, APIs: 11, Instructions: 127COMMON

Download Yara Rule

APIs

#41.OLEAUT32(0000000C,?,?,?,?,005C0B20), ref: 005C0B6B
#37.OLEAUT32(?,?,?,005C0B20), ref: 005C0BCD
#8.OLEAUT32(?,?,?,005C0B20), ref: 005C0BDF
#23.WSOCK32(?,?,?,?,005C0B20), ref: 005C0BFF
#10.WSOCK32(?,?,00000002,?,?,?,005C0B20), ref: 005C0C52
#24.OLEAUT32(?,00000002,?,?,?,005C0B20), ref: 005C0C66
#9.WSOCK32(?,?,?,005C0B20), ref: 005C0C7B
#39.OLEAUT32(?,?,?,005C0B20), ref: 005C0C88
#38.OLEAUT32(?,?,?,005C0B20), ref: 005C0C91
#9.WSOCK32(?,?,?,005C0B20), ref: 005C0CA3
#38.OLEAUT32(?,?,?,005C0B20), ref: 005C0CAE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88eb6b868c0d33c0e7820d018df6481507996a4181e273144572ec2996f03c9e
Instruction ID: e0d5b4e3aba6ccb34f2c37800b157f429e88f1decce9d7c7b1a51cc08a8aa73b
Opcode Fuzzy Hash: 88eb6b868c0d33c0e7820d018df6481507996a4181e273144572ec2996f03c9e
Instruction Fuzzy Hash: DF412875E00219DFCF10DF94C848AAEBFB9FF58314F008469E955A72A1C774AE49DBA0

Function 005D88AB Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 235COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005D8A68
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8A7C
GetFileAttributesW.KERNEL32(?), ref: 005D8A9B
GetFileAttributesW.KERNEL32(?), ref: 005D8AB3
SetFileAttributesW.KERNEL32(?,00000000), ref: 005D8AC9
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8ADB
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005D8B27
SetCurrentDirectoryW.KERNEL32(?), ref: 005D8B30

Strings

*.*, xrefs: 005D8B36

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 846d83df1c0392558b1b50b54b66421277b5652de2786629e4c1b796e6258c3a
Instruction ID: bc0cf744bbe7c6aab005ab95445f64b343b6bb73df186afa0e9bc9a7bca83815
Opcode Fuzzy Hash: 846d83df1c0392558b1b50b54b66421277b5652de2786629e4c1b796e6258c3a
Instruction Fuzzy Hash: 6C817C726042059BCB34EB58C894A7EBBE8BB89320F14482BF9D9D7350DB74E945CB53

Function 005E1125 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207fileCOMMON

Download Yara Rule

APIs

#115.WSOCK32(00000101,?), ref: 005E1186
#10.WSOCK32(?), ref: 005E11E6
#52.WSOCK32(?), ref: 005E11F2
IcmpCreateFile.IPHLPAPI ref: 005E1200
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0,00000000), ref: 005E1290
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0,00000000), ref: 005E12AF
IcmpCloseHandle.IPHLPAPI(?), ref: 005E1383
#116.WSOCK32 ref: 005E1389

Strings

Ping, xrefs: 005E1240

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Icmp$EchoSend$#115#116CloseCreateFileHandle
String ID: Ping
API String ID: 1853569507-2246546115
Opcode ID: c8046c5f469a578938505cb2f8a60144ad529c22a885a7dd185bc6dd8ebf6ab2
Instruction ID: 951b7298b944d4b32355de7759294c7a3c7877c0df307e456fead940503f2241
Opcode Fuzzy Hash: c8046c5f469a578938505cb2f8a60144ad529c22a885a7dd185bc6dd8ebf6ab2
Instruction Fuzzy Hash: 9B91B1356086419FD724DF16C888F1ABFE1BF88318F048999E5A9CB7A2C730ED45CB91

Function 005E42A7 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 202comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 005E42F1
CoUninitialize.OLE32 ref: 005E42FB
CoCreateInstance.OLE32(?,00000000,00000017,00600B2C,?), ref: 005E4367
IIDFromString.OLE32(00000000,?), ref: 005E43D8
#8.OLEAUT32(?), ref: 005E447B
#9.WSOCK32(?,?), ref: 005E44CD

Strings

NULL Pointer assignment, xrefs: 005E43A7
Failed to create object, xrefs: 005E4372, 005E4426
Invalid parameter, xrefs: 005E43F1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CreateFromInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 2575628211-1287834457
Opcode ID: b97f5d912cbf04643869ac4b7aa190d33f3ac81fb8c8513fedc6001645e60f3f
Instruction ID: f5b69194137612839954d377e0fdc18c9c78b1bf8330507664e1b473a9844e22
Opcode Fuzzy Hash: b97f5d912cbf04643869ac4b7aa190d33f3ac81fb8c8513fedc6001645e60f3f
Instruction Fuzzy Hash: A37177312043419FCB28DF56C888B6ABBE5BF89754F104849F9C59B2A1C774ED88CF62

Function 005E96F4 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 158COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,00000000,00000000,?), ref: 005E9716

Part of subcall function 005C9D33: _wcslen.LIBCMT ref: 005C9D56

_wcslen.LIBCMT ref: 005E9770
_wcslen.LIBCMT ref: 005E97B4
_wcslen.LIBCMT ref: 005E97EF
_wcslen.LIBCMT ref: 005E9872

Strings

none, xrefs: 005E986D, 005E987E
stdcall, xrefs: 005E97EA, 005E97FF
cdecl, xrefs: 005E976B, 005E9784
winapi, xrefs: 005E97AF, 005E97C2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 63e7f14d0b9bfcb3a34e8ab73879a0464a29f771b0bf613a2c22b49505a449d5
Instruction ID: f88c30aab95be0fdcea777919a3fab6878fbb5eb47764da1c2ac7c7240355a28
Opcode Fuzzy Hash: 63e7f14d0b9bfcb3a34e8ab73879a0464a29f771b0bf613a2c22b49505a449d5
Instruction Fuzzy Hash: A7515535A041429BCF18EF29D8419BEBFA6FF92310F10852CE8A597395EB71AC45CB91

Function 005D4142 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?,?,00000000,?,005E8731,?,?,00000047,00000001,005FD944,?,00000016,?), ref: 005D4189

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

LoadStringW.USER32(00000072,?,00000FFF,?,?,005E8731,?,?,00000047,00000001,005FD944,?,00000016,?), ref: 005D41AA

Strings

Incorrect parameters to object property !, xrefs: 005D4265
^ ERROR , xrefs: 005D4258
Line %d (File "%s"):, xrefs: 005D41FD, 005D4216
"%s" (%d) : ==> %s:%s%s, xrefs: 005D42BE
Error: , xrefs: 005D428B
"%s" (%d) : ==> %s:, xrefs: 005D42DC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 542891581f7a19fdc9eae44501a7aadefe08ea4851aa9177fcc9bd1f7b053530
Instruction ID: 0beeab2d42840272b2082c1d8fb8f9d0b2146e02c84f81f12ab351ae90fe71e6
Opcode Fuzzy Hash: 542891581f7a19fdc9eae44501a7aadefe08ea4851aa9177fcc9bd1f7b053530
Instruction Fuzzy Hash: 03518F31D0020AAADB14EBE0ED5AEEEBB79BF48300F104566B505631A2DB342F99DF51

Function 005CDCB4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CEC33: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005CDCD6,?), ref: 005CEC50

Part of subcall function 005CEC33: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005CDCD6,?), ref: 005CEC69

lstrcmpiW.KERNEL32(?,?), ref: 005CDCF9
MoveFileW.KERNEL32(?,?), ref: 005CDD2F
GetFileAttributesW.KERNEL32(?), ref: 005CDD46
GetFileAttributesW.KERNEL32(?), ref: 005CDD58
GetFileAttributesW.KERNEL32(?,?), ref: 005CDDA2
_wcslen.LIBCMT ref: 005CDDC5
_wcslen.LIBCMT ref: 005CDDDB
SHFileOperationW.SHELL32(?), ref: 005CDE21

Strings

\*.*, xrefs: 005CDDB3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: File$Attributes$FullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 1658098097-1173974218
Opcode ID: 77843674c0849d17151129add3e936ea3e38e4503d54288ae8af3e68e900c6e5
Instruction ID: 2a8c72166469863e826b594848be3a80dba9499959c534f04fb6f6f032fb79c5
Opcode Fuzzy Hash: 77843674c0849d17151129add3e936ea3e38e4503d54288ae8af3e68e900c6e5
Instruction Fuzzy Hash: 6B417275C0521D5EDF12EBA4C985EED7BB8BF08340F1005AAA519E7181EA34A649CBA0

Function 005CC439 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005CC46E
_wcslen.LIBCMT ref: 005CC479
_wcslen.LIBCMT ref: 005CC4B4
_wcslen.LIBCMT ref: 005CC4E7
_wcslen.LIBCMT ref: 005CC521

Strings

EXISTS, xrefs: 005CC4E2, 005CC4F5
KEYS, xrefs: 005CC4AF, 005CC4C2
APPEND, xrefs: 005CC51C, 005CC52D
REMOVE, xrefs: 005CC474, 005CC487

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: f86b4ccdf05fcce35e95154699540c81ece61daea141ab87a82454a244b66f7a
Instruction ID: 6a21e2b3c67da5a99fff3c7f6bd48cb5471356c418a613128b9638e265244544
Opcode Fuzzy Hash: f86b4ccdf05fcce35e95154699540c81ece61daea141ab87a82454a244b66f7a
Instruction Fuzzy Hash: 0A310C76F041224FCB24ABEC9855EBABF66FBA5310B14C06DDD0E67204F971AC42CB51

Function 005D5F48 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D5F55
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 005D5FCB
GetLastError.KERNEL32 ref: 005D5FD5
SetErrorMode.KERNEL32(00000000), ref: 005D605C

Strings

READONLY, xrefs: 005D6007
NOTREADY, xrefs: 005D6000
UNKNOWN, xrefs: 005D5FF9
READY, xrefs: 005D6015, 005D601D
INVALID, xrefs: 005D600E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 43323e2121df0eb569808154d1f9c5401f8f5408adeadd1968bb328030811ba8
Instruction ID: bc8b0b358c7f8ec278e703bcb40fdef8579fccd75b872fa55117b7b8c452f007
Opcode Fuzzy Hash: 43323e2121df0eb569808154d1f9c5401f8f5408adeadd1968bb328030811ba8
Instruction Fuzzy Hash: 5F415975A042059FC720DF68D898EAABFB5FB44304F14806BE505DB3A2E635DD46DBA0

Function 005F45EF Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 005F4622
SetMenu.USER32(?,00000000), ref: 005F4631
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005F46BE
IsMenu.USER32(?), ref: 005F46D2
CreatePopupMenu.USER32 ref: 005F46DC
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 005F4709
DrawMenuBar.USER32 ref: 005F4711

Strings

F, xrefs: 005F46FD
0, xrefs: 005F45FD

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: cf8eefed9b3dc35431bb9d91fb9b762d7193e9470598ef42ca30a2415296fdc4
Instruction ID: 4eacecd792629eb03b13202da4aaddbc1d507a312a35e3837862a9f94f8ce28c
Opcode Fuzzy Hash: cf8eefed9b3dc35431bb9d91fb9b762d7193e9470598ef42ca30a2415296fdc4
Instruction Fuzzy Hash: 84416C78A0220AEFDB10DF54E884AAA7BB6FF4A355F140028FE45D7350C734A914DFA0

Function 005C2F90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005C4D36: GetClassNameW.USER32(?,?,000000FF), ref: 005C4D59

SendMessageW.USER32(?,0000018C,000000FF,00020000,?,?,ListBox,?,?,ComboBox), ref: 005C3015
GetDlgCtrlID.USER32(?,?,?,0000018C,000000FF,00020000,?,?,ListBox,?,?,ComboBox), ref: 005C3020
GetParent.USER32(?,00000111,?,?,?,?,0000018C,000000FF,00020000,?,?,ListBox,?,?,ComboBox), ref: 005C303C
SendMessageW.USER32(00000000,?,00000111,?,?,?,?,0000018C,000000FF,00020000,?,?,ListBox,?,?,ComboBox), ref: 005C303F
GetDlgCtrlID.USER32(?,?,?,00000111,?,?,?,?,0000018C,000000FF,00020000,?,?,ListBox,?), ref: 005C3048
GetParent.USER32(?,00000111,00020000,?,00000111,?,?,?,?,0000018C,000000FF,00020000,?,?,ListBox,?), ref: 005C305C
SendMessageW.USER32(00000000,?,00000111,?,?,?,?,0000018C,000000FF,00020000,?,?,ListBox,?,?,ComboBox), ref: 005C305F

Strings

ListBox, xrefs: 005C2FD2
ComboBox, xrefs: 005C2F9D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: ba98dd348d79bf9b6b78029f8ce1ea4b2325de0686f9b2b714b6eb380fbac853
Instruction ID: 446212a4133b78fe15eb632a747ffe1068d1bae8c88f38636e1e74fdad6adcb6
Opcode Fuzzy Hash: ba98dd348d79bf9b6b78029f8ce1ea4b2325de0686f9b2b714b6eb380fbac853
Instruction Fuzzy Hash: 5B21CF71D00119AFCF10EBA0DC99EFEBF7AFF15310F00465AB955A3291DA394948DB60

Function 005C3073 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005C4D36: GetClassNameW.USER32(?,?,000000FF), ref: 005C4D59

SendMessageW.USER32(?,00000186,00020000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C30F6
GetDlgCtrlID.USER32(?,?,?,00000186,00020000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C3101
GetParent.USER32(?,00000111,?,?,?,?,00000186,00020000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C311D
SendMessageW.USER32(00000000,?,00000111,?,?,?,?,00000186,00020000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C3120
GetDlgCtrlID.USER32(?,?,?,00000111,?,?,?,?,00000186,00020000,00000000,?,?,ListBox,?), ref: 005C3129
GetParent.USER32(?,00000111,00020000,?,00000111,?,?,?,?,00000186,00020000,00000000,?,?,ListBox,?), ref: 005C313D
SendMessageW.USER32(00000000,?,00000111,?,?,?,?,00000186,00020000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C3140

Strings

ListBox, xrefs: 005C30B5
ComboBox, xrefs: 005C3080

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: d2427550e6e03a6e15a3b04832c323c95559f87a9763cdce52f8fc850cc7087d
Instruction ID: 1673e3111562b04dbc8bad98fddbd3160b82b9caafa3d2e3013564d93b8fa487
Opcode Fuzzy Hash: d2427550e6e03a6e15a3b04832c323c95559f87a9763cdce52f8fc850cc7087d
Instruction Fuzzy Hash: B621BE71D00219BFCF10ABA0DC99EFEBFBAFF15310F00855AB955A3291CA794948DB60

Function 005F43BD Relevance: 15.2, APIs: 10, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000,00001200,00000000,00000000,?,?,?), ref: 005F443F
SendMessageW.USER32(00000000,?,0000101F,00000000,00000000,00001200,00000000,00000000,?,?,?), ref: 005F4442
GetWindowLongW.USER32(?,000000F0,?,0000101F,00000000,00000000,00001200,00000000,00000000,?,?,?), ref: 005F4469
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005F448C
SendMessageW.USER32(?,0000104D,00000000,00000007,?,00000000,006328A4), ref: 005F4504

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 37a9856f45fcfa3bef6140daadd049056935af77651475ac2e4b35172e49b2ed
Instruction ID: ae9a6dc300b1dc74f473fec1af70f06033d408a93364accdd02088352004883d
Opcode Fuzzy Hash: 37a9856f45fcfa3bef6140daadd049056935af77651475ac2e4b35172e49b2ed
Instruction Fuzzy Hash: CC616875900209AFDB20DFA8CC81EFE7BB9BB49700F104159FA14A72A1D774AD45DF90

Function 005CBF7F Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,?,?,005CB01C,?,00000001), ref: 005CBFA1
GetForegroundWindow.USER32(00000000,?,?,?,?,?,005CB01C,?,00000001), ref: 005CBFB5
GetWindowThreadProcessId.USER32(00000000,?,?,?,?,?,005CB01C,?,00000001), ref: 005CBFBC
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005CB01C,?,00000001), ref: 005CBFCB
GetWindowThreadProcessId.USER32(?,00000000,?,?,?,?,?,005CB01C,?,00000001), ref: 005CBFDD
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,005CB01C,?,00000001), ref: 005CBFF6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005CB01C,?,00000001), ref: 005CC008
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,005CB01C,?,00000001), ref: 005CC04D
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,005CB01C,?,00000001), ref: 005CC062
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,005CB01C,?,00000001), ref: 005CC06D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: a799893bf8a06e0b646e1b1bfd60a5794e0e9c0c0cc733937a005b806ad1cbd6
Instruction ID: 0b5d10a60fd6e9e96719569a499bdc337343bb399648cb74c075aa546167073d
Opcode Fuzzy Hash: a799893bf8a06e0b646e1b1bfd60a5794e0e9c0c0cc733937a005b806ad1cbd6
Instruction Fuzzy Hash: 8F316971A00215EFEB209FA5DC48F6D7FBABB54711F10800DF908EA290D7B99A44DBA0

Function 00592B57 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00592B6B

Part of subcall function 005927F4: HeapFree.KERNEL32(00000000,00000000,?,0056FC79,?,?,0056111E), ref: 0059280A

_free.LIBCMT ref: 00592B77
_free.LIBCMT ref: 00592B82
_free.LIBCMT ref: 00592B8D
_free.LIBCMT ref: 00592B98
_free.LIBCMT ref: 00592BA3
_free.LIBCMT ref: 00592BAE
_free.LIBCMT ref: 00592BB9
_free.LIBCMT ref: 00592BC4
_free.LIBCMT ref: 00592BD2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: b3eec4424fe50e8e2e39531240296a594f596c5efb090798bcf6fca0b482c3b4
Instruction ID: 35719fd86cc1e95ece0b334ce32e63186d715e01415948854a3fe3d42aa10c1e
Opcode Fuzzy Hash: b3eec4424fe50e8e2e39531240296a594f596c5efb090798bcf6fca0b482c3b4
Instruction Fuzzy Hash: 3C11A47A108189BFCF09EF99C856CD93FA5FF44350F4140A1BA089B222DA31DA55EB80

Function 005694B8 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 333comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00569501
OleUninitialize.OLE32(?,00000000), ref: 005695A0
UnregisterHotKey.USER32(?), ref: 00569787
DestroyWindow.USER32(?), ref: 005A8D83
FreeLibrary.KERNEL32(?), ref: 005A8DE8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 005A8E15

Strings

close all, xrefs: 005694FC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 0afcded74ce654ee07b5d501498f613e5b597018a993844d7d949dcc5aae01a5
Instruction ID: 6dc2a6b073d0ec510c3a1406117b1ae384841e9dad43448489e9ecc67da5b3bd
Opcode Fuzzy Hash: 0afcded74ce654ee07b5d501498f613e5b597018a993844d7d949dcc5aae01a5
Instruction Fuzzy Hash: 01D17971701213CFCB29EF14C499A29FBA9BF55710F1446ADE90AAB2A1CF31AC56CF50

Function 005CC563 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

CompareStringW.KERNEL32(00000400,00000001,?,?,?,?,REMOVE), ref: 005CC5C8

Strings

EXISTS, xrefs: 005CC6CB
KEYS, xrefs: 005CC637
APPEND, xrefs: 005CC76A
REMOVE, xrefs: 005CC5A9

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CompareString_wcslen
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1025422365-769500911
Opcode ID: 6e5acab473ce0abf96e17e52c3d774fc9e8b3d09126f92093bfdc67f4b073532
Instruction ID: 8bf1b35ffd8227fadc20f33ca9a547278ea5a1b341d69bdaf3fb2be7699de3d0
Opcode Fuzzy Hash: 6e5acab473ce0abf96e17e52c3d774fc9e8b3d09126f92093bfdc67f4b073532
Instruction Fuzzy Hash: BE9134716083029FCB10DF98C999E6ABFE5FF98710F00496DF49A9B2A1D770D948CB52

Function 005757F1 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00575881

Part of subcall function 005745EE: GetClientRect.USER32(?,?), ref: 00574614
Part of subcall function 005745EE: GetWindowRect.USER32(?,?), ref: 00574655
Part of subcall function 005745EE: ScreenToClient.USER32(?,?), ref: 0057467D

GetDC.USER32 ref: 005B9A62
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 005B9A75
SelectObject.GDI32(00000000,00000000,?,00000031,00000000,00000000), ref: 005B9A83
SelectObject.GDI32(00000000,00000000,?,00000031,00000000,00000000), ref: 005B9A98
ReleaseDC.USER32(?,00000000,?,00000031,00000000,00000000), ref: 005B9AA0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 005B9B31

Strings

U, xrefs: 005B9A00

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 80a9ab9214b5a2460a46756afa2024e0617f10331521db745908cdfe067c374d
Instruction ID: ed3e088308aad84b5d369a42f85b739b082b2146b7b00167a7bd736f510e6c83
Opcode Fuzzy Hash: 80a9ab9214b5a2460a46756afa2024e0617f10331521db745908cdfe067c374d
Instruction Fuzzy Hash: D171B230500209DFCF218F64D884AFA7FB5FF49320F244669EE559A2A6D731AC44EF61

Function 0056921A Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 0057F9FB: MapVirtualKeyW.USER32(0000005B,00000000,?,?,?,00569291), ref: 0057FA2C
Part of subcall function 0057F9FB: MapVirtualKeyW.USER32(00000010,00000000,?,?,?,00569291), ref: 0057FA34
Part of subcall function 0057F9FB: MapVirtualKeyW.USER32(000000A0,00000000,?,?,?,00569291), ref: 0057FA3F
Part of subcall function 0057F9FB: MapVirtualKeyW.USER32(000000A1,00000000,?,?,?,00569291), ref: 0057FA4A
Part of subcall function 0057F9FB: MapVirtualKeyW.USER32(00000011,00000000,?,?,?,00569291), ref: 0057FA52
Part of subcall function 0057F9FB: MapVirtualKeyW.USER32(00000012,00000000,?,?,?,00569291), ref: 0057FA5A

Part of subcall function 0057F508: RegisterWindowMessageW.USER32(00000004,?,005693EB), ref: 0057F560

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00569488
OleInitialize.OLE32 ref: 005694A6
CloseHandle.KERNEL32(00000000,00000000), ref: 005A8D75

Strings

<%c, xrefs: 005692B1
&c, xrefs: 005693CF
%c, xrefs: 005693B9
x$c, xrefs: 00569278
`(c, xrefs: 005693F7

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <%c$`(c$x$c$%c$&c
API String ID: 1986988660-1501787395
Opcode ID: b8ed8efc1c7ff2665bf136f0f66d49834d9fd97762facdfefe078a77e9158e0f
Instruction ID: 8775e8b1439b88528c0e3ae8cc74a23f909f3a7a801dd6721f4c4f7fba286c4f
Opcode Fuzzy Hash: b8ed8efc1c7ff2665bf136f0f66d49834d9fd97762facdfefe078a77e9158e0f
Instruction Fuzzy Hash: BA718AB0A112078FD388EF79FD796253FE7FB88321710A52A9109C7262EB3446499FD5

Function 005D4358 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?,00000000,?,?,005A40FE,0000006E,?), ref: 005D43A0

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

LoadStringW.USER32(?,?,00000FFF,?,?,?,005A40FE,0000006E,?), ref: 005D43C6

Strings

Line %d (File "%s"):, xrefs: 005D4427
"%s" (%d) : ==> %s:%s%s, xrefs: 005D44E0
Error: , xrefs: 005D44AB
^ ERROR, xrefs: 005D4485
"%s" (%d) : ==> %s:, xrefs: 005D44FE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: c6f59800bf512d5260300b213492e320b2871fdfbfc062540d43ad8fda9057dd
Instruction ID: 6fad21e6b5db6e4080c0e61032548a14402d994ff9ecc9e1f33e17ad8c63aac6
Opcode Fuzzy Hash: c6f59800bf512d5260300b213492e320b2871fdfbfc062540d43ad8fda9057dd
Instruction Fuzzy Hash: 8F515072D0021AABDF15EBE0EC9AEEEBF75BF44300F404166F505621A1DB306A99DF91

Function 005DCD34 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005DCD53
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 005DCD7B
HttpQueryInfoW.WININET(00000000,00000005,?,?,?,00000000), ref: 005DCDAB
GetLastError.KERNEL32 ref: 005DCE03
SetEvent.KERNEL32(?), ref: 005DCE17
InternetCloseHandle.WININET(00000000), ref: 005DCE22

Strings

, xrefs: 005DCD9C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 58cb4472237ae1f471177f2de67d4257969d5e850ca874025902ebd0a0bfd0b3
Instruction ID: cbf9cb1be53a169b1f7c3e8d1d7f9375916891b0b4944290d0ac7abee10afa51
Opcode Fuzzy Hash: 58cb4472237ae1f471177f2de67d4257969d5e850ca874025902ebd0a0bfd0b3
Instruction Fuzzy Hash: 13316DB1501246AFD731AF698C88ABBBFFDFB55750B10452BF446D6300DA349908EBB1

Function 005CA66B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,005B690F,?,?,Bad directive syntax error,005FD938,00000000,00000010,?,?), ref: 005CA68C
LoadStringW.USER32(00000000,?,005B690F,?,?,Bad directive syntax error,005FD938,00000000,00000010,?,?,?,?,?,?,00000001), ref: 005CA693

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

MessageBoxW.USER32(00000000,00000001,00000001,00011010,.,00000001,Error: ,?,?,00000001), ref: 005CA757

Strings

Line %d (File "%s"):, xrefs: 005CA6FD
Error: , xrefs: 005CA725
Line %d:, xrefs: 005CA6E2
., xrefs: 005CA73D
%s (%d) : ==> %s.: %s %s, xrefs: 005CA6C1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 6d9ad8153d82d220304512778fc93554eab77f08e499fd0cab765fb52dcfdeda
Instruction ID: 2e60a97096f7dd7d703e7238bf2874ebaca54e9b12cd7610bc96efa0c273d453
Opcode Fuzzy Hash: 6d9ad8153d82d220304512778fc93554eab77f08e499fd0cab765fb52dcfdeda
Instruction Fuzzy Hash: 3A215C32C0421EEBCF11EF90EC5AEEE7B7ABF18700F044869F515620A2DA719A58DB51

Function 005C3154 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 005C3160
GetClassNameW.USER32(00000000,?,00000100), ref: 005C3175
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 005C3202

Strings

list, xrefs: 005C31E4
smallicons, xrefs: 005C31CA
SHELLDLL_DefView, xrefs: 005C3181
largeicons, xrefs: 005C3196
details, xrefs: 005C31B0

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 79b1736cb6d89951b7f8b7af104eb2dcd4b669603858c77508ed23dac51cd56e
Instruction ID: 3c0794a13145cfee1ceaf76151ae88e43b7737080ccc2fa6e238ac51013fae8f
Opcode Fuzzy Hash: 79b1736cb6d89951b7f8b7af104eb2dcd4b669603858c77508ed23dac51cd56e
Instruction Fuzzy Hash: 75112B7A644317BEE7103650EC0BEB73F9DAB15724B21801BFD18E40D1FE626A44DA54

Function 00598B75 Relevance: 13.8, APIs: 9, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfe8f23fa0422e28c3395c581113dd9a5841a3bd8a4c5647acfb1c3865343e6
Instruction ID: fd15bb183ca3294b527deb86596e761f6c55e5a7d144e089706064d5dcf160df
Opcode Fuzzy Hash: 1dfe8f23fa0422e28c3395c581113dd9a5841a3bd8a4c5647acfb1c3865343e6
Instruction Fuzzy Hash: 94C1B070A0424AAFDF11DFA8C855BBEBFB5BF5B310F180489E514AB392CB749941CB61

Function 0059CCC0 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0059CCE7
_free.LIBCMT ref: 0059CD52
_free.LIBCMT ref: 0059CD78
_free.LIBCMT ref: 0059CDA1
_free.LIBCMT ref: 0059CDD9
_free.LIBCMT ref: 0059CE0A
_free.LIBCMT ref: 0059CE4B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0059CECC
_free.LIBCMT ref: 0059CEE5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 12abf3757fce9daffd754fbc45c30e97d9b59c74a744015580207eb24e82c6b0
Instruction ID: 2ca87ec614457b41ed3e6cd2fe931cb50ca098deb4d4d771d34c9120c787ff95
Opcode Fuzzy Hash: 12abf3757fce9daffd754fbc45c30e97d9b59c74a744015580207eb24e82c6b0
Instruction Fuzzy Hash: B361F671A04342BFDF25AFB8D8856AABFA9FF46350F04017DEA45AF291DA318D418790

Function 005F5AEB Relevance: 13.7, APIs: 9, Instructions: 164COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 005F5B96

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: cd8b2dfb85f706d7fca475a1ba1c3a7165c09393d927be27d05d218ed9dcbcbb
Instruction ID: 464285a5faf7be3aa98466af3c774bae2a7ced8cb5b631298615cbbb27e9e200
Opcode Fuzzy Hash: cd8b2dfb85f706d7fca475a1ba1c3a7165c09393d927be27d05d218ed9dcbcbb
Instruction Fuzzy Hash: 0C514E30640A0DAFEF209B24DC4AFB97F65BB04710F148111FB169A1E1E779AD90EB51

Function 0057555B Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF), ref: 005B8FD7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF,00000000), ref: 005B8FF9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF), ref: 005B9011
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF,00000000), ref: 005B902F
SendMessageW.USER32(00000000,00000080,00000000,00000000,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF,00000000,000000FF), ref: 005B9050
DestroyIcon.USER32(00000000,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 005B905F
SendMessageW.USER32(00000000,00000080,00000001,00000000,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF,00000000,000000FF), ref: 005B907C
DestroyIcon.USER32(00000000,?,?,?,?,?,0056C4A3,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 005B908B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 170dff80af0fdc9d877621f18869188858f6139830e2f5c98fe95b4041a0aff7
Instruction ID: f5b32b9a2d4bb0c224e8ee62e4556c09a27fc6c3795c12cbe8541f3d88867ce9
Opcode Fuzzy Hash: 170dff80af0fdc9d877621f18869188858f6139830e2f5c98fe95b4041a0aff7
Instruction Fuzzy Hash: 64512B7060060AAFDB20DF24DC59BAA7BB6FB58714F104518F906D7290E7B1ED94EBA0

Function 005DCC24 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005DCC63
GetLastError.KERNEL32 ref: 005DCC76
SetEvent.KERNEL32(?), ref: 005DCC8A

Part of subcall function 005DCD34: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005DCD53
Part of subcall function 005DCD34: GetLastError.KERNEL32 ref: 005DCE03
Part of subcall function 005DCD34: SetEvent.KERNEL32(?), ref: 005DCE17
Part of subcall function 005DCD34: InternetCloseHandle.WININET(00000000), ref: 005DCE22

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 8e5e5ded2fc793be1c1bca832012bdd31aa96fdec3c58ca6746073beb69b4299
Instruction ID: 8acdf17f95115c805973bb2bbb30b643061a2d120c5351651e4569423b38641b
Opcode Fuzzy Hash: 8e5e5ded2fc793be1c1bca832012bdd31aa96fdec3c58ca6746073beb69b4299
Instruction Fuzzy Hash: 13316D71101646AFDB31AF698C44A7ABFBAFF58310B14482FF956C6720C735E814EBA0

Function 005C367A Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005C3E94: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?,?,?,?,?,005C368B), ref: 005C3EB2
Part of subcall function 005C3E94: GetWindowThreadProcessId.USER32(?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3EC3
Part of subcall function 005C3E94: GetCurrentThreadId.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ECA
Part of subcall function 005C3E94: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ED1

MapVirtualKeyW.USER32(00000025,00000000), ref: 005C3695
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 005C36B3
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 005C36B7
MapVirtualKeyW.USER32(00000025,00000000,?,00000100,00000025,00000000), ref: 005C36C1
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 005C36D9
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 005C36DD
MapVirtualKeyW.USER32(00000025,00000000,?,00000100,00000027,00000000), ref: 005C36E7
PostMessageW.USER32(?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 005C36FB
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 005C36FF

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Message$PostSleepThreadVirtual$AttachCurrentInputProcessSendTimeoutWindow
String ID:
API String ID: 2686503918-0
Opcode ID: 3bf08a0bdf42c2ce180a031fff40e90e1d6ea06d3bcd8ba61c93c27fe4a99048
Instruction ID: 2063f053d882c3f55d43f4854fe1ec0c8de7365aa1ab66ee3e54dd0b195c19d9
Opcode Fuzzy Hash: 3bf08a0bdf42c2ce180a031fff40e90e1d6ea06d3bcd8ba61c93c27fe4a99048
Instruction Fuzzy Hash: 9801D8303803147BFB1067689C8EF697F6AEB9DB51F100405F318EE1E0C9E56444DA79

Function 005E5BAD Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 364COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 005E5C2D, 005E5F89
Not an Object type, xrefs: 005E5C06

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: db11b6bd73a0c3c58fc79e2f862606d1b754baeb3254f12931c62f894ff0f8b7
Instruction ID: 5655b02b32a946cc15649de209b369aaecb47de0855f656911d4152a3ecef260
Opcode Fuzzy Hash: db11b6bd73a0c3c58fc79e2f862606d1b754baeb3254f12931c62f894ff0f8b7
Instruction Fuzzy Hash: A9D1C571A0064A9FDF14CF59C884FAEBBB9FF48308F148469E955AB281E770DD45CB60

Function 005CD36C Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00572306: _wcslen.LIBCMT ref: 0057230B

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005CD48A
_wcslen.LIBCMT ref: 005CD4D1
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005CD538
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 005CD566

Strings

)c, xrefs: 005CD3E7
0, xrefs: 005CD44B
p)c, xrefs: 005CD3B8

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0$p)c$)c
API String ID: 1227352736-2269920802
Opcode ID: b2c2f9d10c4ed61320376a3ad730618c89d4ade05631cc8e31cc5549d86eb0bc
Instruction ID: 19254fd049d27406a36bb05bd652a4297568bd425db579e4ae2ac975e3f2a1cf
Opcode Fuzzy Hash: b2c2f9d10c4ed61320376a3ad730618c89d4ade05631cc8e31cc5549d86eb0bc
Instruction Fuzzy Hash: 36519D716143019EDB54AFA8D885F6ABFF8BB85318F04093DF995D31A0D7B4D9048BA2

Function 0059B957 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00604560), ref: 0059B9C1
WideCharToMultiByte.KERNEL32(00000000,00000000,006321DC,000000FF,00000000,0000003F,00000000,?,?), ref: 0059BA39
WideCharToMultiByte.KERNEL32(00000000,00000000,00632230,000000FF,?,0000003F,00000000,?), ref: 0059BA66
_free.LIBCMT ref: 0059B9AF

Part of subcall function 005927F4: HeapFree.KERNEL32(00000000,00000000,?,0056FC79,?,?,0056111E), ref: 0059280A

_free.LIBCMT ref: 0059BB7B

Strings

`E`, xrefs: 0059BADE
`E`, xrefs: 0059B96A, 0059B970

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide_free$FreeHeapInformationTimeZone
String ID: `E`$`E`
API String ID: 4205277975-2001098328
Opcode ID: 64d0c63d0920d51bd7ce9ff1ab9a8384f66cb6c609142ae703c9df2e908b324c
Instruction ID: a6b1cd0c8380034548cb7d650206202ead32fb3da48b61733cff51d9a2c03425
Opcode Fuzzy Hash: 64d0c63d0920d51bd7ce9ff1ab9a8384f66cb6c609142ae703c9df2e908b324c
Instruction Fuzzy Hash: 9551D67190020AEBFF10EF65EE959BA7FBAFF80350F10026AE55097191E7309E41DB90

Function 005EAAD8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 005CE2AB: CreateToolhelp32Snapshot.KERNEL32 ref: 005CE2D0
Part of subcall function 005CE2AB: Process32FirstW.KERNEL32(00000000,?), ref: 005CE2DE
Part of subcall function 005CE2AB: CloseHandle.KERNEL32(00000000), ref: 005CE3BC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 005EAB63
GetLastError.KERNEL32 ref: 005EAB76
OpenProcess.KERNEL32(00000001,00000000,?), ref: 005EABA9
TerminateProcess.KERNEL32(00000000,00000000), ref: 005EAC5E
GetLastError.KERNEL32(00000000), ref: 005EAC69
CloseHandle.KERNEL32(00000000), ref: 005EACBA

Strings

SeDebugPrivilege, xrefs: 005EAB85

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f469a4f473d725cf7f46cb7761f6d66938f7eb893f35bf0540bd46172b32080b
Instruction ID: 660f8b0735c654271d11ae8cb39b8548e65a178da9fc4cfb2572ccfd0ac83b47
Opcode Fuzzy Hash: f469a4f473d725cf7f46cb7761f6d66938f7eb893f35bf0540bd46172b32080b
Instruction Fuzzy Hash: 08619A742082829FD324DF25C498F25BBE5BF54318F24849CF49A8B6A2C775ED49CB92

Function 005F421E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010,?,?,SysListView32,005FD938,00000000,?,?,?,?,?,?,00000000), ref: 005F42BD
SendMessageW.USER32(00000000,00001036,00000000,?,?,?,SysListView32,005FD938,00000000,?,?,?,?,?,?,00000000), ref: 005F42D2
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 005F42EC
_wcslen.LIBCMT ref: 005F4331
SendMessageW.USER32(?,00001057,00000000,?,?,?,006328A4), ref: 005F435E
SendMessageW.USER32(?,00001061,?,0000000F), ref: 005F438C

Strings

SysListView32, xrefs: 005F428F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 3336bf690ed40713c42bfd55e3b2812d42a0c601861984c436bfae8b0609d2e2
Instruction ID: 2b51b9c3692b0b7df55e6e98e74584a2d52a142452125e5e78186d1f4b38eacf
Opcode Fuzzy Hash: 3336bf690ed40713c42bfd55e3b2812d42a0c601861984c436bfae8b0609d2e2
Instruction Fuzzy Hash: E241BD71A00219ABDB219F64CC49BFB7BAAFF48350F110526FA08E7281D7799984CF90

Function 005CCAE1 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030,00000000,000000FF,?,00000000,000CB752), ref: 005CCB80
IsMenu.USER32(00000000,?,00000000,000CB752), ref: 005CCBA0
CreatePopupMenu.USER32(?,00000000,000CB752), ref: 005CCBD6
GetMenuItemCount.USER32(00000000,?,00000000,000CB752), ref: 005CCC34
InsertMenuItemW.USER32(00000000,?,00000001,00000030,?,00000000,000CB752), ref: 005CCC5C

Strings

0, xrefs: 005CCB2B
2, xrefs: 005CCBBA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 0d5a27927181ca5665b043c38902c15e98ed876a74b0d5c7a82e331229cc2371
Instruction ID: 39ea99486539728e5e5b820df8ec6aff3344c295da69e01a12292cac34e39bc2
Opcode Fuzzy Hash: 0d5a27927181ca5665b043c38902c15e98ed876a74b0d5c7a82e331229cc2371
Instruction Fuzzy Hash: BA515970A002059FDB20CFA8D988BAEBFB5BB49318F14426DE82DE7290D7709D45CB61

Function 005CD612 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03,00632B0C,00632970,00632B10,00632970,00632970,?,005B7CA9,?,?,00632B10), ref: 005CD6B1

Strings

stop, xrefs: 005CD682
question, xrefs: 005CD66A
blank, xrefs: 005CD633
info, xrefs: 005CD652
warning, xrefs: 005CD69A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a5a5e923f03992421ad76265f35e212c5f705bf7aed71cc80c0c04c83dd24977
Instruction ID: c0b917686e9ab23a4642dd6ae534df4ab2598438186328a239bc65835ea96917
Opcode Fuzzy Hash: a5a5e923f03992421ad76265f35e212c5f705bf7aed71cc80c0c04c83dd24977
Instruction Fuzzy Hash: 1F11D8326487177FD7115A94AC42E6F6FBCBF15364B20003EFD0CE6181EAB46A80D6B8

Function 005CEC7C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

#115.WSOCK32(00000101,?), ref: 005CEC97
#57.WSOCK32(?,00000100), ref: 005CECB1
#52.WSOCK32(?), ref: 005CECBE
#11.WSOCK32(?), ref: 005CED00
_strcat.LIBCMT ref: 005CED0E
#116.WSOCK32 ref: 005CED33

Strings

0.0.0.0, xrefs: 005CECDC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: #115#116_strcat
String ID: 0.0.0.0
API String ID: 941644628-3771769585
Opcode ID: 3ce033c01da13e3595719d48a664a069ae9d9e9aaaa6b0b605602fa4a4cd8cee
Instruction ID: fcd663366d2fe977ee5abc2a28bdd20109652ee82871689b4a7288969a92bc8a
Opcode Fuzzy Hash: 3ce033c01da13e3595719d48a664a069ae9d9e9aaaa6b0b605602fa4a4cd8cee
Instruction Fuzzy Hash: E011D532504215AFDB20B7A09C4AFBE7B7CFF61710F01046DF905E6091EEB99D859B61

Function 005D1EAE Relevance: 12.3, APIs: 8, Instructions: 275COMMON

Download Yara Rule

APIs

#77.OLEAUT32(00000001,?,00000002,?,?,00000000,?,?,?,?,?,005D1AE8,?,?,?,?), ref: 005D1F8A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4bacade0318eac50fbbe027210f00ceacada9b42d5646c64e3ac0cad68c5f4
Instruction ID: 9d9dcadbfe9202efb5bc239dffe8d4379d65eb229dfc363f1c4f97cab9b5cfa3
Opcode Fuzzy Hash: 3b4bacade0318eac50fbbe027210f00ceacada9b42d5646c64e3ac0cad68c5f4
Instruction Fuzzy Hash: A5A1807190021A9FDB10DF98C889BBEBBB5FF98311F14805BEA00E7351D774A985CBA1

Function 005FA94E Relevance: 12.3, APIs: 8, Instructions: 262windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

GetSystemMetrics.USER32(0000000F), ref: 005FA98F
GetSystemMetrics.USER32(0000000F), ref: 005FA9AF
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 005FABF3
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 005FAC11
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 005FAC32
ShowWindow.USER32(00000003,00000000), ref: 005FAC51
InvalidateRect.USER32(?,00000000,00000001), ref: 005FAC76
DefDlgProcW.USER32(?,00000005,?,?), ref: 005FAC99

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: a30b6b65ee8a208e9de120dd55190601a3dfccfe631d48ada8d22a43b686d3dd
Instruction ID: 22e900fe529b2567cefbd10f566507b1814fd67dbd21e6a00c88029f5831fa7c
Opcode Fuzzy Hash: a30b6b65ee8a208e9de120dd55190601a3dfccfe631d48ada8d22a43b686d3dd
Instruction Fuzzy Hash: D5B198B1600219DFCF14CF28C9897BE7BB2FF44701F088069EE499B295D738A944CB62

Function 005CFBA1 Relevance: 12.1, APIs: 8, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 005CFBB2
_wcslen.LIBCMT ref: 005CFBC3
_wcslen.LIBCMT ref: 005CFC01
_wcslen.LIBCMT ref: 005CFC37
_wcslen.LIBCMT ref: 005CFC67
_wcslen.LIBCMT ref: 005CFC77
_wcslen.LIBCMT ref: 005CFCB3
_wcslen.LIBCMT ref: 005CFCE2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 9bf1074ed2dbc4ae67ace35ec140987cd2b8277d180a8563727a3e5b55064d7b
Instruction ID: 8a8d2d53a2394bb1d6c327d1875c00dabb2c96be8ee18d87dbaa505561e40489
Opcode Fuzzy Hash: 9bf1074ed2dbc4ae67ace35ec140987cd2b8277d180a8563727a3e5b55064d7b
Instruction Fuzzy Hash: 8141AF65C1021A76CB11FBF5884EADFBBBDBF45310F508466ED09E3122EA349614CBA6

Function 0057544C Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,000000FF,00000000,?,?,005B8E87,00000004,00000000,00000000), ref: 005754CC
ShowWindow.USER32(?,00000006,00000000,?,?,005B8E87,00000004,00000000,00000000), ref: 005B8EE3
ShowWindow.USER32(?,000000FF,00000000,?,?,005B8E87,00000004,00000000,00000000), ref: 005B8F66

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 06281c2fddac543decd717e1db5d7cbce12dbf3e0d1a010f25c995cf8d2184cd
Instruction ID: d54df46d8f08ec2c8ded33dc21c3ba553e0933ebd01e70886221d38ae79f0be3
Opcode Fuzzy Hash: 06281c2fddac543decd717e1db5d7cbce12dbf3e0d1a010f25c995cf8d2184cd
Instruction Fuzzy Hash: FC41BB30604AC19ADF359B38E88CB7A7F97BB95312F14D81DE04E46561D6B5E8C4F720

Function 005E1DD8 Relevance: 12.1, APIs: 8, Instructions: 114COMMON

Download Yara Rule

APIs

#23.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 005E1E4A
#111.WSOCK32 ref: 005E1E57
#2.WSOCK32(00000000,?,00000010), ref: 005E1E8E
#111.WSOCK32 ref: 005E1E99
#3.WSOCK32(00000000), ref: 005E1EC8
#13.WSOCK32(00000000,00000005), ref: 005E1ED7
#111.WSOCK32 ref: 005E1EE1
#3.WSOCK32(00000000), ref: 005E1F10

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: #111
String ID:
API String ID: 568940515-0
Opcode ID: f46eee19e95616f4d54a193ab984ab657dac2d2ec57c7491e3b1e093851e9066
Instruction ID: c9fb126744dbdcfb4b3280d44f1d845652c0053a51f13bf710a110d30908b762
Opcode Fuzzy Hash: f46eee19e95616f4d54a193ab984ab657dac2d2ec57c7491e3b1e093851e9066
Instruction Fuzzy Hash: F6418E30A005419FD714DF25C498B2ABFBABF45314F188198E8569F292C775ED86CBE1

Function 005F3681 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000,00000001,?,?,?,?,005F64C1,?,?,000000FF,00000000,?,000000FF,?,00000001,?), ref: 005F3699
GetDC.USER32(00000000,00000001,?,?,?,?,005F64C1,?,?,000000FF,00000000,?,000000FF,?,00000001,?), ref: 005F36A1
GetDeviceCaps.GDI32(00000000,0000005A,?,?,005F64C1,?,?,000000FF,00000000,?,000000FF,?,00000001,?), ref: 005F36AC
ReleaseDC.USER32(00000000,00000000,?,?,005F64C1,?,?,000000FF,00000000,?,000000FF,?,00000001,?), ref: 005F36B8
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 005F36F4
SendMessageW.USER32(?,00000030,00000000,00000001,?,?,005F64C1,?,?,000000FF,00000000,?,000000FF,?,00000001,?), ref: 005F3705
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,005F64C1,?,?,000000FF,00000000,?,000000FF,?), ref: 005F3740
SendMessageW.USER32(?,00000142,00000000,00000000,?,?,005F64C1,?,?,000000FF,00000000,?,000000FF,?,00000001,?), ref: 005F375F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 9b46a99815fd93eba0b76c90c05147110560a5da642dcd09d4ab7abb46069b67
Instruction ID: 47855127e4aa2904862da4c7cc5390da32393e6b43071d311f33b14de7050c6a
Opcode Fuzzy Hash: 9b46a99815fd93eba0b76c90c05147110560a5da642dcd09d4ab7abb46069b67
Instruction Fuzzy Hash: 3B315AB2201214BBEB119F14CC89FBB3FAAFF19721F044065FE08DA291D6799945DBB4

Function 005A1452 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,005A172B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 005A14FE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,005A172B,00000000,00000000,?,00000000,?,?,?,?), ref: 005A1581
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,005A172B,?,005A172B,00000000,00000000,?,00000000,?,?,?,?), ref: 005A1614
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,005A172B,00000000,00000000,?,00000000,?,?,?,?), ref: 005A162B

Part of subcall function 0059282E: HeapAlloc.KERNEL32(00000000,?,00000001,?,00580445,?,?,0056FA72,00000000,?,?,?,00561188,?), ref: 00592860

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,005A172B,00000000,00000000,?,00000000,?,?,?,?), ref: 005A16A7
__freea.LIBCMT ref: 005A16D2
__freea.LIBCMT ref: 005A16DE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocHeapInfo
String ID:
API String ID: 2171645-0
Opcode ID: 1d848b89f2551f42675803abfb223424b3574ebddb9ea879cd7de10149d6bfed
Instruction ID: abb46e05393d8b7885d07ecc3cdcc40391846c41e6e050f533434dd0a2e1f292
Opcode Fuzzy Hash: 1d848b89f2551f42675803abfb223424b3574ebddb9ea879cd7de10149d6bfed
Instruction Fuzzy Hash: F891C372E00A169BDF208EA9CC45EEE7FB5BF4A750F184659E805EB181DB35DC40CB68

Function 005E5123 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

#8.OLEAUT32(?,?,?), ref: 005E5248
#8.OLEAUT32(?,?,?,?), ref: 005E5349
#9.WSOCK32(?,?,?), ref: 005E5353
#9.WSOCK32(?,?,?,?), ref: 005E53B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 005E532C
Null Object assignment in FOR..IN loop, xrefs: 005E51D8, 005E5306, 005E53BE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 0-625585964
Opcode ID: 3bf3627206531fda89d7ac0bf8ea6ff32588237164e48a46ee92fdffe21bd4fa
Instruction ID: cd824d9ce89534c6fa10bae524447839cbf2e1aab1a5b80c923e6894038f51d7
Opcode Fuzzy Hash: 3bf3627206531fda89d7ac0bf8ea6ff32588237164e48a46ee92fdffe21bd4fa
Instruction Fuzzy Hash: 6191A270A00655ABDF28CFA6C848FAEBFB8FF45714F108559F545AB280E7B09944CFA0

Function 00573C69 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00573B38: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00573B92
Part of subcall function 00573B38: SelectObject.GDI32(?,00000000), ref: 00573BA1
Part of subcall function 00573B38: BeginPath.GDI32(?), ref: 00573BB8
Part of subcall function 00573B38: SelectObject.GDI32(?,00000000,000000FF,00000000), ref: 00573BE1

MoveToEx.GDI32(?,00000001,?,00000000,?,00000000,000000FE,00000000,00000001,00000000,?,?), ref: 005B81D0
AngleArc.GDI32(?,00000001,?,?), ref: 005B81FD
LineTo.GDI32(?,00000001,?), ref: 005B8206
CloseFigure.GDI32(?), ref: 005B820D
Ellipse.GDI32(?,00000001,?,?,00000000,?,?,?,00000000,?,?,?,?,00000000,000000FE,00000000), ref: 005B8278
Rectangle.GDI32(?,00000001,?,?,?,?,00000000,000000FE,00000000,00000001,00000000,?,?), ref: 005B82DD

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ObjectSelect$AngleBeginCloseCreateEllipseFigureLineMovePathRectangle
String ID:
API String ID: 3473974417-0
Opcode ID: b09de411d11c78c10c842c6d7f9767ec1da80ff914f5975eb889256acd234368
Instruction ID: 7d7e55483a2131900405774ce711b59384ceb10f855f618f5f06c9ef47f0e9c5
Opcode Fuzzy Hash: b09de411d11c78c10c842c6d7f9767ec1da80ff914f5975eb889256acd234368
Instruction Fuzzy Hash: E8915A71D0021AAFCB10CFA9CC88AEEBFB8FF49320F148555E519B7251D774AA41EB60

Function 005E57AD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 005C10AB: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?,?,?,005C13FD), ref: 005C10C8
Part of subcall function 005C10AB: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?,?), ref: 005C10E3
Part of subcall function 005C10AB: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?,?), ref: 005C10F1
Part of subcall function 005C10AB: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?), ref: 005C1101

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 005E5851
_wcslen.LIBCMT ref: 005E5959
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 005E59D1
CoTaskMemFree.OLE32(?), ref: 005E59DC

Strings

NULL Pointer assignment, xrefs: 005E5A29, 005E5A58

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: ccfa12b3d99037b6044847cfbc8b863bafdbbeca6e40c0ea594f3a731efb4b29
Instruction ID: d8a4b2114152a6487fce3194fe6d96a07b3dbac28bfd5fc3c0a138960e3c9634
Opcode Fuzzy Hash: ccfa12b3d99037b6044847cfbc8b863bafdbbeca6e40c0ea594f3a731efb4b29
Instruction Fuzzy Hash: BF914471D00219EFDF14DFA5D884EEEBBB9BF48314F10456AE859A7241EB309A44CFA0

Function 005E44DE Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

#8.OLEAUT32(?), ref: 005E44FE
CharUpperBuffW.USER32(?,?), ref: 005E460B
_wcslen.LIBCMT ref: 005E4616
#9.WSOCK32(?,00000001,00000000,Incorrect Parameter format,00000000), ref: 005E4790

Part of subcall function 005D1ABE: #8.OLEAUT32(00000000,?,?,?,?,?,005E56FC,?,?), ref: 005D1AFE
Part of subcall function 005D1ABE: #10.WSOCK32(?,?,?,005E56FC,?,?), ref: 005D1B07
Part of subcall function 005D1ABE: #9.WSOCK32(?,?,005E56FC,?,?), ref: 005D1B13

Strings

AUTOIT.ERROR, xrefs: 005E4611, 005E4622
Incorrect Parameter format, xrefs: 005E4540, 005E470C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 157775604-1221869570
Opcode ID: a4d75be5ad83b43d31ba0de932635da1c50173edd266ab75e1c734d4651506b2
Instruction ID: d8e030a53c928997c887c0989dfbd054428e0035a81eb7be0156ad1ff4a9d566
Opcode Fuzzy Hash: a4d75be5ad83b43d31ba0de932635da1c50173edd266ab75e1c734d4651506b2
Instruction Fuzzy Hash: C5819B71A04242AFCB14DF24C484A6ABFE5BF89314F04496DF88A9B352DB31ED46CB91

Function 005F885A Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 005F88F4
IsWindowEnabled.USER32(?), ref: 005F8900
SendMessageW.USER32(00000000,0000041C,00000000,00000000,?,?,?,?,?,00000000), ref: 005F89E4
SendMessageW.USER32(?,000000B0,?,?), ref: 005F8A1B
IsDlgButtonChecked.USER32(?,?,?,?), ref: 005F8A58
GetWindowLongW.USER32(?,000000EC,?,?,?), ref: 005F8A7A
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 005F8A92

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 9e85d64df30338d969bbbdae84514d936722faf19359884f57d3c2ba38eb8a82
Instruction ID: 3d96e44d44ed91185e9f9b6dedb0b92f479285e006c7984d7d3ed95f83901fa3
Opcode Fuzzy Hash: 9e85d64df30338d969bbbdae84514d936722faf19359884f57d3c2ba38eb8a82
Instruction Fuzzy Hash: 3C71D13460020AAFDB209F64C894FBABFBAFF49340F144459EA4993251CB79AC54DB51

Function 005F2A1F Relevance: 10.7, APIs: 7, Instructions: 197windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005F3353: IsWindow.USER32(00000000,?,000CB88A,00000000,?,005AA532,00000001), ref: 005F3384

GetMenu.USER32(?,00000001,?,00000000), ref: 005F2AA5
GetMenuItemCount.USER32(00000000), ref: 005F2AD7
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 005F2AFF
_wcslen.LIBCMT ref: 005F2B35
GetMenuItemID.USER32(?,?), ref: 005F2B6F
GetSubMenu.USER32(?,?), ref: 005F2B7D

Part of subcall function 005C3E94: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?,?,?,?,?,005C368B), ref: 005C3EB2
Part of subcall function 005C3E94: GetWindowThreadProcessId.USER32(?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3EC3
Part of subcall function 005C3E94: GetCurrentThreadId.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ECA
Part of subcall function 005C3E94: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ED1

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 005F2C05

Part of subcall function 005CF7F5: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF86D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Menu$Thread$ItemMessageWindow$AttachCountCurrentInputPostProcessSendSleepStringTimeout_wcslen
String ID:
API String ID: 948020913-0
Opcode ID: 8612279c60a42eae4c078c49f672db029a41281ed6d6f86e999df75f90146250
Instruction ID: a35c85ca56d7c9397b9939a18df0f2a9471c4ea03dcc6fcce5e780bf921301e8
Opcode Fuzzy Hash: 8612279c60a42eae4c078c49f672db029a41281ed6d6f86e999df75f90146250
Instruction Fuzzy Hash: 27716175A0020AAFCB14EF64C845ABEBBF5FF88310F148459E956EB351DB78AD41CB90

Function 005CF252 Relevance: 10.7, APIs: 7, Instructions: 177filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005CEC33: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005CDCD6,?), ref: 005CEC50

Part of subcall function 005CEC33: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005CDCD6,?), ref: 005CEC69

GetFileAttributesW.KERNEL32(?), ref: 005CF29C
GetFileAttributesW.KERNEL32(?), ref: 005CF2B7
lstrcmpiW.KERNEL32(?,?), ref: 005CF2E6
MoveFileW.KERNEL32(?,?), ref: 005CF31B
_wcslen.LIBCMT ref: 005CF454
_wcslen.LIBCMT ref: 005CF46C
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 005CF4B9

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: File$AttributesFullNamePath_wcslen$MoveOperationlstrcmpi
String ID:
API String ID: 4252263244-0
Opcode ID: a7b7426b6821a62f7ebbc6bdebff3855a2fdd62aa660b6b22f75a29587fad18f
Instruction ID: 6bd0b9bc878b7f4ccc4762718f54a8b3f7e453ec175593060447757f4ae8cf3a
Opcode Fuzzy Hash: a7b7426b6821a62f7ebbc6bdebff3855a2fdd62aa660b6b22f75a29587fad18f
Instruction Fuzzy Hash: 0B5161B24083859FC724EBA4D885EDF7BEDBF84314F40092EB589D3191EF74A5888766

Function 005CBD03 Relevance: 10.7, APIs: 7, Instructions: 163windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?,?,?,00000011), ref: 005CBD42
GetKeyboardState.USER32(?), ref: 005CBD57
SetKeyboardState.USER32(?), ref: 005CBDB8
PostMessageW.USER32(?,00000101,00000010,?), ref: 005CBDE6
PostMessageW.USER32(?,00000101,00000011,?), ref: 005CBE05
PostMessageW.USER32(?,00000101,00000012,?), ref: 005CBE46
PostMessageW.USER32(?,00000101,0000005B,?), ref: 005CBE69

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8d116164795aac63759d14974f84aa1107d597911ba140d285c6561fe9140868
Instruction ID: c4cccb700d998997bbb32242dda3cac9c98920438d1fe3cd9ae97ddcfb76622b
Opcode Fuzzy Hash: 8d116164795aac63759d14974f84aa1107d597911ba140d285c6561fe9140868
Instruction Fuzzy Hash: BD51D4A0A047D63DFB3642B4CC4AFBA7EA97B06704F08898DE1D5558D2C3D9ACC8D751

Function 005CBB21 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000,00000000,00000000), ref: 005CBB60
GetKeyboardState.USER32(?), ref: 005CBB75
SetKeyboardState.USER32(?), ref: 005CBBD6
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 005CBC02
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 005CBC1F
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 005CBC5E
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 005CBC7F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d9b3ce4e707a669f2cc9ac9ff5ae1b9b70fe77ad1cd1ffdc51643751d2ecdae1
Instruction ID: ec572d31d1021eb6daa01ed602e12e1d4493a9256bc5902476f97b82ee4a3fdc
Opcode Fuzzy Hash: d9b3ce4e707a669f2cc9ac9ff5ae1b9b70fe77ad1cd1ffdc51643751d2ecdae1
Instruction Fuzzy Hash: 575108A09047D63EFB3687B48C4AF7A7FA97F06304F08458DE0D9564C2C795AD88E751

Function 0059525C Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,005959D1,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0059529E
__fassign.LIBCMT ref: 00595319
__fassign.LIBCMT ref: 00595334
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0059535A
WriteFile.KERNEL32(?,FF8BC35D,00000000,005959D1,00000000,?,?,?,?,?,?,?,?,?,005959D1,?), ref: 00595379
WriteFile.KERNEL32(?,?,00000001,005959D1,00000000,?,?,?,?,?,?,?,?,?,005959D1,?), ref: 005953B2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b5a5773611f3ff9e53f9e553a7e50a4ee1b78b851cf912f8db397428e0dc397d
Instruction ID: bd4c3a1d86a648f6ddc06f254860a829f003fe51a6dadb51a11a7b8295601baa
Opcode Fuzzy Hash: b5a5773611f3ff9e53f9e553a7e50a4ee1b78b851cf912f8db397428e0dc397d
Instruction Fuzzy Hash: 8851B070A00649AFDF11CFA8D845AEEBBF9FF09300F14451AF955E7291E7709A51CB60

Function 00583F60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00583F8B
___except_validate_context_record.LIBVCRUNTIME ref: 00583F93
__IsNonwritableInCurrentImage.LIBCMT ref: 00584007

Part of subcall function 005A1A40: __FindPESection.LIBCMT ref: 005A1A99

_ValidateLocalCookies.LIBCMT ref: 0058407C
_ValidateLocalCookies.LIBCMT ref: 005840A7

Strings

csm, xrefs: 00583FF1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentFindImageNonwritableSection___except_validate_context_record
String ID: csm
API String ID: 138943561-1018135373
Opcode ID: 278fcc23851e7d9ab98c7498d45c8828bc4e61ff336bd9b0e0866de86d48c97d
Instruction ID: 9228f85c654d17558e59d5a7e40978434a04d4db55ca6f11d01e1fa864abfbfa
Opcode Fuzzy Hash: 278fcc23851e7d9ab98c7498d45c8828bc4e61ff336bd9b0e0866de86d48c97d
Instruction Fuzzy Hash: 89416E30A0021ADBCF10EF69C849A9E7FA5BF45318F148155EE14BF292D736AA15CF90

Function 005E1C8A Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 005E3B94: #10.WSOCK32(?,?,?,?,?,00000000), ref: 005E3BC5
Part of subcall function 005E3B94: _wcslen.LIBCMT ref: 005E3BE4
Part of subcall function 005E3B94: #9.WSOCK32(00000000,?,?,00000000), ref: 005E3C2D

#23.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 005E1CE4
#111.WSOCK32 ref: 005E1CF3
#111.WSOCK32 ref: 005E1D9D
#3.WSOCK32(00000000), ref: 005E1DCD

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: #111$_wcslen
String ID:
API String ID: 2838908337-0
Opcode ID: 1f0405546023834d494479538bed0a8d081daa606e70aba10b1020d6535ad3f6
Instruction ID: 32cd5b59b2df81d1c89ac68fe9b3029eeb7a484a603afc42413bfc5e530e5c71
Opcode Fuzzy Hash: 1f0405546023834d494479538bed0a8d081daa606e70aba10b1020d6535ad3f6
Instruction Fuzzy Hash: ED410331600608AFDB14DF15CC88BB9BFA9FF44320F148058FC899B291CB75AE49CBA5

Function 005F377B Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000,?,?,?,005F72F4,?,?,?,?,?), ref: 005F379A
GetWindowLongW.USER32(?,000000F0,?,?,?,005F72F4,?,?,?,?,?), ref: 005F37CD
GetWindowLongW.USER32(?,000000F0,00000000,?,?,?,005F72F4,?,?,?,?,?), ref: 005F3802
SendMessageW.USER32(?,000000F1,00000000,00000000,00000000,?,?,?,005F72F4,?,?,?,?,?), ref: 005F3834
SendMessageW.USER32(?,000000F1,00000001,00000000,?,?,?,005F72F4,?,?,?,?), ref: 005F385E
GetWindowLongW.USER32(?,000000F0,?,?,?,005F72F4,?,?,?,?), ref: 005F386F
SetWindowLongW.USER32(?,000000F0,00000000,?,?,?,005F72F4,?,?,?,?), ref: 005F3889

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 1f17ef2476cdf40535bc46e97138c95399e3894467a5d8089948d8fa31889499
Instruction ID: a6afc2e3bf4b4b9f71775f09f2a871d3cf1cbd32b5b63ba6976ec731013d9bad
Opcode Fuzzy Hash: 1f17ef2476cdf40535bc46e97138c95399e3894467a5d8089948d8fa31889499
Instruction Fuzzy Hash: F7316474606149AFEB20DF09DC85F353BA2FB4A750F154164F600CB2B2CB39AA44DB90

Function 005C85E6 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C8629
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C864F
#2.WSOCK32(00000000), ref: 005C8652
#2.WSOCK32(?), ref: 005C8670
#6.OLEAUT32(?), ref: 005C8679
StringFromGUID2.OLE32(?,?,00000028), ref: 005C869E
#2.WSOCK32(?), ref: 005C86AC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide$FromString
String ID:
API String ID: 1211328463-0
Opcode ID: 9a73c9c3daf28c44bd884951cd0043ee1dd11a7183c563c0a18356fc43585e45
Instruction ID: 8b99dfef572b4789af76b271d2c9462f57486169a82c4260422470f9a9858183
Opcode Fuzzy Hash: 9a73c9c3daf28c44bd884951cd0043ee1dd11a7183c563c0a18356fc43585e45
Instruction Fuzzy Hash: FD21A672604209AF9F10DFA8CC88DBB77ADFB183647048129FD15DB150DA74DC45D764

Function 005C86BF Relevance: 10.6, APIs: 7, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C8704
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005C872A
#2.WSOCK32(00000000), ref: 005C872D
#2.WSOCK32 ref: 005C874E
#6.OLEAUT32 ref: 005C8757
StringFromGUID2.OLE32(?,?,00000028), ref: 005C8771
#2.WSOCK32(?), ref: 005C877F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide$FromString
String ID:
API String ID: 1211328463-0
Opcode ID: 5bfb6e4b8eab6397eac1cf77fe6c0d93adb869c7cc6c5eb4bac558c9be6585ba
Instruction ID: d53348a17cf64740c8809a05324f954957aa2816524650428b05f2aec4644a7d
Opcode Fuzzy Hash: 5bfb6e4b8eab6397eac1cf77fe6c0d93adb869c7cc6c5eb4bac558c9be6585ba
Instruction Fuzzy Hash: B1219035204204AF9F10AFE8CC88EBA7BEDFB193607148129F905DB2A1EB75EC45D760

Function 005D1330 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 005D1350
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005D1383
GetStdHandle.KERNEL32(0000000C), ref: 005D1395
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 005D13CF
CloseHandle.KERNEL32(?), ref: 005D13F3

Strings

nul, xrefs: 005D13CA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Handle$Create$CloseFilePipe
String ID: nul
API String ID: 3408351469-2873401336
Opcode ID: 14d95f6fc85f2b85e2a5a060b1ea037ba04340b9d6ccd0821754a6301ef3a548
Instruction ID: 99183d3c2d700d629ee70399df058dda397cab4a82cdb486a7655b75eb5cf264
Opcode Fuzzy Hash: 14d95f6fc85f2b85e2a5a060b1ea037ba04340b9d6ccd0821754a6301ef3a548
Instruction Fuzzy Hash: E2218E70500706ABDB308F68D805AA9BBF5BF51320F204E1BE9A0D72D0D7709840DB54

Function 005D1405 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005D1424
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005D1456
GetStdHandle.KERNEL32(000000F6), ref: 005D1467
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 005D14A1
CloseHandle.KERNEL32(?), ref: 005D14C5

Strings

nul, xrefs: 005D149C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Handle$Create$CloseFilePipe
String ID: nul
API String ID: 3408351469-2873401336
Opcode ID: 3f8b9b6b87aa5ab73a44a7c632b5f82404942dc48428b32226c5393e24146612
Instruction ID: 78e5c3ec00352a187f496a531a5f47fea6c1ca3d3d54aed01d589d2a3d7063ae
Opcode Fuzzy Hash: 3f8b9b6b87aa5ab73a44a7c632b5f82404942dc48428b32226c5393e24146612
Instruction Fuzzy Hash: D4216075500706ABDF309F6D9804A99BBF9BF55720F200A1BF9A0D33D0D7719850DB65

Function 005F4A66 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00574570: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00574473), ref: 005745AE
Part of subcall function 00574570: GetStockObject.GDI32(00000011,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?,?), ref: 005745C2
Part of subcall function 00574570: SendMessageW.USER32(00000000,00000030,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?), ref: 005745CC

SendMessageW.USER32(00000000,00002001,00000000,FF000000,?,?,?,Msctls_Progress32,00000000,00000000,?,?,?,?,?), ref: 005F4ACB
SendMessageW.USER32(?,00000409,00000000,FF000000,?,?,?,Msctls_Progress32,00000000,00000000,?,?,?,?,?), ref: 005F4AD8
SendMessageW.USER32(?,00000402,00000000,00000000,?,?,?,Msctls_Progress32,00000000,00000000,?,?,?,?,?), ref: 005F4AE3
SendMessageW.USER32(?,00000401,00000000,00640000,?,?,?,Msctls_Progress32,00000000,00000000,?,?,?,?,?), ref: 005F4AF2
SendMessageW.USER32(?,00000404,00000001,00000000,?,?,?,Msctls_Progress32,00000000,00000000,?,?,?,?,?), ref: 005F4AFE

Strings

Msctls_Progress32, xrefs: 005F4A9C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 09418c8c41dc36137b5b0ed90b8aac003206624b370d5a9ff2663241da319263
Instruction ID: 99ea9cbbe1252340ffa46338d674984b1a3a70e42abd8505b7ced9e59327d70b
Opcode Fuzzy Hash: 09418c8c41dc36137b5b0ed90b8aac003206624b370d5a9ff2663241da319263
Instruction Fuzzy Hash: 2D1151B124021EBEEF115E64DC85EF77FADFF48798F018111B648A6050C7759C219BA4

Function 0059D60F Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0059D5D3: _free.LIBCMT ref: 0059D5FC

_free.LIBCMT ref: 0059D65D

Part of subcall function 005927F4: HeapFree.KERNEL32(00000000,00000000,?,0056FC79,?,?,0056111E), ref: 0059280A

_free.LIBCMT ref: 0059D668
_free.LIBCMT ref: 0059D673
_free.LIBCMT ref: 0059D6C7
_free.LIBCMT ref: 0059D6D2
_free.LIBCMT ref: 0059D6DD
_free.LIBCMT ref: 0059D6E8

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: acd2ea49cf299b89b64f17ab4c84d32e9c7a8468b9dcd93b7b969ff5bf17de5c
Instruction ID: 845c247ed3fc0bb5225db48d17363e3a9269eb9d79becc4094d486bde3096862
Opcode Fuzzy Hash: acd2ea49cf299b89b64f17ab4c84d32e9c7a8468b9dcd93b7b969ff5bf17de5c
Instruction Fuzzy Hash: 7211F971544B06BAEE20BBF1CC4AFCB7FACBF84704F414815B2A9A6052DE65A5099760

Function 005CE854 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 005CE86E
LoadStringW.USER32(00000000), ref: 005CE875
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 005CE88B
LoadStringW.USER32(00000000), ref: 005CE892
MessageBoxW.USER32(00000000,?,?,00011010), ref: 005CE8D6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 005CE8B3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: e43b3c4c1ae0a222601e99f9c8a0131f0242609f325ede71912d20e037d43260
Instruction ID: 3723edb2c2e52f6804accd12db5141db72744a21830aa93e90b6d213dad77215
Opcode Fuzzy Hash: e43b3c4c1ae0a222601e99f9c8a0131f0242609f325ede71912d20e037d43260
Instruction Fuzzy Hash: F90162F69002087FE710E7D09D89EF7777CEB08300F0005A5BB49E2041EA785E888B71

Function 0057FBB7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001,00633370,00572E27), ref: 0057FBE5
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0057FC06
ShowWindow.USER32(00000000), ref: 0057FC1A
ShowWindow.USER32(00000000), ref: 0057FC23

Strings

AutoIt v3, xrefs: 0057FBDD, 0057FBE2, 0057FBE3
edit, xrefs: 0057FC00

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 51ffbccf9c5585b0758a005b3816397b1148e3b725117f900b3f99bcb17b0fca
Instruction ID: 624e8222dd8e905b823d08d979dd07e22c83c3634879480cb72aab49c69f744e
Opcode Fuzzy Hash: 51ffbccf9c5585b0758a005b3816397b1148e3b725117f900b3f99bcb17b0fca
Instruction Fuzzy Hash: D1F0DA719402957AFB3127176C58E373FBEEBDAF50B00106EBA04A61B0C56A1851DAF0

Function 005D17B9 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00000034,00000034,00000000,?,005AA8BC,?,?,0056ABE9,?,?), ref: 005D17C9
EnterCriticalSection.KERNEL32(00000014,?), ref: 005D17DB
TerminateThread.KERNEL32(?,000001F6), ref: 005D17E9
WaitForSingleObject.KERNEL32(?,000003E8), ref: 005D17F7
CloseHandle.KERNEL32(?), ref: 005D1806
InterlockedExchange.KERNEL32(00000034,000001F6), ref: 005D1816
LeaveCriticalSection.KERNEL32(00000014), ref: 005D181D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 7d50bb87f29f536e19b72c68dfe626e21d6556a9c250f5207dad86f71b2c3e65
Instruction ID: 280859a649176c9911341b5c39d753cad4d084d41bbe1e0abced01fff68980f2
Opcode Fuzzy Hash: 7d50bb87f29f536e19b72c68dfe626e21d6556a9c250f5207dad86f71b2c3e65
Instruction Fuzzy Hash: EFF04F32151A02FBD3565F68ED4CBEABB3AFF14702F401122F201D58B08779A478EBA4

Function 005E283C Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

APIs

#151.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 005E299C
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 005E29BD
#111.WSOCK32 ref: 005E29CE
#15.WSOCK32(?), ref: 005E2AB7
#11.WSOCK32(?), ref: 005E2A68

Part of subcall function 005C4A80: _strlen.LIBCMT ref: 005C4A8A

Part of subcall function 005E3D76: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,005DF771), ref: 005E3D92

_strlen.LIBCMT ref: 005E2B11

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _strlen$#111#151ByteCharMultiWide
String ID:
API String ID: 3392548154-0
Opcode ID: f7e97ba833e3b273ca17b13b89568d5f69a9aea7f5052db4300aefcb48e3268b
Instruction ID: b3117aca27aa45fbe50a0f9c392c7e57b344fe7c3234707648dd99bdc59f6044
Opcode Fuzzy Hash: f7e97ba833e3b273ca17b13b89568d5f69a9aea7f5052db4300aefcb48e3268b
Instruction Fuzzy Hash: 78B1F231604341AFC728DF25C899E2A7FA9BF84314F54895CF49A8F2A2DB31ED45CB91

Function 005745EE Relevance: 9.3, APIs: 6, Instructions: 277COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00574614
GetWindowRect.USER32(?,?), ref: 00574655
ScreenToClient.USER32(?,?), ref: 0057467D
GetClientRect.USER32(?,?), ref: 005747BD
GetWindowRect.USER32(?,?), ref: 005747DE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 47f2864531f6ba9f49e9f779bc2b90494ebccee178762d45640d0799b2ef663d
Instruction ID: e70241a79b192f100b44e0a538ac5708b76a06a649d1ce866d1002edd2dffbc6
Opcode Fuzzy Hash: 47f2864531f6ba9f49e9f779bc2b90494ebccee178762d45640d0799b2ef663d
Instruction Fuzzy Hash: BCB16878A0064ADBDB14CFA8C4406FEBBF5FF58310F24991AE8A9D7250DB34A951EF50

Function 0058FFD6 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0058FED9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0058FEF5
__allrem.LIBCMT ref: 0058FF0C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0058FF2A
__allrem.LIBCMT ref: 0058FF41
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0058FF5F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 2b4cc460486545c1ca38040b2c02df6d169d0970c99fa1199ea289bb234a2fe8
Instruction ID: 3295f9e6da18162c9ae95f8f4a9296eee9160cda1607eec2a3ef8c3cd84d8ece
Opcode Fuzzy Hash: 2b4cc460486545c1ca38040b2c02df6d169d0970c99fa1199ea289bb234a2fe8
Instruction Fuzzy Hash: 2F812D71A007079FEB24BE38DC46B6A7BE9BF89324F14453AFA11E66C2E770D9408750

Function 0059602C Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00588204,00588204,?,?,?,0059627D,00000001,00000001,71E85006), ref: 00596086
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0059627D,00000001,00000001,71E85006,?,?,?), ref: 0059610C
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,71E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00596206
__freea.LIBCMT ref: 00596213

Part of subcall function 0059282E: HeapAlloc.KERNEL32(00000000,?,00000001,?,00580445,?,?,0056FA72,00000000,?,?,?,00561188,?), ref: 00592860

__freea.LIBCMT ref: 0059621C
__freea.LIBCMT ref: 00596241

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID:
API String ID: 3147120248-0
Opcode ID: 52d0380e938ea4a0b9ec700cbd5ec7c93d95f9825e821cfa18fd93709028f0c0
Instruction ID: 2c32720e42e05d9f9a062e49d1274c7b1ee56ad13613e484ca625db6b1c41cda
Opcode Fuzzy Hash: 52d0380e938ea4a0b9ec700cbd5ec7c93d95f9825e821cfa18fd93709028f0c0
Instruction Fuzzy Hash: AF51DF72A00216AEDF258F64CD89EBF7FAAFB80750F154628FC04D6180EB34DC58D6A0

Function 005C0851 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

#8.OLEAUT32(005E5FF9,?,?,?,?,?,005C0B20,005E5FF9,?,?,?,?,005E5FF9,?), ref: 005C085D
#2.WSOCK32(00000001,?,?,?,005E5FF9,?), ref: 005C0904
#10.WSOCK32(005C0B20), ref: 005C092D
#9.WSOCK32(005C0B20), ref: 005C0951
#10.WSOCK32(005C0B20,00000000), ref: 005C0955
#9.WSOCK32(005E5FE5), ref: 005C095F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afab1495e19726bf99c6e87ff63e4cb1e1ce282f6b5b055822dc30b67ddef8db
Instruction ID: 62e8510d46c272c90663cd784e04bd51a9fc9377a4a15242f4377f0be2ec5656
Opcode Fuzzy Hash: afab1495e19726bf99c6e87ff63e4cb1e1ce282f6b5b055822dc30b67ddef8db
Instruction Fuzzy Hash: 6E51A331600301DEDF24AFA8D899F39BBA5BF95310B20A85EE506CF2D6DA709C44CB65

Function 005EC5DB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005ED398: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EC0AE,?,?), ref: 005ED3B5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED3F5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED456

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EC6CA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005EC725
RegCloseKey.ADVAPI32(00000000), ref: 005EC76A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 005EC799
RegCloseKey.ADVAPI32(?,?,00000000), ref: 005EC7F3
RegCloseKey.ADVAPI32(?), ref: 005EC7FF

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Close_wcslen$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 2057806628-0
Opcode ID: 648c990ac62ff421e8bef5ed689fab671e600fe1cbbe377358c22726ebae2c24
Instruction ID: d0287856e167c5b8f5ee25568a4a4066d483b090dca23b23bad25559ebfcfb59
Opcode Fuzzy Hash: 648c990ac62ff421e8bef5ed689fab671e600fe1cbbe377358c22726ebae2c24
Instruction Fuzzy Hash: 8C817071608281AFD714DF24C495E2ABFE5FF84308F14895CF4958B2A2DB31ED46CB91

Function 005D9BF1 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 00572306: _wcslen.LIBCMT ref: 0057230B

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

GetOpenFileNameW.COMDLG32(00000058), ref: 005D9FEF
_wcslen.LIBCMT ref: 005DA010
_wcslen.LIBCMT ref: 005DA045
GetSaveFileNameW.COMDLG32(00000058), ref: 005DA0CA

Strings

X, xrefs: 005D9F11

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 9b7a6c605dcdfbe0943ef53a868c4c4a9eb987a5a87490a6b09ad5faf9a2b0cd
Instruction ID: 598a1856468f7ef6009298a5c9062e5581fbe1717b4de991ccaa250731b64524
Opcode Fuzzy Hash: 9b7a6c605dcdfbe0943ef53a868c4c4a9eb987a5a87490a6b09ad5faf9a2b0cd
Instruction Fuzzy Hash: 78F193719043419FD724EF24C485B6ABBE5BF84314F04896EE8999B3A2DB31ED05CB92

Function 00573FE0 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

BeginPaint.USER32(?,?,?,?,?,?), ref: 00574015
GetWindowRect.USER32(?,?), ref: 00574079
ScreenToClient.USER32(?,?), ref: 00574096
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005740A7
EndPaint.USER32(?,?), ref: 005740F5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: d1ac73051cc9a867baa63bae69428cf2ec432da6c26ca04e49ed3d708af4fc26
Instruction ID: 7871a19c0acaa3eefe89c78e750e9b6ee268112811d83ca7f53916f50e9cb750
Opcode Fuzzy Hash: d1ac73051cc9a867baa63bae69428cf2ec432da6c26ca04e49ed3d708af4fc26
Instruction Fuzzy Hash: 5641A130104202AFC710DF15DC88FBA7FE9FB55720F104669FA68CB1A1C775A849EBA2

Function 005F8BA7 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00632890,00000000,00632890,00000000,00000000,00632890,?,005B8EBD,00000000,?,00000000,?,?,005B8E87,00000004,00000000), ref: 005F8C1B
EnableWindow.USER32(?,00000000), ref: 005F8C3F
ShowWindow.USER32(00632890,00000000), ref: 005F8C9F
ShowWindow.USER32(?,00000004), ref: 005F8CB1
EnableWindow.USER32(?,00000001), ref: 005F8CD5
SendMessageW.USER32(?,0000130C,00000000,00000000,00632890,00000000,00000000,00632890,?,005B8EBD,00000000,?,00000000,?,?,005B8E87), ref: 005F8CF8

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3e257a096b2b09f255d9ebca61ea7c0c28e6685cc596992ce643859c03575f13
Instruction ID: 84ecc9f59c1b3ed4f389abc1626b177460bf4df22dd7a4de6e16f23413ea2a15
Opcode Fuzzy Hash: 3e257a096b2b09f255d9ebca61ea7c0c28e6685cc596992ce643859c03575f13
Instruction Fuzzy Hash: BF417231602148AFDB25DF14C889BB57FF1FF09314F1841A9EA598F2A2CB35AC45DB60

Function 005D706A Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 357comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005D70B5
CoInitialize.OLE32(00000000,.lnk), ref: 005D7219
CoCreateInstance.OLE32(00600CAC,00000000,00000001,00600B1C,?), ref: 005D7232
CoUninitialize.OLE32 ref: 005D74D6

Strings

.lnk, xrefs: 005D7093, 005D70F9, 005D71BC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: e7d2de3ad15cbec0d9febc24e8718eea5f0201a7fd2fba489e352b97e5d9de6a
Instruction ID: e3abff795eaf3174a05d65046ad1157af6e1d536a3630123a3bc463febab7e81
Opcode Fuzzy Hash: e7d2de3ad15cbec0d9febc24e8718eea5f0201a7fd2fba489e352b97e5d9de6a
Instruction Fuzzy Hash: DDD159716083069FD310DF54C895E6BBBE8BFC8714F04491EF5858B2A1EB71E94ACB92

Function 00580A12 Relevance: 9.1, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

___scrt_release_startup_lock.LIBCMT ref: 00580AA4
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00580AB8
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00580ADD
___scrt_get_show_window_mode.LIBCMT ref: 00580AEF
___scrt_uninitialize_crt.LIBCMT ref: 00580B20
___scrt_fastfail.LIBCMT ref: 00580B6F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___scrt_fastfail___scrt_get_show_window_mode___scrt_release_startup_lock___scrt_uninitialize_crt
String ID:
API String ID: 4079798206-0
Opcode ID: fc129c5dce0d90e3453b3c0428cc5a50b88e22ced9794da5840f9c93f28e99c7
Instruction ID: eef3b8582d856e033e78c08e5a14668cccbf502bf7ea1615017023fc929c798a
Opcode Fuzzy Hash: fc129c5dce0d90e3453b3c0428cc5a50b88e22ced9794da5840f9c93f28e99c7
Instruction Fuzzy Hash: 60215131685347AADF6477B49C0BBBD2F66BFC2326F202019FC803B1C3CA6148498764

Function 005D164F Relevance: 9.1, APIs: 6, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 005D1666
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 005D169D
EnterCriticalSection.KERNEL32(?), ref: 005D16B9
LeaveCriticalSection.KERNEL32(?), ref: 005D1733
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 005D1748
InterlockedExchange.KERNEL32(?,000001F6), ref: 005D1767

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: aa59af1f2b0d886f30afe2114ff6a93149e17bde2936f9185bc21bd16aa3ba5d
Instruction ID: 40509985f54018e7e800d71301f487938301aa6419004d869761ad5bbe4a87c0
Opcode Fuzzy Hash: aa59af1f2b0d886f30afe2114ff6a93149e17bde2936f9185bc21bd16aa3ba5d
Instruction Fuzzy Hash: 26318231900605EBDF10EF54DC89A6E7B79FF84710B1481A6ED04EB296DB30DA15DBA4

Function 005C5C3A Relevance: 9.1, APIs: 6, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?,?,?,?,?), ref: 005C5C52
SendMessageW.USER32(?,0000000E,00000000,00000000,?,?,?,?), ref: 005C5C6F
SendMessageW.USER32(?,0000000D,00000001,00000000,?,?,?,?), ref: 005C5CA7
_wcslen.LIBCMT ref: 005C5CC5
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 005C5CCD
_wcsstr.LIBVCRUNTIME ref: 005C5CD7

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: fb1ff879a411aff926ac293979bbd3895633c1363e6a045bed29facb3c1f7adc
Instruction ID: e257e73dc9cfc0af8749177537b6ed6cb13149fea2a01dd1bdb74209ffde59d5
Opcode Fuzzy Hash: fb1ff879a411aff926ac293979bbd3895633c1363e6a045bed29facb3c1f7adc
Instruction Fuzzy Hash: 572125722046007FEB155BA99C49F7B7FA9EF84750F00802EFC09DA191FA65EC8492A0

Function 005F864E Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

GetWindowLongW.USER32(?,000000F0,?,?,?,?,005DC28E,00000000,?,00000000), ref: 005F8695
SetWindowLongW.USER32(00000000,000000F0,?,?,?,?,?,005DC28E,00000000,?,00000000), ref: 005F86BA
SetWindowLongW.USER32(00000000,000000EC,000000FF,?,?,?,?,005DC28E,00000000,?,00000000), ref: 005F86D2
GetSystemMetrics.USER32(00000004,?,?,?,?,?,?,?,005DC28E,00000000,?,00000000), ref: 005F86FF
GetSystemMetrics.USER32(00000004,?,?,?,?,?,?,?,005DC28E,00000000,?,00000000), ref: 005F870A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,005DC28E,00000000), ref: 005F871F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: d8f4208ae9b8533250e1fbc8c19355e7b70ba0ea6ff56a64ee4374cec016a1d2
Instruction ID: 98ffea1cf4b0a2d838972e0a6cb9ce3d70136ba1ecb7e5648e2d7d575a194388
Opcode Fuzzy Hash: d8f4208ae9b8533250e1fbc8c19355e7b70ba0ea6ff56a64ee4374cec016a1d2
Instruction Fuzzy Hash: EB21863161024AAFCF149F39DC08B7A3BA5FB55365F204629FA26C31E0DF799854DB50

Function 005D63E8 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328comCOMMON

Download Yara Rule

APIs

Part of subcall function 0056119F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00561192,?), ref: 005611BF

_wcslen.LIBCMT ref: 005D6441
CoInitialize.OLE32(00000000,.lnk), ref: 005D6561
CoCreateInstance.OLE32(00600CAC,00000000,00000001,00600B1C,?), ref: 005D657A
CoUninitialize.OLE32 ref: 005D659B

Strings

.lnk, xrefs: 005D6438, 005D6485, 005D6551

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: d1d77f956fabf9a0016db88d7a9cf47dcfca722b8062a73a869cdbed0443ba1f
Instruction ID: 917f34eefaa70023f06266a3f43ffcfa44c7783b84db3ba6d4f0ff2cc2282fb6
Opcode Fuzzy Hash: d1d77f956fabf9a0016db88d7a9cf47dcfca722b8062a73a869cdbed0443ba1f
Instruction Fuzzy Hash: ECD136756043019FC724DF18C484A2ABBE5FF88714F14895EF8999B361CB32ED46CB92

Function 005C2875 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C20BE: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005C20D4
Part of subcall function 005C20BE: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005C20E0
Part of subcall function 005C20BE: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005C20EF
Part of subcall function 005C20BE: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005C20F6
Part of subcall function 005C20BE: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005C210C

GetLengthSid.ADVAPI32(?,00000000,005C2443), ref: 005C28C6
GetProcessHeap.KERNEL32(00000008,00000000), ref: 005C28D2
HeapAlloc.KERNEL32(00000000), ref: 005C28D9
CopySid.ADVAPI32(00000000,00000000,?), ref: 005C28F2
GetProcessHeap.KERNEL32(00000000,00000000,005C2443), ref: 005C2906
HeapFree.KERNEL32(00000000), ref: 005C290D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: e16ae3a96dad5140929755031d820c070212d138f573dbddcc6b2cc6f212e3fb
Instruction ID: dd9e4338c3d8ea05476ae5a5d7d9762c2b2ae6c81aa65fd465e43a5a9fd8b074
Opcode Fuzzy Hash: e16ae3a96dad5140929755031d820c070212d138f573dbddcc6b2cc6f212e3fb
Instruction Fuzzy Hash: 6A118676600305BFDB209BA4CC09FBE7BBAFB55311F10441DE841E7221DB3AA945EB60

Function 005C25DE Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005C260F
OpenProcessToken.ADVAPI32(00000000), ref: 005C2616
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 005C2625
CloseHandle.KERNEL32(00000004), ref: 005C2630
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005C265F
DestroyEnvironmentBlock.USERENV(00000000), ref: 005C2673

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: a3ab36754014f9808fc6e5ec52f7640aa82e4fff0408e80bde9855e5158d52eb
Instruction ID: 3ba84acfc7c86999a08eaf722a659051f7c1e63a867f266ceea51bef16164ba0
Opcode Fuzzy Hash: a3ab36754014f9808fc6e5ec52f7640aa82e4fff0408e80bde9855e5158d52eb
Instruction Fuzzy Hash: 4111477250120DAFDB018FA4ED49FEA7BBAFF08304F044018FE04A60A0D7768E65EB61

Function 00592C4B Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0058490E,?,00000002,?,005854B1,0058621F), ref: 00592C4F
_free.LIBCMT ref: 00592C82
_free.LIBCMT ref: 00592CAA
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,0058621F,00000000), ref: 00592CB7
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,0058621F,00000000), ref: 00592CC3
_abort.LIBCMT ref: 00592CC9

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 82e800f2626ae5e396fc64dd416cf1b8f979dd3989d52864d4fc30d330c9a21b
Instruction ID: effb3600657fadd526aa9d4fcfb7fcff9ea9c1710a3ecbf7a76be197119f82fa
Opcode Fuzzy Hash: 82e800f2626ae5e396fc64dd416cf1b8f979dd3989d52864d4fc30d330c9a21b
Instruction Fuzzy Hash: 8BF0A436604602B7CF2177286D0EF6E2D6ABFD1761F354514F914E21A1EE258C069171

Function 005C61D2 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000,?,?,?,80004003), ref: 005C61F7
GetDeviceCaps.GDI32(00000000,00000058,?,?,80004003), ref: 005C6208
GetDeviceCaps.GDI32(00000000,0000005A,?,?,80004003), ref: 005C620F
ReleaseDC.USER32(00000000,00000000,?,?,80004003), ref: 005C6217
MulDiv.KERNEL32(000009EC,?,00000000,?,?,80004003), ref: 005C622E
MulDiv.KERNEL32(000009EC,00000001,?,?,?,80004003), ref: 005C6240

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 07e5325e0067ac1bbd5652fff2db80254166492919895a495f7eb9138c213a6d
Instruction ID: acda23a4cdb0cc537c9d6d87710f935d67e2c12c5f7ad165247dadb375812f91
Opcode Fuzzy Hash: 07e5325e0067ac1bbd5652fff2db80254166492919895a495f7eb9138c213a6d
Instruction Fuzzy Hash: FF017175A00308BBEF109BE69C49F5EBFB9EB58351F044066FA08E7281DA30D914CFA0

Function 005F940F Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00573B38: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00573B92
Part of subcall function 00573B38: SelectObject.GDI32(?,00000000), ref: 00573BA1
Part of subcall function 00573B38: BeginPath.GDI32(?), ref: 00573BB8
Part of subcall function 00573B38: SelectObject.GDI32(?,00000000,000000FF,00000000), ref: 00573BE1

MoveToEx.GDI32(?,-00000002,00000000,00000000,?,00000000,000000FF,00000000,00000001,?,?,?,005F933B,?,?), ref: 005F9439
LineTo.GDI32(?,00000003,00000000,?,005F933B,?,?), ref: 005F944D
MoveToEx.GDI32(?,00000000,-00000002,00000000,?,005F933B,?,?), ref: 005F945B
LineTo.GDI32(?,00000000,00000003,?,005F933B,?,?), ref: 005F946B
EndPath.GDI32(?,?,?), ref: 005F947B
StrokePath.GDI32(?,?,?), ref: 005F948B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 7eef8a1c775ec4108a875ccfa45389c84860ea4b2229009168dee2950e20fa65
Instruction ID: 96dec95468f13ac3b0728417881aca613c9616606ce0207d24aca582ac88b75e
Opcode Fuzzy Hash: 7eef8a1c775ec4108a875ccfa45389c84860ea4b2229009168dee2950e20fa65
Instruction Fuzzy Hash: A611097200010DBFDF129F90DC88FAA7F6EEB18364F008011BA199A1A0D7759D5AEBA0

Function 0057F9FB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000,?,?,?,00569291), ref: 0057FA2C
MapVirtualKeyW.USER32(00000010,00000000,?,?,?,00569291), ref: 0057FA34
MapVirtualKeyW.USER32(000000A0,00000000,?,?,?,00569291), ref: 0057FA3F
MapVirtualKeyW.USER32(000000A1,00000000,?,?,?,00569291), ref: 0057FA4A
MapVirtualKeyW.USER32(00000011,00000000,?,?,?,00569291), ref: 0057FA52
MapVirtualKeyW.USER32(00000012,00000000,?,?,?,00569291), ref: 0057FA5A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 41ddf0bbc329c776d63c0086d13244c744722548456729d18057cf60e85d94d8
Instruction ID: 75e8562d435ae93e70bfa702d995d3858d1dc048b406ac0ffdaee702f8815064
Opcode Fuzzy Hash: 41ddf0bbc329c776d63c0086d13244c744722548456729d18057cf60e85d94d8
Instruction Fuzzy Hash: D1016CB09017597DE3008F5A8C85B52FFB8FF19354F00411B915C8B941C7F5A864CBE5

Function 005CF9A0 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005CF9B0
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CF9C6
GetWindowThreadProcessId.USER32(?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CF9D5
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CF9E4
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CF9EE
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005CF9F5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a46daa819cbdca4e025dc285ea7a091ad0916958da664d7b41c04516a96afa70
Instruction ID: fc0e5730ef47d8947e1d466096ec72c3d9204095a0b256275470794e37092625
Opcode Fuzzy Hash: a46daa819cbdca4e025dc285ea7a091ad0916958da664d7b41c04516a96afa70
Instruction Fuzzy Hash: 5FF06D32241158BBE7205B929C0EEFF3A7DEB9AB11F000159FA04D209097A52A05E6B5

Function 005B89E2 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 005B89FB
SendMessageW.USER32(?,00001328,00000000,?), ref: 005B8A12
GetWindowDC.USER32(?), ref: 005B8A1E
GetPixel.GDI32(00000000,?,?), ref: 005B8A2D
ReleaseDC.USER32(?,00000000), ref: 005B8A3F
GetSysColor.USER32(00000005), ref: 005B8A59

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: f5f65bf2e068371efaf4b22567cd82019f98d703cd90b56f56fa2c929c1facb4
Instruction ID: 006592ce8e08d08eb041c74732b7c40bd565e6523b06f416ff2df1ef74846e33
Opcode Fuzzy Hash: f5f65bf2e068371efaf4b22567cd82019f98d703cd90b56f56fa2c929c1facb4
Instruction Fuzzy Hash: 7E015631400205EFDB109BA0DC08BFA7FB6FB14321F150561FA19E61A1CB352E99EB21

Function 005C298E Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 005C2999
UnloadUserProfile.USERENV(?,?), ref: 005C29A5
CloseHandle.KERNEL32(?), ref: 005C29AE
CloseHandle.KERNEL32(?), ref: 005C29B6
GetProcessHeap.KERNEL32(00000000,?), ref: 005C29BF
HeapFree.KERNEL32(00000000), ref: 005C29C6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: e420a33a3f2f04f1670a6f6da11cc0470fab6adc509a2162ed6de2dfe27960d7
Instruction ID: b1daf91218f7053e8605221979f6aa5b42dbe989fe47bde56a6f690b53af5e05
Opcode Fuzzy Hash: e420a33a3f2f04f1670a6f6da11cc0470fab6adc509a2162ed6de2dfe27960d7
Instruction Fuzzy Hash: 64E0ED76004105BBD7011FA1EC0CD29BF3AFF693217104620F225C20B0CB375424FB60

Function 005E8595 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

Part of subcall function 00580854: EnterCriticalSection.KERNEL32(006316CC,?,00633504,?,00561535,00633504), ref: 0058085F
Part of subcall function 00580854: LeaveCriticalSection.KERNEL32(006316CC,?,00633504,?,00561535,00633504), ref: 0058089C

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005806D4: __onexit.LIBCMT ref: 005806DA

__Init_thread_footer.LIBCMT ref: 005E8612

Part of subcall function 0058080A: EnterCriticalSection.KERNEL32(006316CC,00633504,?,0056154F,00633504,005A231A), ref: 00580814
Part of subcall function 0058080A: LeaveCriticalSection.KERNEL32(006316CC,?,0056154F,00633504,005A231A), ref: 00580847

Strings

5, xrefs: 005E868F
Variable must be of type 'Object'., xrefs: 005E8651
G, xrefs: 005E8696
I`Z, xrefs: 005E8845

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$I`Z$Variable must be of type 'Object'.
API String ID: 535116098-907750244
Opcode ID: b3d27fa6ec8b89ee081a21a29c42fd768aae0bb5b07f0f2277fc7cdfbc31e543
Instruction ID: 2838aaf693f433ae3ed0b45afbf5c04d7389a0cde7dd8195ff45b44f5268e980
Opcode Fuzzy Hash: b3d27fa6ec8b89ee081a21a29c42fd768aae0bb5b07f0f2277fc7cdfbc31e543
Instruction Fuzzy Hash: 0991A075A00249EFCB18EF95C8958BDBFB2FF84300F548459F8496B292DB71AE45CB50

Function 005EB76E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 005EB8AF

Part of subcall function 00572306: _wcslen.LIBCMT ref: 0057230B

GetProcessId.KERNEL32(00000000), ref: 005EB944
CloseHandle.KERNEL32(00000000), ref: 005EB973

Strings

<, xrefs: 005EB877
@, xrefs: 005EB87E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 8018fa553e149de96c0293d2e2121cae1ec7a0004931921e2866c430d6a62f5d
Instruction ID: 07337fb8f36e503b9ebf32ecb4dac69bb15a898937fc9b7b3f9935fea29d5864
Opcode Fuzzy Hash: 8018fa553e149de96c0293d2e2121cae1ec7a0004931921e2866c430d6a62f5d
Instruction Fuzzy Hash: D7715574A0025ADFDB14DF55C488A9EBBF5FF48310F048499E895AB362CB34EE44CB90

Function 005F472C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005F47EA
IsMenu.USER32(?), ref: 005F47FF
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 005F4847
DrawMenuBar.USER32 ref: 005F485A

Strings

0, xrefs: 005F4739

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 4f09f170a7ea1884e4be97d0d9b17127ef29028531e28678c1ad87995392881a
Instruction ID: 7c91e58d1a0d19f9d93f3b8c0ea95df7f89519b003c63fdc6b253f7af503f214
Opcode Fuzzy Hash: 4f09f170a7ea1884e4be97d0d9b17127ef29028531e28678c1ad87995392881a
Instruction Fuzzy Hash: 9D415775A0128EEFDF10CF51E884AAABBB9FF45754F048129EA05AB250C734AD54DFA0

Function 005C2E91 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005C4D36: GetClassNameW.USER32(?,?,000000FF), ref: 005C4D59

SendMessageW.USER32(?,00000188,00000000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C2F15
SendMessageW.USER32(?,0000018A,00000000,00000000,?,00000188,00000000,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C2F28
SendMessageW.USER32(?,00000189,?,00000000,?,0000018A,00000000,00000000,?,00000188,00000000,00000000,?,?,ListBox,?), ref: 005C2F58

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

Strings

ListBox, xrefs: 005C2ED4
ComboBox, xrefs: 005C2E9F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 0436a13b2f51996ed97d83ddb25f61d7e5049750a626559b2e2183584b8c5956
Instruction ID: 2eb780ce7ce2dc91ed2f433529344af7b581e7c3c0a29642b0e84470c64057dc
Opcode Fuzzy Hash: 0436a13b2f51996ed97d83ddb25f61d7e5049750a626559b2e2183584b8c5956
Instruction Fuzzy Hash: 1C21047190010A6EDB14ABA0D84AEFEBF79FF86360F11862DB815A31D0DB384C499B60

Function 005F3895 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00574570: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00574473), ref: 005745AE
Part of subcall function 00574570: GetStockObject.GDI32(00000011,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?,?), ref: 005745C2
Part of subcall function 00574570: SendMessageW.USER32(00000000,00000030,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?), ref: 005745CC

SendMessageW.USER32(00000000,00000467,00000000,?,?,00000000,SysAnimate32,00000000,?,?,?,?,?,?,?,00000000), ref: 005F390F
LoadLibraryW.KERNEL32(?), ref: 005F3916
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 005F392B
DestroyWindow.USER32(?), ref: 005F3933

Strings

SysAnimate32, xrefs: 005F38EA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 56c573dbc5bc432cf4fb350f763b67de7dabf52930ba1df7d8b2de94199b9fc2
Instruction ID: b3ffb65a09bdeae74570d691e3c076ce898bee536d61e9a7944261019e871406
Opcode Fuzzy Hash: 56c573dbc5bc432cf4fb350f763b67de7dabf52930ba1df7d8b2de94199b9fc2
Instruction Fuzzy Hash: B621797160020AAFFF104E64DC84EBB7BADFB55764F108618FA5092190D7B98D51A760

Function 005C4024 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

Part of subcall function 005C3E94: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?,?,?,?,?,005C368B), ref: 005C3EB2
Part of subcall function 005C3E94: GetWindowThreadProcessId.USER32(?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3EC3
Part of subcall function 005C3E94: GetCurrentThreadId.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ECA
Part of subcall function 005C3E94: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ED1

GetFocus.USER32(005FD938), ref: 005C404B
GetParent.USER32(00000000), ref: 005C4068
GetClassNameW.USER32(?,?,00000100,?), ref: 005C40A7
EnumChildWindows.USER32(?,005C4110,?,?), ref: 005C40CF

Strings

%s%d, xrefs: 005C40E3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: b2d0e4b4dfa53fa66d65d09c171e0e88844faf26b47f01db7f0a1e3fb345473b
Instruction ID: 0ab20715dae46a05a043572812e9a4bc82eb619dfa89ef8638dad0993e1ae37c
Opcode Fuzzy Hash: b2d0e4b4dfa53fa66d65d09c171e0e88844faf26b47f01db7f0a1e3fb345473b
Instruction Fuzzy Hash: 4321507560020A9FCF10AFA09C99FFD7B6ABF94310F044069FE09EB142DA355949DBB0

Function 00584C79 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00584C2A,00000003,?,00584BCA,00000003,00629500,0000000C,00584D21,00000003,00000002), ref: 00584C99
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,00584C2A,00000003,?,00584BCA,00000003,00629500,0000000C,00584D21,00000003,00000002), ref: 00584CAC
FreeLibrary.KERNEL32(00000000,?,?,?,00584C2A,00000003,?,00584BCA,00000003,00629500,0000000C,00584D21,00000003,00000002,00000000), ref: 00584CCF

Strings

CorExitProcess, xrefs: 00584CA4
mscoree.dll, xrefs: 00584C92

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 18efc427ef1b240887370c2ba5dd8e222278d8bfec413f54a10c451e21c18627
Instruction ID: 19f5df67e0dea043d57b1c537731e94a414f9b842d60112f5e9d31e5d2fb1ac1
Opcode Fuzzy Hash: 18efc427ef1b240887370c2ba5dd8e222278d8bfec413f54a10c451e21c18627
Instruction Fuzzy Hash: C0F03C30A41219ABDB15AF90DD09BAEBFBAEB04751F010168BC05A62A0DB349E45DB91

Function 0057290F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,005727DC,?,?,0057058E,?,00000001), ref: 0057291B
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection,?,?,005727DC,?,?,0057058E,?,00000001), ref: 0057292D
FreeLibrary.KERNEL32(00000000,?,?,005727DC,?,?,0057058E,?,00000001), ref: 0057293F

Strings

Wow64DisableWow64FsRedirection, xrefs: 00572927
kernel32.dll, xrefs: 00572913

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: b94dd86d5ceb2648708a1f5ae217a4c8461fac68e65122cf236fbe8f06d6d5a2
Instruction ID: 96037ed8a9c5649da15b78f3f18e6ef7b7dbfc0b5386d913927ff5ec3d413565
Opcode Fuzzy Hash: b94dd86d5ceb2648708a1f5ae217a4c8461fac68e65122cf236fbe8f06d6d5a2
Instruction Fuzzy Hash: 1AE086316016322BC35117557C0CB7F7976AFA2F22F094015FE08D2210DB58CC45E4B1

Function 005728D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,005B77B4,?,?,0057058E,?,00000001), ref: 005728E1
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection,?,?,005B77B4,?,?,0057058E,?,00000001), ref: 005728F3
FreeLibrary.KERNEL32(00000000,?,?,005B77B4,?,?,0057058E,?,00000001), ref: 00572906

Strings

Wow64RevertWow64FsRedirection, xrefs: 005728ED
kernel32.dll, xrefs: 005728DA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: e917aeba16aa98ebe5f0f36fb2d97fad9634d3aa6d6de6db7d737577157365e9
Instruction ID: 15a0d1616a27a8aa16b549533f4581d8a14c599c86f5c4c928f3f1625c3c6345
Opcode Fuzzy Hash: e917aeba16aa98ebe5f0f36fb2d97fad9634d3aa6d6de6db7d737577157365e9
Instruction Fuzzy Hash: 18D01235602A3B57C63227257C08DAF6E37AF81B517094025BA08E2114CF69CD55E5B2

Function 005D36AD Relevance: 7.8, APIs: 5, Instructions: 314fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005D396B
DeleteFileW.KERNEL32(?), ref: 005D39ED
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005D3A03
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005D3A14
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005D3A26

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: b613a29d9ea6ccc84646bc35db9138598c6066377cef86b1e757069fefbcecbe
Instruction ID: 6f5d6e475f29b79ace17a75d25192de819b5a2060e74bad371a4ea9278d2725f
Opcode Fuzzy Hash: b613a29d9ea6ccc84646bc35db9138598c6066377cef86b1e757069fefbcecbe
Instruction Fuzzy Hash: 36B13072A01119ABDF21EFA4DC89EDE7B7DFF44350F0040A7F509A6251EA319B44CB61

Function 005EAD7F Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 005EAE1F
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 005EAE2D
GetProcessIoCounters.KERNEL32(00000000,?), ref: 005EAE60
CloseHandle.KERNEL32(?), ref: 005EB035

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 194689a54f3269aad52fcda5adb0c1d2b389e6878a14dea1647c87a208f1c38e
Instruction ID: 33b3c7c61b9b3b72a39b291b3b5e7ed1e3b4fb74ee0b9123b800104f8fa3810a
Opcode Fuzzy Hash: 194689a54f3269aad52fcda5adb0c1d2b389e6878a14dea1647c87a208f1c38e
Instruction Fuzzy Hash: ECA1C075604301AFE724DF25C88AF2ABBE5BF84710F14881DF9999B292D770ED44CB91

Function 005EB074 Relevance: 7.7, APIs: 5, Instructions: 181processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 005EB0A4
Process32FirstW.KERNEL32(00000000,?), ref: 005EB0B2

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

CompareStringW.KERNEL32(00000400,00000001,?,?,?,?,?), ref: 005EB136
Process32NextW.KERNEL32(00000000,?,?,?), ref: 005EB19E
CloseHandle.KERNEL32(00000000), ref: 005EB1B0

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 2cb03c8dc04b4023f94a15028a426d3fa036c3fcd8d4123671c14efabd12560d
Instruction ID: 0893a74ed79dbb7947d562391053187ca081e34a07f6ddc12b7abb9768985754
Opcode Fuzzy Hash: 2cb03c8dc04b4023f94a15028a426d3fa036c3fcd8d4123671c14efabd12560d
Instruction Fuzzy Hash: 2C614BB1508301AFD714EF65D889A6BBBE9FFC8750F00492DF99597291EB30D904CB92

Function 005EC3C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005ED398: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005EC0AE,?,?), ref: 005ED3B5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED3F5
Part of subcall function 005ED398: _wcslen.LIBCMT ref: 005ED456

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005EC4A5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005EC500
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 005EC563
RegCloseKey.ADVAPI32(?), ref: 005EC5A6
RegCloseKey.ADVAPI32(00000000), ref: 005EC5B3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 2f5a41c015226133928c71902ff7e1a04e11dfd7de0afb6d0594db2aa6582e6e
Instruction ID: c3e5d8fba001cc623f13c29d3933a5e91811e567a8e21d876294db0e034ee495
Opcode Fuzzy Hash: 2f5a41c015226133928c71902ff7e1a04e11dfd7de0afb6d0594db2aa6582e6e
Instruction Fuzzy Hash: 1F618F31608241AFD718DF25C494E2ABFE5FF84308F54895DF49A8B2A2DB31ED46CB91

Function 005C9A8B Relevance: 7.7, APIs: 5, Instructions: 160COMMON

Download Yara Rule

APIs

#8.OLEAUT32(?,00000000,?,?,?,?,?,?,?,?,00000024), ref: 005C9AA8
#9.WSOCK32(?,?,?,?,?,?,?,00000024), ref: 005C9B19
#9.WSOCK32(?,?,?,?,?,?,?,00000024), ref: 005C9B78
#9.WSOCK32(?,?,?,?,?,?,?,00000024), ref: 005C9BEB
#12.WSOCK32(?,?,00000000,00000013,00000000,?,?,?,?,?,?,?,?,00000024), ref: 005C9C16

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d42f2e3a49c72df9708c739f4f3000b351ae04897a761eca63ee0b1e3654c7
Instruction ID: aae6cae0a3f32bc55d1930e17c98ae58b3d38171c4be90e40932050e6c0619ba
Opcode Fuzzy Hash: f9d42f2e3a49c72df9708c739f4f3000b351ae04897a761eca63ee0b1e3654c7
Instruction Fuzzy Hash: E45149B5A00619EFCB14CF58D888EAABBF9FF89314B15855DE909DB310E734E911CB90

Function 005E23E0 Relevance: 7.7, APIs: 5, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 005E3B94: #10.WSOCK32(?,?,?,?,?,00000000), ref: 005E3BC5
Part of subcall function 005E3B94: _wcslen.LIBCMT ref: 005E3BE4
Part of subcall function 005E3B94: #9.WSOCK32(00000000,?,?,00000000), ref: 005E3C2D

#23.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 005E2437
#111.WSOCK32 ref: 005E245E
#2.WSOCK32(00000000,?,00000010), ref: 005E24B5
#111.WSOCK32 ref: 005E24C0
#3.WSOCK32(00000000), ref: 005E24EF

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: #111$_wcslen
String ID:
API String ID: 2838908337-0
Opcode ID: e47bae73dd659ae00fa6eccc647cca70758a55a7d210918cc6a080809e9b0dcb
Instruction ID: e2b2194b47628e6176a6f2fcc240e97022087319aad291200718f4b6ae7776aa
Opcode Fuzzy Hash: e47bae73dd659ae00fa6eccc647cca70758a55a7d210918cc6a080809e9b0dcb
Instruction Fuzzy Hash: 8851E475A00210AFDB24EF24C88AF2ABFA9BF44714F148098F9459F3C3D671AD41C7A1

Function 005D95DA Relevance: 7.6, APIs: 5, Instructions: 144COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?,00000000), ref: 005D968D
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 005D96B9
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 005D9711
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 005D9736
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 005D973E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: f17761b67e29385fa3cbd19785e05747acd32ad4a66aa8ab4b5998d0d8e8db7e
Instruction ID: 5de328df930a3554c66e893926a3207e77759cdc536f117ecb7b515973f45f25
Opcode Fuzzy Hash: f17761b67e29385fa3cbd19785e05747acd32ad4a66aa8ab4b5998d0d8e8db7e
Instruction Fuzzy Hash: 7E512935A00219EFCB14EF64C889A6ABBF5FF49314F048059E949AB362CB35ED45DB90

Function 005E98C8 Relevance: 7.6, APIs: 5, Instructions: 144libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 005E9924
GetProcAddress.KERNEL32(00000000,?,00000000,?), ref: 005E99B4
GetProcAddress.KERNEL32(00000000,00000000,00000000,?), ref: 005E99D0
GetProcAddress.KERNEL32(00000000,?,00000041), ref: 005E9A16
FreeLibrary.KERNEL32(00000000), ref: 005E9A36

Part of subcall function 005800D3: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,005D1DC1,?,80000009), ref: 005800F0
Part of subcall function 005800D3: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,005C0B20,00000000,00000000,?,?,005D1DC1,?,80000009,?,005C0B20), ref: 00580117

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 44b88d3e04ee3629728471047d63d5c2919e60d12b0e9e7ff7122952c30bdab9
Instruction ID: bc2a2d150def682e023d9501bc64960f0b94470a1d3118bae73f99dc84e4f0f7
Opcode Fuzzy Hash: 44b88d3e04ee3629728471047d63d5c2919e60d12b0e9e7ff7122952c30bdab9
Instruction Fuzzy Hash: FB514B35A04246DFCB14DF55C4988ADBFF1FF49314B0481A8E849AB762DB31EE85CB91

Function 005F7526 Relevance: 7.6, APIs: 5, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58a14851d49b66bfabed8a21672547327f4ebaf04c1658d1a9f387eae736efc
Instruction ID: c9c68f7d15a945ba42de670affaf7e031f9cb40d8e425314f52b721d15eb5ed6
Opcode Fuzzy Hash: f58a14851d49b66bfabed8a21672547327f4ebaf04c1658d1a9f387eae736efc
Instruction Fuzzy Hash: 1C41AF35A0810DABDB249F28CC58FB9BF66FB0D310F150265FA19E72A0C678AD11DA90

Function 00591E72 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00591EE4
_free.LIBCMT ref: 00591F04

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3abd27c99a100a3e0e9f7ffc7378f019d74dd94a5c2f5d6dd43e8efdc78a7dc4
Instruction ID: 9b7841a76e199726e9d1f521def5fa50779111d55191d1d859e83d484152e346
Opcode Fuzzy Hash: 3abd27c99a100a3e0e9f7ffc7378f019d74dd94a5c2f5d6dd43e8efdc78a7dc4
Instruction Fuzzy Hash: FE41D136A006199FCF24DF78C885A5ABBF5FF88314F2545A8E915EB341DB31AD02CB84

Function 00574B74 Relevance: 7.6, APIs: 5, Instructions: 122keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?,?,00000000,00000000,?,005753FE,00000000,000000FF,?,?,?), ref: 00574B88
ScreenToClient.USER32(00000000,?,?,005753FE,00000000,000000FF,?,?,?), ref: 00574BA5
GetAsyncKeyState.USER32(?,?,005753FE), ref: 00574BCE
GetAsyncKeyState.USER32(?,?,005753FE), ref: 00574BE8

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 9895422fd54c2bccea3e421d5e5bd3e7d3d70df793e129f8bcd0d4d347c84dc8
Instruction ID: edae29c00aab66a1d2a652ee3af184e54fd3c78d437309ca4ffca41b5c9ba772
Opcode Fuzzy Hash: 9895422fd54c2bccea3e421d5e5bd3e7d3d70df793e129f8bcd0d4d347c84dc8
Instruction Fuzzy Hash: B5417E71A0451ABBDF059F64D844BFEBF78FB09320F208219E429A7290CB356D54EFA1

Function 005D6291 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000002), ref: 005D62C9
CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 005D634B
GetLastError.KERNEL32(?,00000000), ref: 005D6371
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 005D6396
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 005D63C2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CreateFileHardLink$AttributesDeleteErrorLast
String ID:
API String ID: 4077537916-0
Opcode ID: 85c4ec0bb2ae31b95ed44442cde141c8ae4fc2caaa2521b5567e038c100e8616
Instruction ID: e319d30100d37d29af86ea660daabcc061db7a7b518ba657a1c4c8f2dcd4e024
Opcode Fuzzy Hash: 85c4ec0bb2ae31b95ed44442cde141c8ae4fc2caaa2521b5567e038c100e8616
Instruction Fuzzy Hash: 1D414C39600611DFCB20DF18C548A5DBFE1FF99720B188489E959AB362CB35FE09DB91

Function 005C2A1B Relevance: 7.6, APIs: 5, Instructions: 94sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005C2A2F
PostMessageW.USER32(00000001,00000201,00000001,?,?,?), ref: 005C2ADB
Sleep.KERNEL32(00000000,?,?,?), ref: 005C2AE3
PostMessageW.USER32(00000001,00000202,00000000,?,?,?,?), ref: 005C2AF4
Sleep.KERNEL32(00000000,?,?,?,?), ref: 005C2AFC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5813bcd63d490b796b54ce3fd4bbd1e0b16b565fced4614f9e8db8090f2b1a75
Instruction ID: c82132e153adeb713f56c707301abeae5544369b0afa9f98fc61fef59ab0d66a
Opcode Fuzzy Hash: 5813bcd63d490b796b54ce3fd4bbd1e0b16b565fced4614f9e8db8090f2b1a75
Instruction Fuzzy Hash: 4E318D71900219EFDB14CFA8CD89BAE7BB6FB14315F104229F925EB2D0C7B09954DB91

Function 005DDA0D Relevance: 7.6, APIs: 5, Instructions: 94networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,005DCCFF,00000000), ref: 005DDA2B
InternetReadFile.WININET(?,00000000,?,?,?,00000000,?,?,?,005DCCFF,00000000), ref: 005DDA62
GetLastError.KERNEL32(?,00000000,?,?,?,005DCCFF,00000000), ref: 005DDAB9
SetEvent.KERNEL32(?,?,00000000,?,?,?,005DCCFF,00000000), ref: 005DDACD
SetEvent.KERNEL32(?,?,00000000,?,?,?,005DCCFF,00000000), ref: 005DDAE5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: ef4fafb2dc8b830911d3b42687b7e5cc54f80da4bd6451100a6d63a849e61892
Instruction ID: fe0ff1d2cabca5a23356f9a015f26ee1e7fd5add39f39bb00dadd521c7f681d9
Opcode Fuzzy Hash: ef4fafb2dc8b830911d3b42687b7e5cc54f80da4bd6451100a6d63a849e61892
Instruction Fuzzy Hash: F2314D71604205EFDB20DFA9D884ABFBBF8FB54310B10842FE506D6250D634AD45DB70

Function 005E14FC Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 005E151D
GetForegroundWindow.USER32 ref: 005E1534
GetDC.USER32(00000000), ref: 005E1570
GetPixel.GDI32(00000000,?,00000003), ref: 005E157C
ReleaseDC.USER32(00000000,00000003), ref: 005E15B4

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5da3412efbce4716acbd9010d8067d74ef9c7453192da8f4534a5df2584899ea
Instruction ID: 8b3ac8be05c22a7432b25f382f4a6d6fe54cf159490622eadaad2769855d7ad8
Opcode Fuzzy Hash: 5da3412efbce4716acbd9010d8067d74ef9c7453192da8f4534a5df2584899ea
Instruction Fuzzy Hash: 34218475600204AFD714DF65DC89AAEBBF5FF98311F00846AE84AD7351CA30AD44DF60

Function 0059CBED Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0059CBF6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0059CC19

Part of subcall function 0059282E: HeapAlloc.KERNEL32(00000000,?,00000001,?,00580445,?,?,0056FA72,00000000,?,?,?,00561188,?), ref: 00592860

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0059CC3F
_free.LIBCMT ref: 0059CC52
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0059CC61

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: eef227b7d3e830a1020f6dbcb212dcd9f1af1d5f8bdc368018369eb545db79bf
Instruction ID: 5a9f427ef083605973d1b78a4f682470612b352e46ca001eaff5cf9c25d6138a
Opcode Fuzzy Hash: eef227b7d3e830a1020f6dbcb212dcd9f1af1d5f8bdc368018369eb545db79bf
Instruction Fuzzy Hash: 00018F726052557F6B2126BA6C8CC7F6E6EFEC6BA13140129FA19D2240DE648D05E1B0

Function 00573B38 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00573B92
SelectObject.GDI32(?,00000000), ref: 00573BA1
BeginPath.GDI32(?), ref: 00573BB8
SelectObject.GDI32(?,00000000,000000FF,00000000), ref: 00573BE1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b0f3d5c27df74dc10d210304ff6e0b54ae31bcbb818d83d8e816c019d1b98105
Instruction ID: 36ae8b869e2fbddebb6ffed830fe3334ff4d9c115066c200831e83c3a9752555
Opcode Fuzzy Hash: b0f3d5c27df74dc10d210304ff6e0b54ae31bcbb818d83d8e816c019d1b98105
Instruction Fuzzy Hash: 33215E30901306EFCB218F1AEC19B797F7AB754322F105216F418961F0D7755996FB90

Function 00592CCF Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,005926D1,0059281A,?,?,0056FC79,?,?,0056111E), ref: 00592CD4
_free.LIBCMT ref: 00592D09
_free.LIBCMT ref: 00592D30
SetLastError.KERNEL32(00000000), ref: 00592D3D
SetLastError.KERNEL32(00000000), ref: 00592D46

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 5612ae5a15dd46e3b205a7b2eeca345abb2a0ef4290677c8c8acd99c701f9576
Instruction ID: 76a28059769cfd79569f996b64a239df428c856a4b4956a59ff5d83cb34898c7
Opcode Fuzzy Hash: 5612ae5a15dd46e3b205a7b2eeca345abb2a0ef4290677c8c8acd99c701f9576
Instruction Fuzzy Hash: 0301D136204702BB8F2627696C8D96B2E6AFBD1760F310424F900E61E2FF24880BA021

Function 005C10AB Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?,?,?,005C13FD), ref: 005C10C8
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?,?), ref: 005C10E3
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?,?), ref: 005C10F1
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?), ref: 005C1101
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005C0FDC,80070057,?,?), ref: 005C110D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 135d3591f02d447157e696a01067969e1999abe854465aa9babe4ab9ca2cb368
Instruction ID: 84c1ad4e6239ec84209a1ced1cadf444fac40902e405472bf4dff06073131681
Opcode Fuzzy Hash: 135d3591f02d447157e696a01067969e1999abe854465aa9babe4ab9ca2cb368
Instruction Fuzzy Hash: 59015E76601604AFDB104F94DC48FAABFBDEB45791F140018FE08D2211E779DD40EAA0

Function 005CF7F5 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF811
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF81F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF827
QueryPerformanceCounter.KERNEL32(005AA61D,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF831
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF86D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: fea197a151833d8a5c93556fe16b8c6d3872b5a4ed158db6e1b27633e4b686da
Instruction ID: e0df4807e5a9a769bfeb3787014f2fd6098fe5d0a8cf443fec66196572b3d956
Opcode Fuzzy Hash: fea197a151833d8a5c93556fe16b8c6d3872b5a4ed158db6e1b27633e4b686da
Instruction Fuzzy Hash: D5010231C006299FDF00AFE5E849AEDBB7AFB19711F10056AE901B2250CB749698DBA5

Function 005C2203 Relevance: 7.5, APIs: 5, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C221E
GetLastError.KERNEL32(?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C222A
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2239
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2240
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?,?,00000000,00000000,?,?,005C1CA1,?,?,?), ref: 005C2257

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: e72175d9dd9271fbdc0d185d65ede9ec9ade7e30d81ea6d387be4242a547b4fd
Instruction ID: d7ed6fc2273bdd0083ad8e7095cbea2009a016232ff9a77f4fe2759fd4d9daa9
Opcode Fuzzy Hash: e72175d9dd9271fbdc0d185d65ede9ec9ade7e30d81ea6d387be4242a547b4fd
Instruction Fuzzy Hash: 130146B9600605AFDB114FA9DC48E6A7B7EEF992A0B214468FD48C3260DA359C50EA70

Function 005C211E Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 005C2134
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 005C2140
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005C214F
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 005C2156
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005C216C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 395f4c226b3153e6f17ca8c50a2fd5531928c519cefe5c8cda87e57df20d7296
Instruction ID: 6ab422c00b68222b0a079c05c3ba8af265ff45dbcf85ccce497df6e691fb5dfc
Opcode Fuzzy Hash: 395f4c226b3153e6f17ca8c50a2fd5531928c519cefe5c8cda87e57df20d7296
Instruction Fuzzy Hash: AFF04975240301AFDB120FA5EC49F663BBEFF89760F140814FA45C72A0DA75D804DA70

Function 005C6C29 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 005C6C3D
GetWindowTextW.USER32(00000000,?,00000100), ref: 005C6C54
MessageBeep.USER32(00000000), ref: 005C6C6C
KillTimer.USER32(?,0000040A), ref: 005C6C88
EndDialog.USER32(?,00000001,?), ref: 005C6CA2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: bb943c034f5adaf3361ecc1f401be00f7fa4ae113f2b5079fc42c398c432d8ef
Instruction ID: 44039e4cde94521300d43bacac1a94d5ae3a3338a27ed65d96cdbe3147af0e42
Opcode Fuzzy Hash: bb943c034f5adaf3361ecc1f401be00f7fa4ae113f2b5079fc42c398c432d8ef
Instruction Fuzzy Hash: 8F0162305007089BEB205B60DD4EFA67B79FF14B05F00065DB586E20E1DBE86E59DBA1

Function 005D116D Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,005D0FE5,?,005D40D1,?,00000001,005A8E5C,?), ref: 005D1182
CloseHandle.KERNEL32(?,?,?,?,005D0FE5,?,005D40D1,?,00000001,005A8E5C,?), ref: 005D118F
CloseHandle.KERNEL32(?,?,?,?,005D0FE5,?,005D40D1,?,00000001,005A8E5C,?), ref: 005D119C
CloseHandle.KERNEL32(?,?,?,?,005D0FE5,?,005D40D1,?,00000001,005A8E5C,?), ref: 005D11A9
CloseHandle.KERNEL32(?,?,?,?,005D0FE5,?,005D40D1,?,00000001,005A8E5C,?), ref: 005D11B6
CloseHandle.KERNEL32(?,?,?,?,005D0FE5,?,005D40D1,?,00000001,005A8E5C,?), ref: 005D11C3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2991d67a7680c292508eb8e3f9ad9c1e337ad2680e6fb991665cee47e560c4f3
Instruction ID: 1cb642b722b88a9d409e416f3f4f2927590ec131f7f9070b7f584a0d9314e5f6
Opcode Fuzzy Hash: 2991d67a7680c292508eb8e3f9ad9c1e337ad2680e6fb991665cee47e560c4f3
Instruction Fuzzy Hash: DC01A271801B15EFCB309FAAD980812FBF5BF503153158A3FD29652A31C771A949DF84

Function 0059D56A Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0059D582

Part of subcall function 005927F4: HeapFree.KERNEL32(00000000,00000000,?,0056FC79,?,?,0056111E), ref: 0059280A

_free.LIBCMT ref: 0059D594
_free.LIBCMT ref: 0059D5A6
_free.LIBCMT ref: 0059D5B8
_free.LIBCMT ref: 0059D5CA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 76f32ff0c35cfb86fc58864e3b40ca17a622c55f28dde418a3c252aedf6f19d9
Instruction ID: 7ec136882b2631c40eb6e23681c96b768ab8da7cec4cc0edea987b2ccb16f075
Opcode Fuzzy Hash: 76f32ff0c35cfb86fc58864e3b40ca17a622c55f28dde418a3c252aedf6f19d9
Instruction Fuzzy Hash: C9F0F932508604AB8B24EBADF9C6C5A7BEAFA40714B691805F108E7541CA34FC81DB74

Function 005C4B6E Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0,?,000000F0,?,?,005C4BDB,?,?), ref: 005C4B7D
GetParent.USER32(?,?,000000F0,?,000000F0,?,?,005C4BDB,?,?), ref: 005C4B84
GetWindowLongW.USER32(?,000000F0,?,?,000000F0,?,000000F0,?,?,005C4BDB,?,?), ref: 005C4B91
GetWindowLongW.USER32(?,000000F0,?,?,005C4BDB,?,?), ref: 005C4BA7

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LongWindow$Parent
String ID:
API String ID: 2125864951-0
Opcode ID: 547d6983b257fde2fb5266295a61e7afeefb82893f00812c0e6e286b24434a78
Instruction ID: 3232014fdd4fde7690cc7490e0d2c3eff0e47f80b5cc627767512e5d08bbb180
Opcode Fuzzy Hash: 547d6983b257fde2fb5266295a61e7afeefb82893f00812c0e6e286b24434a78
Instruction Fuzzy Hash: 25E09B312090326F5F1116696C10F6F69BD7E627787220364F820F21E4D754FC025DF8

Function 005920C4 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005920E2

Part of subcall function 005927F4: HeapFree.KERNEL32(00000000,00000000,?,0056FC79,?,?,0056111E), ref: 0059280A

_free.LIBCMT ref: 005920F4
_free.LIBCMT ref: 00592107
_free.LIBCMT ref: 00592118
_free.LIBCMT ref: 00592129

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 03dd7735ff9b5f0bf070f5b72727943253c5e9b4096eca35a224e6900f829958
Instruction ID: a29e9e97b4e901b19edbfdbd5e66c90ee8be6419ae9d4f53654cad41e07d17f7
Opcode Fuzzy Hash: 03dd7735ff9b5f0bf070f5b72727943253c5e9b4096eca35a224e6900f829958
Instruction Fuzzy Hash: F3F0FE70809522EFCB1A6F59BC5548A3FA7FB49760715220AF514AA2B5CB390A42DFC1

Function 00573BF5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?,?,005B842E,00000000,?), ref: 00573C04
StrokeAndFillPath.GDI32(?,?,005B842E,00000000,?), ref: 00573C20
SelectObject.GDI32(?,?,?,005B842E,00000000,?), ref: 00573C33
DeleteObject.GDI32(?,005B842E,00000000,?), ref: 00573C46
StrokePath.GDI32(?,?,005B842E,00000000,?), ref: 00573C61

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 3469a670fe79bd01b29344c4d08ad8924e30c422a850dbeb37c78ec58e63720a
Instruction ID: 4743b874f28b57e0391d8ef995ba988f244dac0fd5b15f91d3b1c58e5a371ba6
Opcode Fuzzy Hash: 3469a670fe79bd01b29344c4d08ad8924e30c422a850dbeb37c78ec58e63720a
Instruction Fuzzy Hash: 6BF0C930005205EBDB269F26ED1CB643F7ABB11376F149214E569950F0C77589AAFFA0

Function 00590D68 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00590F1A
__freea.LIBCMT ref: 00590F38

Part of subcall function 00591358: _free.LIBCMT ref: 00591370

Strings

am/pm, xrefs: 00590F9B
a/p, xrefs: 00590FFF

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 4169e314c01e5c0facd1217d45d19afd146484c886b8321cb4d2414452eb32c5
Instruction ID: 7d666a0b286fcc506d7f53495f4f110e4640fc6e4c0670f5d0828f2385cb778b
Opcode Fuzzy Hash: 4169e314c01e5c0facd1217d45d19afd146484c886b8321cb4d2414452eb32c5
Instruction Fuzzy Hash: E0D12931900627EFCF289F68C9497BABFB4FF05300F14495AEA15AB290D3359D80DB58

Function 005E6DA0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 325COMMON

Download Yara Rule

APIs

Part of subcall function 00580854: EnterCriticalSection.KERNEL32(006316CC,?,00633504,?,00561535,00633504), ref: 0058085F
Part of subcall function 00580854: LeaveCriticalSection.KERNEL32(006316CC,?,00633504,?,00561535,00633504), ref: 0058089C

Part of subcall function 005806D4: __onexit.LIBCMT ref: 005806DA

__Init_thread_footer.LIBCMT ref: 005E6E08

Part of subcall function 0058080A: EnterCriticalSection.KERNEL32(006316CC,00633504,?,0056154F,00633504,005A231A), ref: 00580814
Part of subcall function 0058080A: LeaveCriticalSection.KERNEL32(006316CC,?,0056154F,00633504,005A231A), ref: 00580847

Part of subcall function 005D4358: LoadStringW.USER32(00000066,?,00000FFF,?,00000000,?,?,005A40FE,0000006E,?), ref: 005D43A0
Part of subcall function 005D4358: LoadStringW.USER32(?,?,00000FFF,?,?,?,005A40FE,0000006E,?), ref: 005D43C6

Strings

X3c, xrefs: 005E6F3F
X3c, xrefs: 005E6F23
X3c, xrefs: 005E6F0A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: X3c$X3c$X3c
API String ID: 1072379062-327526534
Opcode ID: e6dfdac951a32111713a9fcb27844025e443a80d1283c3891667379347fa751e
Instruction ID: 4b810142eff1de970f57f7bc19625d5c60fb5d3be0a44389abdbbb4084f19684
Opcode Fuzzy Hash: e6dfdac951a32111713a9fcb27844025e443a80d1283c3891667379347fa751e
Instruction Fuzzy Hash: 45C1E271A0414AAFCB18DF59C894DBEBBB9FF58340F108429F9959B291DB30ED44CB90

Function 005C37EF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005CC259: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005C3287,?,?,00000034,00000800,?,00000034), ref: 005CC283

SendMessageW.USER32(?,00001104,00000000,00000000,?,00000000,00000010,00000010,?,00000000), ref: 005C3839

Part of subcall function 005CC224: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005C32B6,?,?,00000800,?,00001073,00000000,?,?), ref: 005CC24E

Part of subcall function 005CC17E: GetWindowThreadProcessId.USER32(?,?,00000000,00000000,?,?,005C324B,00000034,?,?,00001004,00000000,00000000), ref: 005CC1A9
Part of subcall function 005CC17E: OpenProcess.KERNEL32(00000438,00000000,?,?,?,005C324B,00000034,?,?,00001004,00000000,00000000), ref: 005CC1B9
Part of subcall function 005CC17E: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,005C324B,00000034,?,?,00001004,00000000,00000000), ref: 005CC1CF

SendMessageW.USER32(?,00001111,00000000,00000000,?,00000000,00000010,00000010,?,00000000,?,00000010,?,00001104,00000000,00000000), ref: 005C38A6
SendMessageW.USER32(?,00001111,00000000,00000000,?,00000000,00000010,00000000,?,00000010,?,00000000,?,00000010,?,00001104), ref: 005C38F3

Strings

@, xrefs: 005C390B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d71a2f92acf543aab1e56fbe323a4daf8a8ab499528a80b4248e3d450078490c
Instruction ID: c51f76711c131ff03db158add037ff9e09608dc03e920a018d3cda01fa9ecca5
Opcode Fuzzy Hash: d71a2f92acf543aab1e56fbe323a4daf8a8ab499528a80b4248e3d450078490c
Instruction Fuzzy Hash: 9F413976900219AECB10DFE4CC45FDEBBB8BF49700F008099FA59B7181DA706E45DBA0

Function 005737B5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 121windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104,00632B0C,00632970), ref: 005B7F96

Part of subcall function 0056F82C: _wcslen.LIBCMT ref: 0056F83F

Shell_NotifyIconW.SHELL32(00000001,000003A8,?,?,00000080), ref: 005738A8

Strings

AutoIt - , xrefs: 00573819
Line %d: , xrefs: 005B8014

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line %d: $AutoIt -
API String ID: 2289894680-4094128768
Opcode ID: fb5d2c77d31b7d5772171625c96e05f6f9728795462a6cea3e2bfd91e2621d33
Instruction ID: 7a8681d657471b5d405efb472322a7bc0a1a39270c1614d0a8f5b3ef079405a4
Opcode Fuzzy Hash: fb5d2c77d31b7d5772171625c96e05f6f9728795462a6cea3e2bfd91e2621d33
Instruction Fuzzy Hash: A441C571408306AAD311EB60EC59EEF7FE8BF84320F00492AF58993191EB74A649D7D3

Function 005CD017 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,?,00000000,?), ref: 005CD0A0
DeleteMenu.USER32(?,00000007,00000000), ref: 005CD0E6
DeleteMenu.USER32(005CCBE8,?,00000000,005CCBE8,00000000,00000000,?,00000000), ref: 005CD12F

Strings

0, xrefs: 005CD079

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 470fe8bcfc5090259b0cee08257bcbbcd2cee2d79c1bea0ddfe2e03864429e7d
Instruction ID: f371c0e8df76d66ae4c624b9a4147ff411891eaac73d0b4fa218c9ca0e3329e0
Opcode Fuzzy Hash: 470fe8bcfc5090259b0cee08257bcbbcd2cee2d79c1bea0ddfe2e03864429e7d
Instruction Fuzzy Hash: B9417C702043029FD720DF68D889F6ABBF8BB85314F184A2DF965D7291D734A905CB72

Function 005F4DDC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,005FD938,00000000,?,?,?,?), ref: 005F4E70
GetWindowLongW.USER32 ref: 005F4E8D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005F4E9D

Strings

SysTreeView32, xrefs: 005F4E42

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: ea717e1f30996f0313489f1993cd40bf305e6f290b5b94fcfd7b91cef36319bc
Instruction ID: 3d784a2fba42f3ca7b4678ad8af23ceb465923255cb79337c3495a2c03fbebc3
Opcode Fuzzy Hash: ea717e1f30996f0313489f1993cd40bf305e6f290b5b94fcfd7b91cef36319bc
Instruction Fuzzy Hash: E9316C3120060AAFDB218E38DC45BEB7BA9FB54324F204725FA79D22E0C778AD559B50

Function 005C7E87 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

#3.WSOCK32(?,?,?,?,?,?,?,005C7A49,?), ref: 005C7F03
#11.WSOCK32(?,?,?,?,?,?,?,005C7A49,?), ref: 005C7F1E
#9.WSOCK32(?,?,?,?,?,?,005C7A49,?), ref: 005C7F28

Strings

Iz\, xrefs: 005C7EA1, 005C7EA6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID: Iz\
API String ID: 0-923263998
Opcode ID: 54443ca476c01f67f186057d2ea4236869ea32effcf2827cf01d8b46c30c6ba0
Instruction ID: 21f2ab15774d64c03653f067307343100d5bf1d365629c0ccbf4f82c940515bb
Opcode Fuzzy Hash: 54443ca476c01f67f186057d2ea4236869ea32effcf2827cf01d8b46c30c6ba0
Instruction Fuzzy Hash: 63318FB160820ADFCB04EFA4D8959BE7F75FF88301B11085DF8028B691DB359A15DFA5

Function 005CA36D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005CA3DE

Strings

#requireadmin, xrefs: 005CA39B
#OnAutoItStartRegister, xrefs: 005CA3B5
#notrayicon, xrefs: 005CA378

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 2c45be8a9e361b3ac4027832cf6c3a64eaf9b12cc2d0fc9e8dff309317fd8da4
Instruction ID: afc4554e0c4352668bbcaf1a0769bade1c7115fa0bd7362084754e70a1acedbf
Opcode Fuzzy Hash: 2c45be8a9e361b3ac4027832cf6c3a64eaf9b12cc2d0fc9e8dff309317fd8da4
Instruction Fuzzy Hash: 2D219A3214021AAFD625B7A49C0AFBB7FD8FF90708F50882EF94597082FB909C418393

Function 005F486F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?,?,?,SysMonthCal32,00000000,00000000,?,?,?,?,?,?,00000001), ref: 005F48F7
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 005F490B
SendMessageW.USER32(?,00001002,00000000,?), ref: 005F492F

Strings

SysMonthCal32, xrefs: 005F48C2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: f9ca120b629a18994830ff4922fe45e43ea49d013f75e1aeec84eb35faf47997
Instruction ID: cefcc8f5e30741fe0d9101915c6bea645d354698cbbf2c9adeaf95a7cf44b58d
Opcode Fuzzy Hash: f9ca120b629a18994830ff4922fe45e43ea49d013f75e1aeec84eb35faf47997
Instruction Fuzzy Hash: 2A21B132600219AFDF118F50CC86FEB3B79FF48724F114214FE19AB190D6B5AC559BA0

Function 005F5020 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 005F50D7
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 005F50E5
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 005F50EC

Strings

msctls_updown32, xrefs: 005F5051

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: ddaf1d11c2daf53765c75a777b49d7c0ac539f3249a09f175d709e2a923a1c99
Instruction ID: 1cc913b62e32213ab74b8636bffeaf158abc35b66589cb405a1945854392c0e8
Opcode Fuzzy Hash: ddaf1d11c2daf53765c75a777b49d7c0ac539f3249a09f175d709e2a923a1c99
Instruction Fuzzy Hash: B7217CB560060AAFDB10DF14DCC5D7B3BADFB8A394B104059FB019B2A1DB35EC11DAA0

Function 005E3B94 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 005E3EAF: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,005E3BC2,?,?), ref: 005E3ECC

#10.WSOCK32(?,?,?,?,?,00000000), ref: 005E3BC5
_wcslen.LIBCMT ref: 005E3BE4
#9.WSOCK32(00000000,?,?,00000000), ref: 005E3C2D

Strings

255.255.255.255, xrefs: 005E3BDF, 005E3BF0

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide_wcslen
String ID: 255.255.255.255
API String ID: 3510393845-2422070025
Opcode ID: c364a7c41e599a0f1d7f9b2ee2f3924ab91273546f7e98cc4dc735968677574c
Instruction ID: 85afbff6e78b9dc9d84c321eceeda1674a8e6067df4107a5e0e15ebf0dbf6c99
Opcode Fuzzy Hash: c364a7c41e599a0f1d7f9b2ee2f3924ab91273546f7e98cc4dc735968677574c
Instruction Fuzzy Hash: BA31A7759002959FCB14CF19C58DBA9BFB0FF04314F288199E8496B352D731EE46CB91

Function 005F414F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?,?,?,Listbox,00000000,00000000,?,?,?,?,?,?,00000001), ref: 005F41D8
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 005F41E8
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 005F420E

Strings

Listbox, xrefs: 005F41A7

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 0a3ae53f7dbda8632cfa37a5d1f43d6039f23deb1b396d7b353983a92f178c1a
Instruction ID: 9b1c834f05ee0b660da7b5bb4a7e85369e681d713601feabcd3e831ebce09d93
Opcode Fuzzy Hash: 0a3ae53f7dbda8632cfa37a5d1f43d6039f23deb1b396d7b353983a92f178c1a
Instruction Fuzzy Hash: FC218E32600119BBEF118F54DC85EBB3B6EFF99764F118124FA149B190CB799C92CBA0

Function 0059BAB2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0059BB25
_free.LIBCMT ref: 0059BB7B

Part of subcall function 0059B957: _free.LIBCMT ref: 0059B9AF
Part of subcall function 0059B957: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00604560), ref: 0059B9C1
Part of subcall function 0059B957: WideCharToMultiByte.KERNEL32(00000000,00000000,006321DC,000000FF,00000000,0000003F,00000000,?,?), ref: 0059BA39
Part of subcall function 0059B957: WideCharToMultiByte.KERNEL32(00000000,00000000,00632230,000000FF,?,0000003F,00000000,?), ref: 0059BA66

Strings

`E`, xrefs: 0059BADE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID: `E`
API String ID: 314583886-1999292458
Opcode ID: e059aa99fd9abc3ecb1cc68444c59dd8122514b6b4bd63b58de8d9c987b8651b
Instruction ID: 3716a87100932fb302b8d1d10949413d776781dba531cbae1188cc38a72991c4
Opcode Fuzzy Hash: e059aa99fd9abc3ecb1cc68444c59dd8122514b6b4bd63b58de8d9c987b8651b
Instruction Fuzzy Hash: 2D21513280421967FF35A724AD85EFA7F6AFBC1320F100255E994A31C4EF704E85C591

Function 005D5594 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005D55A8
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 005D55FC
SetErrorMode.KERNEL32(00000000), ref: 005D5670

Strings

%lu, xrefs: 005D560F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 713d7a001becc8285d1f277460468051e6381d2f196a4cb76864741aafb99ef1
Instruction ID: 26d69a93dc6d8e2aa393d8069c5736a3b2548fcc2c7a544ef50a51f084833871
Opcode Fuzzy Hash: 713d7a001becc8285d1f277460468051e6381d2f196a4cb76864741aafb99ef1
Instruction Fuzzy Hash: 39317F74A00209AFDB10DF54C985EAA7BB9FF48304F144099E909DB362DB75EE45CB61

Function 005F4BA4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000,?,?,msctls_trackbar32,00000000,00000000,?,?,?,?,?,?,00000000), ref: 005F4C08
SendMessageW.USER32(?,00000406,00000000,00640000,?,00000000,?), ref: 005F4C1D
SendMessageW.USER32(?,00000414,0000000A,00000000,?,00000000,?), ref: 005F4C2A

Strings

msctls_trackbar32, xrefs: 005F4BDF

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 9287b82f4762d7b4c43588be3da8be92a5c40e4c2b80da4c9ed052368117c3d5
Instruction ID: 2a3923b216bf3eed0921b791c13ca045dd63a6173c4019d21688deae93fb9c67
Opcode Fuzzy Hash: 9287b82f4762d7b4c43588be3da8be92a5c40e4c2b80da4c9ed052368117c3d5
Instruction Fuzzy Hash: CF11CE31240208BEEF215F69CC06FBB3FA9FF95B64F024524FA55E20A0D675DC519B60

Function 0057514D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?,00573A41,?,?,?,?,?,00573992,?,?), ref: 00575182
DestroyWindow.USER32(?,00573A41,?,?,?,?,?,00573992,?,?), ref: 005751DF

Strings

(c, xrefs: 00575157
(c, xrefs: 005B8D1C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: DeleteDestroyObjectWindow
String ID: (c$(c
API String ID: 2587070983-3197731969
Opcode ID: 70b0e2de37877ef02066322a410bc7a3feb434ff3c38201ede76375ee7452387
Instruction ID: c672d8dd4e8ebab905b694c011139ef350937a05792c0d4b3d4a4a8a26724002
Opcode Fuzzy Hash: 70b0e2de37877ef02066322a410bc7a3feb434ff3c38201ede76375ee7452387
Instruction Fuzzy Hash: 46212974605607CFDB19DF16FC64B253BEABB54312F44A02DE4098B2A0EBB0AC44EB91

Function 00575C80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00575C71,SwapMouseButtons,00000004,?), ref: 00575CA4
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,?,00575C71,SwapMouseButtons,00000004,?,?,?,?,00574F9C), ref: 00575CC5
RegCloseKey.ADVAPI32(00000000,?,?,00575C71,SwapMouseButtons,00000004,?,?,?,?,00574F9C), ref: 00575CE7

Strings

Control Panel\Mouse, xrefs: 00575CA2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 09a00d293651114ad3e9c88017dd3f5827dc5a2de8fafaf7e6d649d777e54074
Instruction ID: aac96d6c4a221217cc6256761530da05db198aa64ca63be202aaf64a4419c268
Opcode Fuzzy Hash: 09a00d293651114ad3e9c88017dd3f5827dc5a2de8fafaf7e6d649d777e54074
Instruction Fuzzy Hash: B61148B2511608BEDB218F68EC84EAEBBBDFF04700F108469B809D7150E6719E45E760

Function 005F8B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00633FE0,00634024), ref: 005F8B8B
CloseHandle.KERNEL32 ref: 005F8B9D

Strings

$@c, xrefs: 005F8B56
?c, xrefs: 005F8B47

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: $@c$?c
API String ID: 3712363035-2560388587
Opcode ID: 7827d9e8e902f0a6321352599025189b80c59596dfc62fc57f3f1da03e1b90b8
Instruction ID: 7884a8fb9786293953dbc96a1e00e4aab7ca7321ce4a7b68db46fb0600d98bab
Opcode Fuzzy Hash: 7827d9e8e902f0a6321352599025189b80c59596dfc62fc57f3f1da03e1b90b8
Instruction Fuzzy Hash: 77F05EB1A40315BBE3106B61AC0AFB77E6EFB08754F001424FB08E6191DB7A590097F8

Function 005C111E Relevance: 6.3, APIs: 4, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27dd7728fb9576a3ff9a474fd014147a4c950cc6743956dbdefa6ef8af907d4b
Instruction ID: 64b8d5c4fce92ffdd6f4cfafdf0c4125b17dc8d06722f7326c4948023eaf08fd
Opcode Fuzzy Hash: 27dd7728fb9576a3ff9a474fd014147a4c950cc6743956dbdefa6ef8af907d4b
Instruction Fuzzy Hash: 4AC14679A00606EFCB04CF94C884FAABBB5FF49704F208598E905EB252D731ED81DB94

Function 00593D09 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00593D94
__alldvrm.LIBCMT ref: 00593F95
__alldvrm.LIBCMT ref: 00593FB7

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: d3d8ec98ca13f08299ac302b469ca78b8e828695f811a4e8be5073181c001c28
Instruction ID: e605def687fbe2a06c57439b174b18a71f834c13ab9b5664cd907e70c9c6a64e
Opcode Fuzzy Hash: d3d8ec98ca13f08299ac302b469ca78b8e828695f811a4e8be5073181c001c28
Instruction Fuzzy Hash: 5FA12236D04286DFDF228F18C8917AABFB5FF51350F184569E5859B281D2388E45CB50

Function 005E3F84 Relevance: 6.3, APIs: 4, Instructions: 271COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 005E3FAD
CoUninitialize.OLE32 ref: 005E3FB7
#8.OLEAUT32(?), ref: 005E3FC2
#9.WSOCK32(?), ref: 005E4296

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: InitializeUninitialize
String ID:
API String ID: 3442037557-0
Opcode ID: 1e39a225374918b3a64928789030d1e1344c7965974e1ea6aa18c21b3a141d64
Instruction ID: 8cbd218a1543a5f620a1bbdb915a6e22b9520fa66ef91df9b9854ef199e7ac1d
Opcode Fuzzy Hash: 1e39a225374918b3a64928789030d1e1344c7965974e1ea6aa18c21b3a141d64
Instruction Fuzzy Hash: 00A16B35604642EFCB14DF25C488A2ABBE1BF89720F04895CFA999B361CB35ED08CF41

Function 005A12C1 Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005A13F0

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d72b0be4c7f9b2b5bd998be37bacc08bbad47a2c703e6b734e8b08dd508a0e4a
Instruction ID: 3e3ce9aa221e3fb5b2d56076edfb4a410297ac60e0cd09a23b477ae4fc4c7291
Opcode Fuzzy Hash: d72b0be4c7f9b2b5bd998be37bacc08bbad47a2c703e6b734e8b08dd508a0e4a
Instruction Fuzzy Hash: 66415C31604912BBDF20BFBD8C4A67E3EB5FF97370F140A56F518D6591EA344801536A

Function 005F6C96 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?), ref: 005F6D05
ScreenToClient.USER32(?,?,?,?,?,?,?), ref: 005F6D38
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 005F6DA5

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 363e329d470ee428d6733da8d6c01a818cae567639cf8aee9fc37a71bdd6587a
Instruction ID: 9e6e2509ca5935a6b6a6f4ff544cc98932b19e179b88c29865373ef6cfb26d70
Opcode Fuzzy Hash: 363e329d470ee428d6733da8d6c01a818cae567639cf8aee9fc37a71bdd6587a
Instruction Fuzzy Hash: 8A513A35A00209EFCB24DF64D884ABE7BB6FF45320F208169FA55DB290D735AD81DB90

Function 005E26B2 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

#23.WSOCK32(00000002,00000002,00000011), ref: 005E26D9
#111.WSOCK32 ref: 005E26E7
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 005E2766
#111.WSOCK32 ref: 005E2770

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: #111
String ID:
API String ID: 568940515-0
Opcode ID: f7b138997fc3062d053b79b9f1e117b46011fac216ef40fbf80b3b9de9141e38
Instruction ID: cefdcad4d1928a053dca6793f0d0b2e4acc41e17a405af03ecf1106444263047
Opcode Fuzzy Hash: f7b138997fc3062d053b79b9f1e117b46011fac216ef40fbf80b3b9de9141e38
Instruction Fuzzy Hash: E441BF78600201AFE724AF25C88AF2A7BA5FF54714F54C458F95A8F2D3D672ED42CB90

Function 0059B24F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89c9d6d01d4b381e12302720f56726948a42208afcef8070a85ca1f241a7ce7
Instruction ID: 732931e09b65e031d21ac594a11d19ca7bd4dd7bf723fa1957cbf0011f18e692
Opcode Fuzzy Hash: c89c9d6d01d4b381e12302720f56726948a42208afcef8070a85ca1f241a7ce7
Instruction Fuzzy Hash: 0541F375A00705AFFF24EF78D945BAEBFA8FB89710F10492AE105DB281D771A9008780

Function 0059D6F3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,71E85006,00586C9C,00000000,00000000,00588204,?,00588204,?,00000001,00586C9C,71E85006,00000001,00588204,00588204), ref: 0059D740
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0059D7C9
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0059D7DB
__freea.LIBCMT ref: 0059D7E4

Part of subcall function 0059282E: HeapAlloc.KERNEL32(00000000,?,00000001,?,00580445,?,?,0056FA72,00000000,?,?,?,00561188,?), ref: 00592860

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID:
API String ID: 573072132-0
Opcode ID: da9613e0c77ecb069fe749b6648484ceec6bb02147f88c6e5e37ba6841e5be3a
Instruction ID: c418b0aac35a8b46879ae4165df4308d32ccd7703807fe57162f052897858b0c
Opcode Fuzzy Hash: da9613e0c77ecb069fe749b6648484ceec6bb02147f88c6e5e37ba6841e5be3a
Instruction Fuzzy Hash: 3B317A32A0021AABDF259FA4DC85EAE7FB5FB40710B140168FC04E6190EB35DD55CBA0

Function 005CB89A Relevance: 6.1, APIs: 4, Instructions: 108keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 005CB8EF
SetKeyboardState.USER32(00000080), ref: 005CB90B
PostMessageW.USER32(?,00000102,00000001,00000001,00000001,00000040,00000000), ref: 005CB979
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 005CB9CB

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e859145a62e33130f02fbc54bbe53db13dfd58ab3630bde117c56d317fc955ff
Instruction ID: 2cbe7c14cd43458097a2146e191b24420ac982a497d2e859566979f762ccbfb0
Opcode Fuzzy Hash: e859145a62e33130f02fbc54bbe53db13dfd58ab3630bde117c56d317fc955ff
Instruction Fuzzy Hash: 8931F870D44218AEFB218BA58C0AFFABFB6FB54310F04421EE685961D0C3758D4597A2

Function 005F5CEF Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005F5D71

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 3134ab9d59450a6942db9c16f1aec5bf68a8262ca032a0e14016e21617a1730a
Instruction ID: d593972b6d39dfabd84e16f182f8b52fb45e2836e9df0b2decf26132703a4480
Opcode Fuzzy Hash: 3134ab9d59450a6942db9c16f1aec5bf68a8262ca032a0e14016e21617a1730a
Instruction Fuzzy Hash: 5E31CD34A52A0DAFEB30AA14CC4DFF83F66BB04310F184102FB11D62E1E7396A40AB81

Function 005CB9E1 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,000CB67E,?,00008000), ref: 005CBA36
SetKeyboardState.USER32(00000080,?,00008000), ref: 005CBA52
PostMessageW.USER32(00000000,00000101,00000000,?,?,00008000), ref: 005CBAB9
SendInput.USER32(00000001,?,0000001C,000CB67E,?,00008000), ref: 005CBB0B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: afb57525598fec6ad2d5fae2eef4b6b3d1f3b8b9fd187e30967e24a73efb5d75
Instruction ID: 8578616203e60cfb68bd3936cc1b25828cae56e825638e014ad0f85d33911fa6
Opcode Fuzzy Hash: afb57525598fec6ad2d5fae2eef4b6b3d1f3b8b9fd187e30967e24a73efb5d75
Instruction Fuzzy Hash: AE312870A80608AEFB20CAA58C0AFFABFB6BF95310F08421EE4D5961D1D3398D45D761

Function 005F803B Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?,?,?,?,?,?,?,?,005F9573,?,?,?), ref: 005F8061
GetWindowRect.USER32(?,?), ref: 005F80D7
PtInRect.USER32(?,?,005F9573,?,?), ref: 005F80E7
MessageBeep.USER32(00000000,?,?,?,?,005F9573,?,?,?), ref: 005F8153

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 7faee71f697c19a0dc39a6b3dd4904deb3aea42836e7dae2d43a9a478604ff43
Instruction ID: 40e8b9b08080a399b5b780e31d174b519f8c8642ff8012791f215561d3662a4c
Opcode Fuzzy Hash: 7faee71f697c19a0dc39a6b3dd4904deb3aea42836e7dae2d43a9a478604ff43
Instruction Fuzzy Hash: 6941A03060021EDFCB11CF59D895E79BBFAFB49310F1442A9EA14CB260CB35A946DB90

Function 005F1FFD Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 005F200E

Part of subcall function 005C3E94: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?,?,?,?,?,005C368B), ref: 005C3EB2
Part of subcall function 005C3E94: GetWindowThreadProcessId.USER32(?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3EC3
Part of subcall function 005C3E94: GetCurrentThreadId.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ECA
Part of subcall function 005C3E94: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ED1

GetCaretPos.USER32(?), ref: 005F2022
ClientToScreen.USER32(00000000,?), ref: 005F206F
GetForegroundWindow.USER32 ref: 005F2075

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputMessageProcessScreenSendTimeout
String ID:
API String ID: 4059344798-0
Opcode ID: b5cb7425f514f9c15b22750674abf5c7853c05f9e7bbf3055e5423fefdfc3b9c
Instruction ID: 520839f0ca88c6b9ea1397a3d3709fe717324d0e58c04723c17784b8c36eabb3
Opcode Fuzzy Hash: b5cb7425f514f9c15b22750674abf5c7853c05f9e7bbf3055e5423fefdfc3b9c
Instruction Fuzzy Hash: CF312375D00209AFCB10DFA5C889DAEBFFDFF98304B50806AE515D7211DA759E45CBA0

Function 005CEDF0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00572306: _wcslen.LIBCMT ref: 0057230B

_wcslen.LIBCMT ref: 005CEE26
_wcslen.LIBCMT ref: 005CEE3D
_wcslen.LIBCMT ref: 005CEE68
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 005CEE73

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: cc3ba3b814dbc7dc974a44987b0f4476792a48f05599c09d9f46e6ad4751ca21
Instruction ID: dd75c8dabf1692996174aa2765e50cd7af4eb292af473213a60d3b0b31eea448
Opcode Fuzzy Hash: cc3ba3b814dbc7dc974a44987b0f4476792a48f05599c09d9f46e6ad4751ca21
Instruction Fuzzy Hash: 0C21B171D40216AFCB10AFA4D986BAEBFFCFF85350F104069ED08BB281D6709D018BA1

Function 005C03B2 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

TranslateAcceleratorW.USER32(?,00000000,?), ref: 005C0422
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005C0466

Part of subcall function 005759E7: IsDialogMessageW.USER32(00000000,?,00000000,?,000CB88A,00632890,?,0056AB4F,?), ref: 00575A21

TranslateMessage.USER32(?,?), ref: 005C044B
DispatchMessageW.USER32(?), ref: 005C0455

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Message$Translate$AcceleratorDialogDispatchPeek
String ID:
API String ID: 1911789232-0
Opcode ID: a810325551a93470c1efa302505593adb57c72333554ba73d987d3bb429eeace
Instruction ID: edafbaf7bea422e27a3c3a2614881a10e0d19d2f7700fac4b2494cb77a15201f
Opcode Fuzzy Hash: a810325551a93470c1efa302505593adb57c72333554ba73d987d3bb429eeace
Instruction Fuzzy Hash: 4B31B170904342DFEF298BB4D898FB73FE9BB15304F14296DD566C20E0E6789888DB91

Function 005F99F9 Relevance: 6.1, APIs: 4, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

GetCursorPos.USER32(?,?,?,?,?,?,?,?,005B8560,?,?,?,?,?), ref: 005F9A33
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,005B8560,?,?,?,?,?), ref: 005F9A48
GetCursorPos.USER32(?,?,?,?,?,?,?,?,?,005B8560,?,?,?,?,?), ref: 005F9A92
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,005B8560,?,?,?), ref: 005F9AC8

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 3e4d59411e6a062e0988a7f8a1ef5943dbd82c768b39da2dcf0804684b01d96d
Instruction ID: 3babc496219142561cd617df9a4fa7602bf18de2e6a4f39673af6ba1859c043d
Opcode Fuzzy Hash: 3e4d59411e6a062e0988a7f8a1ef5943dbd82c768b39da2dcf0804684b01d96d
Instruction Fuzzy Hash: 7521603560041CEFCB158F99D858EFA7FBAFB89710F144055FA4997261C3399D50EBA0

Function 005CE098 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(000CACA2,005FD934,000CACA2), ref: 005CE0D2
GetLastError.KERNEL32 ref: 005CE0E1
CreateDirectoryW.KERNEL32(000CACA2,00000000), ref: 005CE0F0
CreateDirectoryW.KERNEL32(000CACA2,00000000,00000000,000000FF,005FD934), ref: 005CE14D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 4f0a5e24c8a51ed8498e77d5aa31717ba2e25bcc247f1008a3a7f25fcd89dd21
Instruction ID: 27a8292152577105ec6e7e73e296f6db88697f648ce1b9337f14e261dfd8c20f
Opcode Fuzzy Hash: 4f0a5e24c8a51ed8498e77d5aa31717ba2e25bcc247f1008a3a7f25fcd89dd21
Instruction Fuzzy Hash: 4321A3305092029F8700DF68D88696B7FE8FE56764F144A1DF499C72A1DB30DD5ACB92

Function 005F30A0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 005F3353: IsWindow.USER32(00000000,?,000CB88A,00000000,?,005AA532,00000001), ref: 005F3384

GetWindowLongW.USER32(?,000000EC,00000001,?), ref: 005F3128
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005F3142
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005F3150
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 005F315E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 0ffaf654044dd74b17dbd810c451c978140c1707f3123a8dc47bf1752525e0cf
Instruction ID: 369b2329e85d982a2d7435cbb148303c70a3f9f4d686b302603db9bb5d9303d4
Opcode Fuzzy Hash: 0ffaf654044dd74b17dbd810c451c978140c1707f3123a8dc47bf1752525e0cf
Instruction Fuzzy Hash: B921C131208116AFE714DB14C849F7ABFA9BF85324F148658F526CB2D2CB79EE45CB90

Function 005C87B9 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C9C5A: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,005C87CE,?,000000FF,?,005C9624,00000000,?,0000001C,?,?), ref: 005C9C69
Part of subcall function 005C9C5A: lstrcpyW.KERNEL32(00000000,?,?,005C87CE,?,000000FF,?,005C9624,00000000,?,0000001C,?,?,00000000), ref: 005C9C8F
Part of subcall function 005C9C5A: lstrcmpiW.KERNEL32(00000000,?,005C87CE,?,000000FF,?,005C9624,00000000,?,0000001C,?,?), ref: 005C9CC0

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,005C9624,00000000,?,0000001C,?,?,00000000), ref: 005C87E7
lstrcpyW.KERNEL32(00000000,?,?,005C9624,00000000,?,0000001C,?,?,00000000), ref: 005C880D
lstrcmpiW.KERNEL32(00000002,cdecl,?,005C9624,00000000,?,0000001C,?,?,00000000), ref: 005C8848

Strings

cdecl, xrefs: 005C883F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: f748c44ec1bea49f13d6209a8204dbbe2986dda8a744d05382f211317fc86c41
Instruction ID: 0bfbd34b53d1fd38c5b764ae2167f0556dbad55b9fe784c68e8093d374090aa6
Opcode Fuzzy Hash: f748c44ec1bea49f13d6209a8204dbbe2986dda8a744d05382f211317fc86c41
Instruction Fuzzy Hash: A511033A200302AFCB146F74C858E7A7BA9FF85750B80842EF906C72A0EF319801D7A0

Function 00591B2A Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2305cf5673963894b1d0467e727b6d318b1f985de789745f088ed73db263313c
Instruction ID: bd3ea628ef1a7ed93d71c0d19287a530ed3a1c2bb929b74cd945ef9bca20c1d0
Opcode Fuzzy Hash: 2305cf5673963894b1d0467e727b6d318b1f985de789745f088ed73db263313c
Instruction Fuzzy Hash: BE018FB2609B277EFE2016B96CC4F7B6A1FEF813B8F340725B521A51D0EA648C019164

Function 005C2B43 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 005C2B63
SendMessageW.USER32(?,000000C9,?,00000000,?,000000B0,?,?), ref: 005C2B75
SendMessageW.USER32(?,000000C9,?,00000000,?,000000C9,?,00000000,?,000000B0,?,?), ref: 005C2B8B
SendMessageW.USER32(?,000000C9,?,00000000,?,000000C9,?,00000000,?,000000C9,?,00000000,?,000000B0,?,?), ref: 005C2BA6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 884327fc4ec3df30756f1cd6080a413174597e320141037460d29dfeef4b16a4
Instruction ID: 1248c6133da84ed4a0ffff1fb1efa4d65838b800469a600b2b000d36ea7a98ab
Opcode Fuzzy Hash: 884327fc4ec3df30756f1cd6080a413174597e320141037460d29dfeef4b16a4
Instruction Fuzzy Hash: 7911277A900218FFEB109FA4CD85FADFB78FB08714F204095EA00B7290D6716E10DB94

Function 00573AE2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00574E5A: GetWindowLongW.USER32(00000000,000000EB,?,00000000,?,005B8DDF,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00574E6B

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00573B2A
GetClientRect.USER32(?,?,?,?,?), ref: 005B8152
GetCursorPos.USER32(?), ref: 005B815C
ScreenToClient.USER32(?,?), ref: 005B8167

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 47ae5fd75c4c0930d79c223df55d1d596e2b1fe8f8a566421a842545d966ff39
Instruction ID: 588cff7f4188e00b0d2a6bd218ab1465f8415df4c836a8be65365ab6f6feb98c
Opcode Fuzzy Hash: 47ae5fd75c4c0930d79c223df55d1d596e2b1fe8f8a566421a842545d966ff39
Instruction Fuzzy Hash: 31113631A1101AFBCB10DFA8E8899FE7BB9FB49310F104451E919E3100D734BA96EBB1

Function 005CF018 Relevance: 6.1, APIs: 4, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005CF03F
MessageBoxW.USER32(?,?,?,?), ref: 005CF072
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 005CF088
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 005CF08F

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 34e58d2b67ef645a04a1854e82c3b637dcdf63b1a687a007bec4ea8c17a819d1
Instruction ID: e4a76f7a1493dc44930abe9a533d7e3ae4642bedbd9d43fd7e4d9fbbcd7c7c06
Opcode Fuzzy Hash: 34e58d2b67ef645a04a1854e82c3b637dcdf63b1a687a007bec4ea8c17a819d1
Instruction Fuzzy Hash: 9511E572900259AFD7009FA89C08EAB7FBEFB45320F144269F815E3291D6768904C7F1

Function 0058D06B Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0058CE98,00000000,00000004,00000000), ref: 0058D0B7
GetLastError.KERNEL32 ref: 0058D0C3
__dosmaperr.LIBCMT ref: 0058D0CA
ResumeThread.KERNEL32(00000000), ref: 0058D0E8

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 0eaf2d3818da5b44d3e06ff86e0a5a0f6dfdc2bf95e77ab2287e00347b9cdcc5
Instruction ID: 4a37ee16b02244aeb5d791832a4f2a3fe808ffd53cb70d1525995f65a474b79c
Opcode Fuzzy Hash: 0eaf2d3818da5b44d3e06ff86e0a5a0f6dfdc2bf95e77ab2287e00347b9cdcc5
Instruction Fuzzy Hash: 5501AD32400205BBDB216BA5DC0DAAA7FBAFB81331F204615FD28A61E0EB708805D7B1

Function 005CF6C9 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 005CEC33: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005CDCD6,?), ref: 005CEC50

GetFileAttributesW.KERNEL32(?,00000000,?,005CF417,?,?,?), ref: 005CF6F4
RemoveDirectoryW.KERNEL32(?,?,005CF417,?,?,?), ref: 005CF70E
_wcslen.LIBCMT ref: 005CF71B
SHFileOperationW.SHELL32(?,?,005CF417,?,?,?), ref: 005CF759

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: File$AttributesDirectoryFullNameOperationPathRemove_wcslen
String ID:
API String ID: 3674178553-0
Opcode ID: ed28c57f42f14f5cca8ffd82530db07d2375b18ee431b113de0accf68435e926
Instruction ID: bfeb3617ac05f908e2f9680837bbd3aa1c85841da4d42ccfeb548b33c014b9d8
Opcode Fuzzy Hash: ed28c57f42f14f5cca8ffd82530db07d2375b18ee431b113de0accf68435e926
Instruction Fuzzy Hash: 1F113A71D0020A8FCF01DFB89949BED7BFAFF09300F1405AAE419E3191EB7896848B60

Function 00574570 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00574473), ref: 005745AE
GetStockObject.GDI32(00000011,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?,?), ref: 005745C2
SendMessageW.USER32(00000000,00000030,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?), ref: 005745CC

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 12cac1a7cd45948e6a221c66619474cf1609977d976d90bb7a8e8fa105242044
Instruction ID: fe91a0a3e56fdec04aa85414dbe5a1525bfd3305451fcde43a75ba91bda993bf
Opcode Fuzzy Hash: 12cac1a7cd45948e6a221c66619474cf1609977d976d90bb7a8e8fa105242044
Instruction Fuzzy Hash: 7F113972501569BFDB165F90AC84AEA7F6EFF18394F048115FA0896120DB359C60EFA0

Function 005C831E Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 005C8339
#183.OLEAUT32(?,00000002,?,00000000), ref: 005C8351
#163.OLEAUT32(?,?,00000000), ref: 005C8366
#442.OLEAUT32(?,?,00000000), ref: 005C8384

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: #163#183#442FileModuleName
String ID:
API String ID: 2875472535-0
Opcode ID: 7f55d903ae8e681f50345614920c4dd439bf9d7a385d06409c61573e1b287f4b
Instruction ID: 58cd583d974961d9e8f2b7b3194aeef82be96ca99aac0bb306940633edeb7f3d
Opcode Fuzzy Hash: 7f55d903ae8e681f50345614920c4dd439bf9d7a385d06409c61573e1b287f4b
Instruction Fuzzy Hash: 761130B12017449FE7208F94DD08FA67BB9FB04F00F10495DA656D6190DBB4E944EBA0

Function 00592F4A Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00592EF1,?,00000000,00000000,00000000,?,00593162,00000006,FlsSetValue), ref: 00592F7C
GetLastError.KERNEL32(?,00592EF1,?,00000000,00000000,00000000,?,00593162,00000006,FlsSetValue,0060311C,00603124,00000000,00000364,?,00592D1D), ref: 00592F88
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00592EF1,?,00000000,00000000,00000000,?,00593162,00000006,FlsSetValue,0060311C,00603124,00000000), ref: 00592F96

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 12f0e8ee825d0a8af5555617ea299a85e7f38be21281507dde64267f30159cf8
Instruction ID: 9bf999e43d81f6ea5652dc37eb2b87d80d41f678c47a031950ed65274843b4e4
Opcode Fuzzy Hash: 12f0e8ee825d0a8af5555617ea299a85e7f38be21281507dde64267f30159cf8
Instruction Fuzzy Hash: F001F732655226BBCF218B79AC45E677FB9BF15BA0F200A24F90AD7180D721D805C6F0

Function 005CBEF3 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,005CBB18,?,00008000), ref: 005CBF0F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,005CBB18,?,00008000), ref: 005CBF34
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,005CBB18,?,00008000), ref: 005CBF3E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,005CBB18,?,00008000), ref: 005CBF71

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: effbcd3070d280ba75d3554fb97cda798277588c8ab4d5334cfa001b0860c8ca
Instruction ID: 4e79016e74593adda5c0ee953d8017cab7d2c5a56c635a7c380c7cf7e9624c39
Opcode Fuzzy Hash: effbcd3070d280ba75d3554fb97cda798277588c8ab4d5334cfa001b0860c8ca
Instruction Fuzzy Hash: 34113031C0152DEBDF009BE4ED4ABEEBF78BB19311F00459AE840B2240CB305A50DBA1

Function 005F87CE Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 005F87ED
ScreenToClient.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 005F8805
ScreenToClient.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 005F8829
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F8844

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e216cbcd948c4502040931ed669255cc8cbbefc4c7567053b2b18098f64ac83d
Instruction ID: 74150d3f7b14b163849f518cdb01be86eacc4192cba5df26aa8980fa38a3916d
Opcode Fuzzy Hash: e216cbcd948c4502040931ed669255cc8cbbefc4c7567053b2b18098f64ac83d
Instruction Fuzzy Hash: 4B1132B9D0020DEFDB41CF99C884AAEBBB9FB18310F108156E914E2210D735AA54DF51

Function 005C4DB6 Relevance: 6.0, APIs: 4, Instructions: 42windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 005C4DD0
SendMessageW.USER32(?,0000000C,00000000,?,?,00000000,00000000,00000000,00000002,00001388,?), ref: 005C4DE4
GetParent.USER32(?,00000000,00000001,?,0000000C,00000000,?,?,00000000,00000000,00000000,00000002,00001388,?), ref: 005C4DF9
InvalidateRect.USER32(00000000,?,00000000,00000001,?,0000000C,00000000,?,?,00000000,00000000,00000000,00000002,00001388,?), ref: 005C4E00

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend$InvalidateParentRectTimeout
String ID:
API String ID: 3648793173-0
Opcode ID: 0bafb96dd5046cbc5b5da1d22309ffdaf5ba8f36f5c867e09cc3719cff885c9d
Instruction ID: fd99a9f6e96206b589068c8b9b74344a75fb8f9490cda0917a2e0fbddb95e3ee
Opcode Fuzzy Hash: 0bafb96dd5046cbc5b5da1d22309ffdaf5ba8f36f5c867e09cc3719cff885c9d
Instruction Fuzzy Hash: 61F04935200244BBEB305FA6DC0DFA77FBDFBA2B40F01415AB945C60A0C6A69804EAB1

Function 005C3E94 Relevance: 6.0, APIs: 4, Instructions: 35threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?,?,?,?,?,005C368B), ref: 005C3EB2
GetWindowThreadProcessId.USER32(?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3EC3
GetCurrentThreadId.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ECA
AttachThreadInput.USER32(00000000,?,00000000,00000000,?,?,?,?,005C368B), ref: 005C3ED1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 02d52610dffe1d4ceb9ec91638de9e598b0c406f8b0838cc20ea3d2309aeeb75
Instruction ID: a92244225494b672b0cdf3453e2277c89e355e95cd13c57bde9700831c7248b6
Opcode Fuzzy Hash: 02d52610dffe1d4ceb9ec91638de9e598b0c406f8b0838cc20ea3d2309aeeb75
Instruction Fuzzy Hash: 40E065315012287AD7205BA2AC0DFFB7F2DEB52B61F000019F508D60909AA99944E2F1

Function 005F924C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00573B38: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00573B92
Part of subcall function 00573B38: SelectObject.GDI32(?,00000000), ref: 00573BA1
Part of subcall function 00573B38: BeginPath.GDI32(?), ref: 00573BB8
Part of subcall function 00573B38: SelectObject.GDI32(?,00000000,000000FF,00000000), ref: 00573BE1

MoveToEx.GDI32(?,00000000,00000000,00000000,?,00000000,000000FF,00000002,00000001,?,?,005F935D,?,?,?,00000000), ref: 005F9270
LineTo.GDI32(?,?,?,?,005F935D,?,?,?,00000000,00000000,?), ref: 005F927D
EndPath.GDI32(?,?,005F935D,?,?,?,00000000,00000000,?), ref: 005F928D
StrokePath.GDI32(?,?,005F935D,?,?,?,00000000,00000000,?), ref: 005F929B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: cd0488a8b78cc04da605cb900c7b5679685fbb36d3dab60ed896a229d6490ed6
Instruction ID: cb601e9250d6be4de431148ae2629dd3bfbdf3aef1018184b58c3a0a46ad1cbd
Opcode Fuzzy Hash: cd0488a8b78cc04da605cb900c7b5679685fbb36d3dab60ed896a229d6490ed6
Instruction Fuzzy Hash: 2BF0823204165ABBDB126F55AC0EFEE3F6BAF26321F048000FB11A10E18B795515EFE6

Function 0058105B Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0058106D
GetCurrentThreadId.KERNEL32 ref: 0058107C
GetCurrentProcessId.KERNEL32 ref: 00581085
QueryPerformanceCounter.KERNEL32(?), ref: 00581092

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d641dee1b04c360aa91fc028b997ad56602262c6f79352171bf7423ff7264761
Instruction ID: d076c3910ab7ccd13d281f853d7b60f9791f0464b804607c3b7e1cb89a64d30d
Opcode Fuzzy Hash: d641dee1b04c360aa91fc028b997ad56602262c6f79352171bf7423ff7264761
Instruction Fuzzy Hash: A4F04D71C1020DEBCB00DBB4D949AAEBBB9EF18215F514996E901E7150E638AB08EB61

Function 00574A5F Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00574A7B
SetTextColor.GDI32(?,?), ref: 00574A85
SetBkMode.GDI32(?,00000001), ref: 00574A98
GetStockObject.GDI32(00000005), ref: 00574AA0

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: d4e55a4d7f4ba108309ca5d73673236effbf7aaaa7135220b59bf8b556a8d936
Instruction ID: 824cf0ad3e28182f2491d08a781480e2acddc45066ccd2b3153d9bbb7ce84d71
Opcode Fuzzy Hash: d4e55a4d7f4ba108309ca5d73673236effbf7aaaa7135220b59bf8b556a8d936
Instruction Fuzzy Hash: D5E03031684644AADB205B74AC19BF97F66BB21332F048219FAB9840E0C7720554EB21

Function 005C273F Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32(00000028,00000000,?,00000000,005C2193,?,?,?,005C22E5), ref: 005C2748
OpenThreadToken.ADVAPI32(00000000,?,?,?,005C22E5), ref: 005C274F
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005C22E5), ref: 005C275C
OpenProcessToken.ADVAPI32(00000000,?,?,?,005C22E5), ref: 005C2763

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 9e959dbe05733cd148c3092f274e3565981c595bb1fb901dbf9519b68edd67c4
Instruction ID: 4c8f62529eb22b370750401d913c1c9c4548d321ced374d7eaa5e39240c0c117
Opcode Fuzzy Hash: 9e959dbe05733cd148c3092f274e3565981c595bb1fb901dbf9519b68edd67c4
Instruction Fuzzy Hash: B1E086326412119BD7201FF09D0CF663BBDEF607D2F108818B646C9094EA7C8449D771

Function 005A56F9 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 005A56F9
GetDC.USER32(00000000), ref: 005A5703
GetDeviceCaps.GDI32(00000000,0000000C), ref: 005A570F
ReleaseDC.USER32(00000001,?,?,?,?), ref: 005A5730

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: a1d6a18ce848ea9b4667022296cce271b271d5f48e5e461eac9a96f157b5fa98
Instruction ID: 372ba12e5e8efdb36445a611b7c8fc6f52fa8b3ee2a11f5c2b8d100e4aca7065
Opcode Fuzzy Hash: a1d6a18ce848ea9b4667022296cce271b271d5f48e5e461eac9a96f157b5fa98
Instruction Fuzzy Hash: 3CE01AB5800200EFCF119FA0880CA6DBFF6FB5C321F118445E81AE3210DB385A45EF10

Function 005D79DD Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005D7A56
GetFileAttributesW.KERNEL32(?,005FD934), ref: 005D7B2E

Part of subcall function 005727CA: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,0057058E,?,00000001), ref: 005727FC

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 005D7A4A, 005D7A62

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AttributesFileLibraryLoad_wcslen
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 3802351006-2806939583
Opcode ID: 4813990665caaa25ec8b1a052684065dda68cdbe484a7d65cfc7b7e8637e8333
Instruction ID: 43553190bb22c03c8c54d06b8c11a295bb809177a9a0e91a382cb9d84391bfb7
Opcode Fuzzy Hash: 4813990665caaa25ec8b1a052684065dda68cdbe484a7d65cfc7b7e8637e8333
Instruction Fuzzy Hash: ADA19331508206DFC724EF24D895E6EBBE5BF98704F04496EF496572A1EB30EE48CB52

Function 005D592D Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00572306: _wcslen.LIBCMT ref: 0057230B

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 005D5A7F

Strings

*, xrefs: 005D59B6
LPT, xrefs: 005D59A1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: d231deff529416337e87564185d8c23631433a84bfca77a8ab8865ee6613e121
Instruction ID: 4d132cb1813477e1f5dcfa534424d30a635c4f2b6573072a21bcaea62408b4b7
Opcode Fuzzy Hash: d231deff529416337e87564185d8c23631433a84bfca77a8ab8865ee6613e121
Instruction Fuzzy Hash: E4A15A75A00604DFDB24DF58C494EA9BFB1BF44314F18809BE84A9B3A2D775EE85CB50

Function 0058E11D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0058E1AD

Strings

pow, xrefs: 0058E185, 0058E1A2

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 59e9e45720a2cc7c91a42fc091660e104cc35fc277b0e6eb5c0e4c6eea6eb3ae
Instruction ID: 2e8fbd55fb8973c2141e29c263cd571fad562d19d92d2a98414e966114b069fa
Opcode Fuzzy Hash: 59e9e45720a2cc7c91a42fc091660e104cc35fc277b0e6eb5c0e4c6eea6eb3ae
Instruction Fuzzy Hash: D9517D71A2C50796DF157714C94737A2FB8BF84B01F208D5AE8C2922E9EB348C94DB86

Function 0057F8E4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

#, xrefs: 0057F90E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 55c6e64edbbc01fc47e63a6f4ddbea737554b86da4f101f1d92e0103c6567115
Instruction ID: 831a577da4fb7e7ff298d2dbb43dc7cdd437aaaedcc37251272b0ce600af2c7f
Opcode Fuzzy Hash: 55c6e64edbbc01fc47e63a6f4ddbea737554b86da4f101f1d92e0103c6567115
Instruction Fuzzy Hash: E1510331904246EFDF15DF28D8A5AFABFA1FF55310F248066EC919B290D734AD42DBA0

Function 0056C9A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0056C9B1
GlobalMemoryStatusEx.KERNEL32(?), ref: 0056C9CA

Strings

@, xrefs: 0056C9BE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 82dbeeddf35adc54aefed3d88800218382a764b8e700e67fb482f475a6e377d3
Instruction ID: d9f3a8552c4d0f91b6ce544adedb544e62b1bee1c404db8ffd1fc4a74ea30bfd
Opcode Fuzzy Hash: 82dbeeddf35adc54aefed3d88800218382a764b8e700e67fb482f475a6e377d3
Instruction Fuzzy Hash: BD5138725087459BD320AF10D88ABAFBBF8FBC4310F41884DF5D8821A5EF708529CB66

Function 005E630A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,00000000,?), ref: 005E63A7
_wcslen.LIBCMT ref: 005E63B2

Strings

CALLARGARRAY, xrefs: 005E63AD, 005E63BE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 8857493ce6be36a7b2b6b380a36cf2e568aaf06fe077045b998f2b3afc204ab8
Instruction ID: 5e7f3c925679a478c5ced4b491dac2a08834ef1b08613135d309b69a40bce440
Opcode Fuzzy Hash: 8857493ce6be36a7b2b6b380a36cf2e568aaf06fe077045b998f2b3afc204ab8
Instruction Fuzzy Hash: 7041D171E002199FCF14EF99C889ABEBFB1FF69354F408068E904AB291E7759D45CB90

Function 005DDBE9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005DDC25
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 005DDC2F

Strings

|, xrefs: 005DDC00

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: dd97369623c6af85bf736ccc80fb31b9f6ffdc49dbfbc90387638c0d55d7fbcf
Instruction ID: 52ad8500b80241151d3457bc1a19bfcb8d1b9615ab13effeceb93707c564f7ea
Opcode Fuzzy Hash: dd97369623c6af85bf736ccc80fb31b9f6ffdc49dbfbc90387638c0d55d7fbcf
Instruction Fuzzy Hash: 3C315071C0111AABDF11EFA4DC89EEEBFB9FF54300F00406AF915A6262EB719915DB60

Function 005CD166 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 005CD210

Strings

0, xrefs: 005CD1CE
p)c, xrefs: 005CD195

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: InfoItemMenu
String ID: 0$p)c
API String ID: 1619232296-2355081387
Opcode ID: 7b3492b1c6fed84f9b4760ee1937101d025c7bd0f91715b13cb42d2b84151ebd
Instruction ID: 1643211c2edbf4d08faddcf5c65cc74bc89b3444f5c262a875e018665ef48377
Opcode Fuzzy Hash: 7b3492b1c6fed84f9b4760ee1937101d025c7bd0f91715b13cb42d2b84151ebd
Instruction Fuzzy Hash: 9831CDB6900206AFEB249FA8C845BAABBB5FB09350F194138E955E7290D774D904CBA0

Function 005F4F02 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?,?,?,?), ref: 005F4FEE
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005F5003

Strings

', xrefs: 005F4F5D

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 9a348cc63e70db65fd5719fc63fb9967564715e2eb6da73944d0ed54d837a711
Instruction ID: dbb58a646dcc83495c8ec9bfecc97037aaf7eb92d46950eadd00ef7ce917ccaa
Opcode Fuzzy Hash: 9a348cc63e70db65fd5719fc63fb9967564715e2eb6da73944d0ed54d837a711
Instruction Fuzzy Hash: B7411874A0130E9FDB14CF69C890BEABBB5FF49300F10416AEA08AB391D775A955DF90

Function 005F3F02 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 005F3FB7
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 005F3FF2

Strings

static, xrefs: 005F3F52

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 85d7a9b7b1297d7d3ebbde8f7af2fa3c174cacd0386381e840906e2da237e4dd
Instruction ID: 7d2d0cb34bfc6eec6ee0a53fbdabc9236fc2afd0d096c1cf4e5f9cfd5c4b758a
Opcode Fuzzy Hash: 85d7a9b7b1297d7d3ebbde8f7af2fa3c174cacd0386381e840906e2da237e4dd
Instruction Fuzzy Hash: A531A471510609AEEB109F34DC84AFB7BB9FF88724F008619F9A9C7190DB38AD85D760

Function 005F3B74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?,?,?,Combobox,00000000,00000000,?,?,?,?,?,?,00000001), ref: 005F3C01
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005F3C0C

Strings

Combobox, xrefs: 005F3BCE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: fdd965f6e683c63b63686692860acd570c4059a7f5fab8c0a048aa275ed3776f
Instruction ID: 50341072013bee380c7a32ed0b5c25e65bf3745f88907754636718f5a1073668
Opcode Fuzzy Hash: fdd965f6e683c63b63686692860acd570c4059a7f5fab8c0a048aa275ed3776f
Instruction Fuzzy Hash: 6F11907120020DAFFF219F14DC90EBB3BAAFB843A4F114529FA5897290D639DD518BA0

Function 005F40A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00574570: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00574473), ref: 005745AE
Part of subcall function 00574570: GetStockObject.GDI32(00000011,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?,?), ref: 005745C2
Part of subcall function 00574570: SendMessageW.USER32(00000000,00000030,00000000,?,?,?,00574473,?,?,static,005FD938,?,?,?,?,?), ref: 005745CC

GetWindowRect.USER32(00000000,?,?,?,static,?,00000000,?,?,?,00000001,?,?,00000001,?), ref: 005F4110
GetSysColor.USER32(00000012,?,?,static,?,00000000,?,?,?,00000001,?,?,00000001,?), ref: 005F412A

Strings

static, xrefs: 005F40ED

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 31232d82fce8cb9e6b3619b9caf863fa7db490770a71a7bf29ec6ab35351c371
Instruction ID: 483f0f4d1b930eda77f2454cd25d71b8c34e6d153d9729c028e02104f696a117
Opcode Fuzzy Hash: 31232d82fce8cb9e6b3619b9caf863fa7db490770a71a7bf29ec6ab35351c371
Instruction Fuzzy Hash: 7221E77261020AAFDB01DFA8DC85EFA7BB9FB18314F014915F959D3250E639E861DB60

Function 005DD82F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000,?,?,00000003,?,?,?,005DCE93,?,?,?), ref: 005DD88E
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 005DD8B7

Strings

<local>, xrefs: 005DD877

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 511a2140c34542bfa6faa57d675a540e274ede2b83f3b57fe719cb2b94994abb
Instruction ID: b2fa4daeadc98a604867b173bd46e7e2f37915c2ff53398a8ebb88d0e63a9bdc
Opcode Fuzzy Hash: 511a2140c34542bfa6faa57d675a540e274ede2b83f3b57fe719cb2b94994abb
Instruction Fuzzy Hash: BA11E071605231BAD7394A6A9C49FF3BF7DFF127A0F00421BF51983280D6609944E6F0

Function 005710B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 005B71AE

Part of subcall function 0056119F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00561192,?), ref: 005611BF

Part of subcall function 0057FDB9: GetLongPathNameW.KERNEL32(?,?,00007FFF,?,?,?,005710EA), ref: 0057FDD8

Strings

(sb, xrefs: 005B7192
X, xrefs: 005B717C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: (sb$X
API String ID: 779396738-2433923972
Opcode ID: 9bc8e3ba14d82c2e4926583951946c3dc06451c90b36b3ec6dadcab2bc43da9e
Instruction ID: 3c9fafb938dfe44b38c2a6634067703f4147e5d5460692ce10e1a9f524d5ebe9
Opcode Fuzzy Hash: 9bc8e3ba14d82c2e4926583951946c3dc06451c90b36b3ec6dadcab2bc43da9e
Instruction Fuzzy Hash: 1721D871A04258ABCB01DF98D809BEE7FFDBF89710F00805AE908E7241DBB45949DFA5

Function 005F3DBF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000,?,?,edit,?,00000000,?,?,?,?,?,?,00000001,?), ref: 005F3E41
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 005F3E50

Strings

edit, xrefs: 005F3E25

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 67a7111f992a17cc0d972d44621206aac7a1a8c27162d0b4388dd1d8580de1a8
Instruction ID: 9bf10ee9397d51478356fa737a8800772c01227e2ed1d37d307ee852a5e3f5b7
Opcode Fuzzy Hash: 67a7111f992a17cc0d972d44621206aac7a1a8c27162d0b4388dd1d8580de1a8
Instruction Fuzzy Hash: 66115871110209ABEB109E68DC85ABB3B6EFF143A8F204724FB64D71E0C639DC55AB60

Function 005CD287 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 005CD319

Strings

0, xrefs: 005CD2F0
p)c, xrefs: 005CD2C3

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: InfoItemMenu
String ID: 0$p)c
API String ID: 1619232296-2355081387
Opcode ID: 9159a7df77c27d788d8cc0d4660e0d66691df5389ff463cbf4cbc1fe934c8c53
Instruction ID: ca63e132c41e27c1781d8957605d81ac63415b59aceae5c309683481a17fa398
Opcode Fuzzy Hash: 9159a7df77c27d788d8cc0d4660e0d66691df5389ff463cbf4cbc1fe934c8c53
Instruction Fuzzy Hash: CA11BB75D05216AFDB21EAD8D844FA9BBB9BB06B10F040539E805E7291D330EE05C7A2

Function 005C2E06 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005C4D36: GetClassNameW.USER32(?,?,000000FF), ref: 005C4D59

SendMessageW.USER32(?,000001A2,000000FF,?,?,?,ListBox,?,?,ComboBox), ref: 005C2E74

Strings

ListBox, xrefs: 005C2E3E
ComboBox, xrefs: 005C2E13

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 4f9949a896d3495d6a8016f2366e13dba4fe32130a5ca1194bd9dbe23bd544c6
Instruction ID: 56be99540f0ce1463d707307d94fc30204f7d1fe86f630a7e8f328fc7c268488
Opcode Fuzzy Hash: 4f9949a896d3495d6a8016f2366e13dba4fe32130a5ca1194bd9dbe23bd544c6
Instruction Fuzzy Hash: 5F01B97194111A6FCB14EBE4DC65DFE7B6ABF52320B004B19B862673C1DE3058089750

Function 005C2CFE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005C4D36: GetClassNameW.USER32(?,?,000000FF), ref: 005C4D59

SendMessageW.USER32(?,00000180,00000000,?,?,?,ListBox,?,?,ComboBox), ref: 005C2D6C

Strings

ListBox, xrefs: 005C2D36
ComboBox, xrefs: 005C2D0B

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a9d61e9a1ca9c3514c0fd904e7bb6fa3310fd1fc40e9fcf1ebc0aa3af973caf6
Instruction ID: 5019716b433c0af3898ad3efbdd75abcdf1959c95309debab29fa863a556789b
Opcode Fuzzy Hash: a9d61e9a1ca9c3514c0fd904e7bb6fa3310fd1fc40e9fcf1ebc0aa3af973caf6
Instruction Fuzzy Hash: 6C01D471A4010A6BCB14E7E0D96AFFE7BB9BF61340F1005297803A3281DA245E0997B1

Function 005C2D83 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

Part of subcall function 005C4D36: GetClassNameW.USER32(?,?,000000FF), ref: 005C4D59

SendMessageW.USER32(?,00000182,?,00000000,?,?,ListBox,?,?,ComboBox), ref: 005C2DEF

Strings

ListBox, xrefs: 005C2DBB
ComboBox, xrefs: 005C2D90

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 452877a8db0b7084cc3f290c2e6c0a05f368a059a98f0a1ac3b9cce3585a2e0c
Instruction ID: d17126afd4f16db6cd17160ff2d19c654a0151f70c8e5fe4d0faddf22f41e7e3
Opcode Fuzzy Hash: 452877a8db0b7084cc3f290c2e6c0a05f368a059a98f0a1ac3b9cce3585a2e0c
Instruction Fuzzy Hash: 9701A271A4410A6BDB10E7E4D96AFFE7BA9AB61340F100529B803B3281DA204E099771

Function 005C7CA5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0056FA3B: _wcslen.LIBCMT ref: 0056FA45

CharUpperBuffW.USER32(?,?,?), ref: 005C7CD6
_wcslen.LIBCMT ref: 005C7CE1

Strings

STOP, xrefs: 005C7CDC, 005C7CED

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 209eb783b27d85d77483eea6986d1e7e17d89882dbed55d30ff7f6b07be4e482
Instruction ID: ac4e670b0429b009d5bcbcf90042c3ff11d9ad490025798b3adbef9072fa0115
Opcode Fuzzy Hash: 209eb783b27d85d77483eea6986d1e7e17d89882dbed55d30ff7f6b07be4e482
Instruction Fuzzy Hash: 6A019E32A0452F4B8B21AEE8E885EBF7F65BE59710F41052CEC1697691EB206C15CF91

Function 005C6FA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

#8.OLEAUT32(?,?), ref: 005C6FEB

Part of subcall function 005C72DF: #8.OLEAUT32(00000000,?,?,?,005C7006,?), ref: 005C7347
Part of subcall function 005C72DF: #10.WSOCK32(00000000,?,?,?,?,005C7006,?), ref: 005C7351

#9.WSOCK32(?,?), ref: 005C700F

Strings

D`, xrefs: 005C6FCE

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID:
String ID: D`
API String ID: 0-932597882
Opcode ID: 062140280c1e66a0109921e13900bb782fb3212732c6a00f7460bf018abaf6be
Instruction ID: 057421b667f1ec482a9d8d1e9a85c9c5083a9743ff0db6c0182e4b4b6c3764b8
Opcode Fuzzy Hash: 062140280c1e66a0109921e13900bb782fb3212732c6a00f7460bf018abaf6be
Instruction Fuzzy Hash: 571121729007099FC720DF99D88499AFBF8FF18310B10856FE54AD7651D771AA48CFA0

Function 005CEF07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 005CEF22
IsWindowVisible.USER32(?), ref: 005CEF2D

Strings

4c, xrefs: 005CEF5A

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: MessageSendTimeoutVisibleWindow
String ID: 4c
API String ID: 2309912316-2342541193
Opcode ID: 88848c48977c1e019097b519f5b86b9b9cc0eec1a869d43f1bfd908f1e4ff4a0
Instruction ID: ca1953a5f149d6eddfaa609a4f22f17c44ed5f31de35efd3a92040a269c63914
Opcode Fuzzy Hash: 88848c48977c1e019097b519f5b86b9b9cc0eec1a869d43f1bfd908f1e4ff4a0
Instruction Fuzzy Hash: BA014F71A001196AEB00EBA0DD56EFF7BADEB15740F404069B805E3281EB649F4587E2

Function 0058042B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00580C74

Part of subcall function 0058440C: RaiseException.KERNEL32(?,?,?,00580C96,?,00000001,?,?,?,?,?,?,00580C96,?,006294C0), ref: 0058446B

__CxxThrowException@8.LIBVCRUNTIME ref: 00580C91

Strings

Unknown exception, xrefs: 00580C9E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 8749c7584297a9eba900d4d55559c2fb6c0d3022b677848406f5517a00762ef6
Instruction ID: 85f3ffb9ab70bfc2e543435f561125af6bb197b6b6a4be1b5785dc30974d6522
Opcode Fuzzy Hash: 8749c7584297a9eba900d4d55559c2fb6c0d3022b677848406f5517a00762ef6
Instruction Fuzzy Hash: 4CF0C87494020EBB8F84BAA4F85AE6D7F6C7E40314F509620BD14B54E1EB70D91ECB91

Function 005A58A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005A58C1
_wcslen.LIBCMT ref: 005A58FF

Strings

3, 3, 15, 1, xrefs: 005A58AA

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 15, 1
API String ID: 176396367-2815819253
Opcode ID: 4a9cb1e0b4770b8a9c609f8e5c9851cab55e63c7087d0c080f8b53c0c3751271
Instruction ID: bc5fc346bc14b0bd1da80c2e6c4fc850830c6fbf02ab02c6fa0f894a71142933
Opcode Fuzzy Hash: 4a9cb1e0b4770b8a9c609f8e5c9851cab55e63c7087d0c080f8b53c0c3751271
Instruction Fuzzy Hash: B8F0C219A016AA96DBA0AA61DD8DE7D2AA4BFC9700F208866EC05D3150FB688D95DF40

Function 005C1C1B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 005C1C29

Strings

AutoIt, xrefs: 005C1C1D
Error allocating memory., xrefs: 005C1C22

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: f7d7611b18892e332e295fcc7c3fa247dcfdc5fa9d3a7781d050718b1043f7a5
Instruction ID: ef5b2ab7b72f16168f92afe0194f3c18fb6072b480043a26291ff5f7f2111750
Opcode Fuzzy Hash: f7d7611b18892e332e295fcc7c3fa247dcfdc5fa9d3a7781d050718b1043f7a5
Instruction Fuzzy Hash: 9EE0D83228875E36D6143794BC0BF947FD4AF45B11F104029FF48B64D39AE7645057A8

Function 005A5493 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 005A54A7
FreeLibrary.KERNEL32 ref: 005A54CD

Strings

GetSystemWow64DirectoryW, xrefs: 005A54A1

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW
API String ID: 3013587201-1150568532
Opcode ID: e774a5054b0ec261f98e78296127d4325b59f6f020000fcdaf7b1fc94555927f
Instruction ID: 128c569310a5dcaf4873f1e0b45978bdf14578336b80479487dbebe16f37dec3
Opcode Fuzzy Hash: e774a5054b0ec261f98e78296127d4325b59f6f020000fcdaf7b1fc94555927f
Instruction Fuzzy Hash: 19E02031503E3197CF6157204C44E7D2EB57F11741F458852F901F6140FB68CD44D6A0

Function 00581311 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0057FF7F: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00581340,?,?,?,0056100A), ref: 0057FF84

IsDebuggerPresent.KERNEL32(?,?,?,0056100A), ref: 00581344
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0056100A), ref: 00581353

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0058134E

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 1b3d89c695368521f88535c3f471571e17d560e9cc3fe3d5f374944ef280ed04
Instruction ID: 6e6fb18a7b66a912f9274ff04fa49267b4838fe5395c470eaf785623cacf3371
Opcode Fuzzy Hash: 1b3d89c695368521f88535c3f471571e17d560e9cc3fe3d5f374944ef280ed04
Instruction Fuzzy Hash: B8E039702407018BD320AF28E408357BFE9BB10700F048D1CE886D2681EBB4E488DBE1

Function 005D3D85 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 005D3D9D
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 005D3DB2

Strings

aut, xrefs: 005D3DA6

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 2b863daa4b41f154bf9d83c7fd2b5ac8a95c5e0cf9442e70d2a668a5d8d41c18
Instruction ID: d4a9b2b41e0e31dd09f37efe7af094b3a67fa6a5d588816c95b50342a42bb7e9
Opcode Fuzzy Hash: 2b863daa4b41f154bf9d83c7fd2b5ac8a95c5e0cf9442e70d2a668a5d8d41c18
Instruction Fuzzy Hash: D0D05B7554032867D6309754AC0DFF77B7CD745711F4002E2BE58D2091DAB49949CBE1

Function 005F2C46 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005F2C50
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 005F2C63

Part of subcall function 005CF7F5: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF86D

Strings

Shell_TrayWnd, xrefs: 005F2C49

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 3f686a65b6fdb4e2bd6df4598a6ec4cafd90e41c755e7cd1cf7af4a508126a6b
Instruction ID: c21b9c39878e06a3a48bcfcfb2a76278140a7132c5b864ab670ea783e41f1f2e
Opcode Fuzzy Hash: 3f686a65b6fdb4e2bd6df4598a6ec4cafd90e41c755e7cd1cf7af4a508126a6b
Instruction Fuzzy Hash: 86D0C735394312BBE564B7709D0FFD769669B50754F1104257645E91D0C9E49404C654

Function 005F2C7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000,00000111,000001A0,00000000), ref: 005F2C90
PostMessageW.USER32(00000000), ref: 005F2C97

Part of subcall function 005CF7F5: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,005AA61D,00000001), ref: 005CF86D

Strings

Shell_TrayWnd, xrefs: 005F2C89

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: cdc9b090a017d80f14089794a986f9c9130aa0530ef2282f9649b8332c0dd1ab
Instruction ID: d4ba556987f72e8f10db6d73cff2501d5c6465fb8ec3ecc78f8f5c4e418617ee
Opcode Fuzzy Hash: cdc9b090a017d80f14089794a986f9c9130aa0530ef2282f9649b8332c0dd1ab
Instruction Fuzzy Hash: 30D0C932384312BBF664B770AD0FFD7AA66AB64B54F1108257645EA1D0C9E4A804CA64

Function 0059BC2D Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0059BCC3
GetLastError.KERNEL32 ref: 0059BCD1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0059BD2C

Memory Dump Source

Source File: 00000008.00000002.1412201755.0000000000561000.00000020.00000001.01000000.00000008.sdmp, Offset: 00560000, based on PE: true

Associated: 00000008.00000002.1412111926.0000000000560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.00000000005FD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412340462.0000000000621000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.000000000062D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412395150.0000000000631000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1412440913.0000000000635000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_560000_Gosse.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 252de6aa0a1e75ff2704e425439c0106fcf9c43fe004db6779aa2bfd7d568d60
Instruction ID: 3b647fe3cf82a0b67815149d8a81832bcfd4299e2e889d0e188acc0f32d6c55d
Opcode Fuzzy Hash: 252de6aa0a1e75ff2704e425439c0106fcf9c43fe004db6779aa2bfd7d568d60
Instruction Fuzzy Hash: C841BE30A00306AFFF259F64EA48BBA7FB5FF41320F244569E9599B1A1DB309D01CB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_more.com_372e469ceb5bfc6b28195017a428fae683e4_8dec09d6_f736110d-adc2-45c8-961e-ed549c5547ba\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE90D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE99B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9CA.tmp.xml

C:\Users\user\AppData\Local\Temp\7ee79492

C:\Users\user\AppData\Local\Temp\7fda8a8e

C:\Users\user\AppData\Local\Temp\Gosse.com

C:\Users\user\AppData\Local\Temp\xwharpgq

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Windows Analysis Report
Setup.exe

Function 0040776F Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Function 00407E8F Relevance: 5.5, APIs: 3, Instructions: 995
memoryCOMMON

Function 0040704F Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Function 0040763F Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Function 0040770F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Function 00406C7F Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Function 00408C9F Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre