Edit tour

Windows Analysis Report
Metamask_setup.exe

Overview

General Information

Sample name:	Metamask_setup.exe
Analysis ID:	1379472
MD5:	618f137baf526f754d3ee3885acb9c04
SHA1:	a7f29acee8f33eee1b569fc992bdbbe2f413042c
SHA256:	512ec746b8318aa67bb11aa498a94d0e9848c241e7296c46757dcf1997e28be4
Infos:

Detection

Meduza Stealer

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Meduza Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

Metamask_setup.exe (PID: 7064 cmdline: C:\Users\user\Desktop\Metamask_setup.exe MD5: 618F137BAF526F754D3EE3885ACB9C04)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "77.105.147.171:15666"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Metamask_setup.exe PID: 7064	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Metamask_setup.exe

Avira: detected

Found malware configuration

Source: Metamask_setup.exe

Malware Configuration Extractor: Meduza Stealer {"C2 url": "77.105.147.171:15666"}

Multi AV Scanner detection for submitted file

Source: Metamask_setup.exe	ReversingLabs: Detection: 81%
Source: Metamask_setup.exe	Virustotal: Detection: 79%			Perma Link

Machine Learning detection for sample

Source: Metamask_setup.exe

Joe Sandbox ML: detected

Source: Metamask_setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D308C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF6DF0D308C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D2FDC FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,		0_2_00007FF6DF0D2FDC

Source: global traffic

TCP traffic: 192.168.2.4:49729 -> 77.105.147.171:15666

Source: Joe Sandbox View

ASN Name: PLUSTELECOM-ASRU PLUSTELECOM-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.147.171

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF0896F0 std::_Lockit::_Lockit,std::_Lockit::_Lockit,std::_Facet_Register,Concurrency::cancel_current_task,Concurrency::cancel_current_task,_invalid_parameter_noinfo_noreturn,InternetOpenW,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF6DF0896F0

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF09F110 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6DF09F110

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF075F00	0_2_00007FF6DF075F00
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B0874	0_2_00007FF6DF0B0874
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A8090	0_2_00007FF6DF0A8090
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BD488	0_2_00007FF6DF0BD488
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D308C	0_2_00007FF6DF0D308C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0510E0	0_2_00007FF6DF0510E0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B6110	0_2_00007FF6DF0B6110
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AB510	0_2_00007FF6DF0AB510
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B036C	0_2_00007FF6DF0B036C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D4F90	0_2_00007FF6DF0D4F90
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF080790	0_2_00007FF6DF080790
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AF7A0	0_2_00007FF6DF0AF7A0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A83A0	0_2_00007FF6DF0A83A0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BBF9C	0_2_00007FF6DF0BBF9C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0C7830	0_2_00007FF6DF0C7830
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF091A80	0_2_00007FF6DF091A80
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A3680	0_2_00007FF6DF0A3680
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF075AD0	0_2_00007FF6DF075AD0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0896F0	0_2_00007FF6DF0896F0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D6EF4	0_2_00007FF6DF0D6EF4
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BBB08	0_2_00007FF6DF0BBB08
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0B8D50	0_2_00007FF6DF0B8D50
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AD590	0_2_00007FF6DF0AD590
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0A7180	0_2_00007FF6DF0A7180
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D69A8	0_2_00007FF6DF0D69A8
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AF9A4	0_2_00007FF6DF0AF9A4
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AF59C	0_2_00007FF6DF0AF59C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0959C0	0_2_00007FF6DF0959C0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BB200	0_2_00007FF6DF0BB200
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0BC61C	0_2_00007FF6DF0BC61C

Source: classification engine

Classification label: mal80.troj.spyw.winEXE@1/0@0/1

Source: Metamask_setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Metamask_setup.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Metamask_setup.exe	ReversingLabs: Detection: 81%
Source: Metamask_setup.exe	Virustotal: Detection: 79%

Source: Metamask_setup.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Metamask_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Metamask_setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Metamask_setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Metamask_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Metamask_setup.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Metamask_setup.exe

API coverage: 2.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D308C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF6DF0D308C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0D2FDC FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,		0_2_00007FF6DF0D2FDC

Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD5A5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF0AE280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6DF0AE280

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0CCE58 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF6DF0CCE58
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: 0_2_00007FF6DF0AE280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF6DF0AE280

Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6DF0C70C0
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: GetLocaleInfoW,	0_2_00007FF6DF0BA4DC
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6DF0B9F9C
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF6DF0C6678
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6DF0C6AA4
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF6DF0C6EDC
Source: C:\Users\user\Desktop\Metamask_setup.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6DF0C69D4

Source: C:\Users\user\Desktop\Metamask_setup.exe

Code function: 0_2_00007FF6DF0CD3CC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6DF0CD3CC

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: Metamask_setup.exe PID: 7064, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty (Web)
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: Metamask_setup.exe, 00000000.00000002.1642063251.000002A5FD57C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: Metamask_setup.exe PID: 7064, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Metamask_setup.exe	82%	ReversingLabs	Win64.Spyware.Medusastealer
Metamask_setup.exe	79%	Virustotal		Browse
Metamask_setup.exe	100%	Avira	TR/Spy.Agent.kgbyf
Metamask_setup.exe	100%	Joe Sandbox ML

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.105.147.171	unknown	Russian Federation		42031	PLUSTELECOM-ASRU	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1379472
Start date and time:	2024-01-23 13:24:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Metamask_setup.exe
Detection:	MAL
Classification:	mal80.troj.spyw.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLUSTELECOM-ASRU	http://jerryposter.com	Get hash	malicious	Unknown	Browse	77.105.140.181
	hostcr.exe	Get hash	malicious	Remcos	Browse	77.105.132.70
	file.exe	Get hash	malicious	PrivateLoader	Browse	77.105.147.130
	p1vNyPdVh2.exe	Get hash	malicious	Stealc, Vidar, zgRAT	Browse	77.105.132.229
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	0442.EXE.exe	Get hash	malicious	Quasar	Browse	77.105.132.124
	gbquas.exe	Get hash	malicious	Quasar	Browse	77.105.132.124
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.338845189889762
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Metamask_setup.exe
File size:	790'016 bytes
MD5:	618f137baf526f754d3ee3885acb9c04
SHA1:	a7f29acee8f33eee1b569fc992bdbbe2f413042c
SHA256:	512ec746b8318aa67bb11aa498a94d0e9848c241e7296c46757dcf1997e28be4
SHA512:	41d93eb646043fc2a16c0cb123d724db9091109dfd4ed457f45444859a38f463b3b410188d9ec1c0df8a3037a7846e8c94bd8e0dbe29634d44f01feb8a4bdf1e
SSDEEP:	12288:k/Dduefh+bErggggggggMfAF3m5mz1U/uuUtw/8DvC5mukp:mDduz6ggggggggMYF3Imzy2NAaC5M
TLSH:	1EF40934E69C3669D06BA078FC4B5C02E93278AA1320BFEB12D55A511F97EE15F3D360
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q.o.q.o.q.o.:.h.p.o.:.i.p.o.d.j...o.d.k.~.o.d.l.y.o.:.j...o.:.l.v.o.:.k.c.o.q.n...o.:.n.j.o.G.f.}.o.G...p.o.G.m.p.o.Richq.o

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14007cb70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64F15F28 [Fri Sep 1 03:48:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	59fc3561b97c1724a66e573b2805c788

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F397938B398h
dec eax
add esp, 28h
jmp 00007F397938A9BFh
int3
int3
and dword ptr [0003DBE5h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [0001C68Ah]
test eax, eax
je 00007F397938AB46h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007F397938AB09h
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007F397938C484h
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [0001C62Dh]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [0001C61Bh]
dec eax
test eax, eax
je 00007F397938AB7Eh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [0001C5E2h]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5b90	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc6000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xbd000	0x79e0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc7000	0xb54	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa76a0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa7700	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa7560	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x99000	0x650	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x97edc	0x98000	14fecd9441573d8f8846ade337580ead	False	0.42626953125	zlib compressed data	6.304920226712859	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x99000	0x1e0c0	0x1e200	2619a9f8e04fbdc4bbf68a1be1ba22e6	False	0.4567313926348548	DIY-Thermocam raw data (Lepton 2.x), scale 25856-27648, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 154742504910672534362390528.000000, slope 2543115696954447765978707132416.000000	5.510471051944646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb8000	0x4484	0x1e00	1ac5d7acfbfbd5b995f739e66ca25ec4	False	0.16067708333333333	data	3.2862763790147604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xbd000	0x79e0	0x7a00	9063aa876dbea603cc0cba3a374e398d	False	0.40320824795081966	data	5.843380934302045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0xc5000	0x15c	0x200	392099a42f1a81299705ff2d92da8379	False	0.41015625	data	3.3726519446433953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc6000	0x1e0	0x200	40051623f806a9ed9f88c3948606ca62	False	0.52734375	data	4.7137725829467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc7000	0xb54	0xc00	b58ee936f6aedd3f50b5062d1561ba30	False	0.4661458333333333	data	5.269667204999112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc6060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	htons, inet_pton, WSAStartup, send, socket, connect, recv, WSACleanup, closesocket
CRYPT32.dll	CryptUnprotectData
WININET.dll	InternetQueryDataAvailable, InternetReadFile, InternetCloseHandle, InternetOpenW, InternetOpenUrlA, InternetOpenA, HttpQueryInfoW
ntdll.dll	NtQueryObject, NtQuerySystemInformation
RstrtMgr.DLL	RmGetList, RmStartSession, RmEndSession, RmRegisterResources
KERNEL32.dll	MultiByteToWideChar, LocalFree, WideCharToMultiByte, IsDebuggerPresent, WriteProcessMemory, TerminateProcess, GetModuleFileNameW, WaitForSingleObject, ResumeThread, CloseHandle, GetThreadContext, VirtualAllocEx, CreateProcessW, SetThreadContext, GetExitCodeProcess, ExitProcess, ReadFile, GetModuleFileNameA, GetVolumeInformationW, GetGeoInfoA, HeapFree, EnterCriticalSection, GetCurrentProcess, GetProcessId, GetProductInfo, LeaveCriticalSection, SetFilePointer, InitializeCriticalSectionEx, GetModuleHandleA, OpenProcess, HeapSize, GetLogicalDriveStringsW, GetFinalPathNameByHandleA, GetTimeZoneInformation, GetLastError, HeapReAlloc, GetNativeSystemInfo, HeapAlloc, GetUserGeoID, DecodePointer, GetProcAddress, GetFileSize, DeleteCriticalSection, GetComputerNameW, GetProcessHeap, GlobalMemoryStatusEx, GetModuleHandleW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, IsProcessorFeaturePresent, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeLibrary, GetModuleHandleExW, VirtualAlloc, VirtualProtect, VirtualQuery, GetCurrentThreadId, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, LoadLibraryExW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetStdHandle, GetFileType, GetStartupInfoW, RaiseException, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, ReadConsoleW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, SetStdHandle, CreateFileW, WriteConsoleW, OutputDebugStringW, SetEndOfFile, FreeEnvironmentStringsW, SetEnvironmentVariableW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, QueryPerformanceCounter, InitializeSListHead, RtlUnwindEx, RtlUnwind, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LCMapStringEx, GetCommandLineA, GetCommandLineW, GetSystemInfo, GetEnvironmentStringsW, GetFileInformationByHandleEx, AreFileApisANSI, GetFileAttributesExW, FindNextFileW, FindFirstFileExW, FindFirstFileW, FindClose, FormatMessageA, GetLocaleInfoEx, GetCurrentDirectoryW
USER32.dll	EnumDisplayDevicesW, GetDC, GetSystemMetrics, GetWindowRect, ReleaseDC, GetDesktopWindow
GDI32.dll	BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetDeviceCaps, DeleteDC, GetObjectW, DeleteObject
ADVAPI32.dll	RegCloseKey, RegQueryValueExA, RegOpenKeyExA, GetUserNameW, RegEnumKeyExA, GetCurrentHwProfileW
SHELL32.dll	ShellExecuteA, SHGetKnownFolderPath
ole32.dll	CoTaskMemFree, CreateStreamOnHGlobal
SHLWAPI.dll
gdiplus.dll	GdiplusStartup, GdiplusShutdown, GdipGetImageEncoders, GdipCloneImage, GdipAlloc, GdipCreateBitmapFromScan0, GdipSaveImageToStream, GdipGetImageEncodersSize, GdipDisposeImage, GdipFree, GdipCreateBitmapFromHBITMAP

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 23, 2024 13:24:59.873930931 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:00.086932898 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:00.588654995 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:00.802571058 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:01.307445049 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:01.520523071 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:02.026153088 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:02.239245892 CET	15666	49729	77.105.147.171	192.168.2.4
Jan 23, 2024 13:25:02.744898081 CET	49729	15666	192.168.2.4	77.105.147.171
Jan 23, 2024 13:25:02.958246946 CET	15666	49729	77.105.147.171	192.168.2.4

Target ID:	0
Start time:	13:24:59
Start date:	23/01/2024
Path:	C:\Users\user\Desktop\Metamask_setup.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Metamask_setup.exe
Imagebase:	0x7ff6df050000
File size:	790'016 bytes
MD5 hash:	618F137BAF526F754D3EE3885ACB9C04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF6DF075F00 Relevance: 38.0, APIs: 15, Strings: 6, Instructions: 1237COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF075FF0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF075FF6

Strings

content, xrefs: 00007FF6DF07662B
telegram, xrefs: 00007FF6DF07668A, 00007FF6DF076A09
cannot use push_back() with , xrefs: 00007FF6DF076C81
directory_iterator::directory_iterator, xrefs: 00007FF6DF076CE0, 00007FF6DF076D2A
status, xrefs: 00007FF6DF076CF0, 00007FF6DF076D06
filename, xrefs: 00007FF6DF076572

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: cannot use push_back() with $content$directory_iterator::directory_iterator$filename$status$telegram
API String ID: 73155330-1682428876
Opcode ID: b2c386aaff44f21faa9323e9549d45462ca294a1c62cdbcd0c795dab9cec7129
Instruction ID: 5c60288f60a947b433be42ada48720ef19acbd5478624d15b5c73196fd319174
Opcode Fuzzy Hash: b2c386aaff44f21faa9323e9549d45462ca294a1c62cdbcd0c795dab9cec7129
Instruction Fuzzy Hash: B8C2A062A19BC189EB21CF35D8903ED7364FB85798F544236EA8D87B99DF38D691C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BA018 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6DF0BA6C2,?,?,?,00007FF6DF0BB5E4), ref: 00007FF6DF0BA194
GetProcAddressForCaller.KERNELBASE(?,?,?,00007FF6DF0BA6C2,?,?,?,00007FF6DF0BB5E4), ref: 00007FF6DF0BA1A0

Strings

api-ms-, xrefs: 00007FF6DF0BA0DE
ext-ms-, xrefs: 00007FF6DF0BA0F1

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: AddressCallerFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3520295827-537541572
Opcode ID: 8018236b3e31d5400bad457142b1c513f9e0a2281b30da1e5932f2d818f46253
Instruction ID: 46e11140b5ae21b1b2adaee83917288a4787a1920a99ee074fc8a029ae228daa
Opcode Fuzzy Hash: 8018236b3e31d5400bad457142b1c513f9e0a2281b30da1e5932f2d818f46253
Instruction Fuzzy Hash: 1A41B122B1AA0245FA56CB16AC3467E2395BF45BA0F498937DE1DCB794EF7CE425C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF07E4B0 Relevance: 3.1, APIs: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF07E642
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF07E64E

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 934906d154d1734d4dd63ea35d7866786702960bfb32e01e6ad4ff713fc1fda4
Instruction ID: 97695fa6f7e88e3bcf54575ff88af66127f0798a7d8c90be8b65c9b18829b70b
Opcode Fuzzy Hash: 934906d154d1734d4dd63ea35d7866786702960bfb32e01e6ad4ff713fc1fda4
Instruction Fuzzy Hash: 97519172E19B8686EA10DB25E85036D73A5FB94784F544632EB8C877A5EF7CE4B18300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF07EEE0 Relevance: 3.1, APIs: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF07EFE0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF07EFEC

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: fa56406c03b6c9ca001bdad761f259cc8ce6151ab533f09826cde0c63591774f
Instruction ID: 9383a42b6a2b0f56673296298346efdbc27a5cb6c1a3f5cbb86a879e909e7379
Opcode Fuzzy Hash: fa56406c03b6c9ca001bdad761f259cc8ce6151ab533f09826cde0c63591774f
Instruction Fuzzy Hash: 1C31C522F06B8545EE189B25A52027D6351EF44BB4F244732DB7C87BD5EE7CE4E28340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0CC580 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0CC5B0

Part of subcall function 00007FF6DF0CD3A0: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6DF0CD3A9

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0CC5B6

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 8edfc3d1130c62526de880746612556dd1d2b5bb9bdd5d839ad3c011f6f06b87
Instruction ID: edbe792ea4225e8dad4ce3ce0d32c8db46b25697d9ea0c9f4fd40a596810c5e5
Opcode Fuzzy Hash: 8edfc3d1130c62526de880746612556dd1d2b5bb9bdd5d839ad3c011f6f06b87
Instruction Fuzzy Hash: 1AE0E240E1A14749FE2932B6A83A0BD03404F98371E289B72D97E872C2ED1CF4F29530

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D5278 Relevance: 1.6, APIs: 1, Instructions: 64
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0D5310

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d96538fd9e4c0ba1957b4897a3115e7797365899696c5d934e3a4e46a089f122
Instruction ID: e1ff70fe6ec38066a3a7aad8d8d0b3591cac549010582fc9feec070854348120
Opcode Fuzzy Hash: d96538fd9e4c0ba1957b4897a3115e7797365899696c5d934e3a4e46a089f122
Instruction Fuzzy Hash: F7112721A0860282FB14AB75A83137E6390AF907A0F144532EF5CC7FC6DFBCE4214700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BB780 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF6DF0CE247,?,?,?,?,?,?,?,?,?,00007FF6DF0D35DD), ref: 00007FF6DF0BB7BE

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cdc2d6fae817b89a224673727086d8959dbde9ebb7d6078baeca0d48c9324078
Instruction ID: eb6fe1a77cc2ad83fac0b4ff54f9d2fa60a092a9506980c06b3ff79e60db8e65
Opcode Fuzzy Hash: cdc2d6fae817b89a224673727086d8959dbde9ebb7d6078baeca0d48c9324078
Instruction Fuzzy Hash: A1F01294F4960642FE745775587167E17905F44BB0F080E76EC2EC73E1DE5CA4A15510

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6DF0896F0 Relevance: 28.7, APIs: 12, Strings: 4, Instructions: 717COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF08971B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF089740
std::_Facet_Register.LIBCPMT ref: 00007FF6DF0897EB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF089836

Strings

ios_base::failbit set, xrefs: 00007FF6DF089AD3, 00007FF6DF08A210, 00007FF6DF08A47F
ios_base::eofbit set, xrefs: 00007FF6DF089ADA, 00007FF6DF08A486
ios_base::badbit set, xrefs: 00007FF6DF089AC7, 00007FF6DF08A472, 00007FF6DF08A4D0
File Downloader, xrefs: 00007FF6DF08A6B2

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID: File Downloader$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1168246061-2259054128
Opcode ID: 7721040ffac38007c553ca3dc60ff604b49acf4bb86305ae07b5ad0cdd2784ac
Instruction ID: 4b2f71ba803312bef7ca54ad5868eb909d39c97cd064cdf0b9290cfdf4b66ad8
Opcode Fuzzy Hash: 7721040ffac38007c553ca3dc60ff604b49acf4bb86305ae07b5ad0cdd2784ac
Instruction Fuzzy Hash: 6E527E32A09A8196EB60EF19E56036DA7A0FB84F98F588532DE5D87B94DF3DD461C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D308C Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF6DF0D3139
GetLastError.KERNEL32 ref: 00007FF6DF0D3143
FindFirstFileW.KERNEL32 ref: 00007FF6DF0D315A
GetLastError.KERNEL32 ref: 00007FF6DF0D3166
FindClose.KERNEL32 ref: 00007FF6DF0D3174
__std_fs_open_handle.LIBCPMT ref: 00007FF6DF0D3207
CloseHandle.KERNEL32 ref: 00007FF6DF0D321D
CloseHandle.KERNEL32 ref: 00007FF6DF0D3390

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 933ae3730207d125b828c856b205ce3c44c04271787765837734cf2a07481d77
Instruction ID: 9ed4659a338e7c9f943e474b9a8797e93ff339b8537b402f8f97afa360f7952d
Opcode Fuzzy Hash: 933ae3730207d125b828c856b205ce3c44c04271787765837734cf2a07481d77
Instruction Fuzzy Hash: 1091A331B08A0286E6648B15AC256BD2398AFC57B4F044336D9BEC7BD4DF3CE8A5C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF09F110 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 371
nativelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DF0CC508: AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00007FF6DF09EF6B), ref: 00007FF6DF0CC518

GetModuleHandleA.KERNEL32 ref: 00007FF6DF09F18A
GetProcAddress.KERNEL32 ref: 00007FF6DF09F19A

Part of subcall function 00007FF6DF0CC49C: AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00007FF6DF09EF95), ref: 00007FF6DF0CC4AC
Part of subcall function 00007FF6DF0CC49C: ReleaseSRWLockExclusive.KERNEL32(?,?,00000000,00007FF6DF09EF95), ref: 00007FF6DF0CC4EC

OpenProcess.KERNEL32 ref: 00007FF6DF09F1DD
NtQuerySystemInformation.NTDLL ref: 00007FF6DF09F204
NtQuerySystemInformation.NTDLL ref: 00007FF6DF09F22F
GetCurrentProcess.KERNEL32 ref: 00007FF6DF09F2FB
NtQueryObject.NTDLL ref: 00007FF6DF09F348
GetFinalPathNameByHandleA.KERNEL32 ref: 00007FF6DF09F442
CloseHandle.KERNEL32 ref: 00007FF6DF09F556
CloseHandle.KERNEL32 ref: 00007FF6DF09F5DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF09F667
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF09F66D

Strings

NtDuplicateObject, xrefs: 00007FF6DF09F193
File, xrefs: 00007FF6DF09F37C
ntdll.dll, xrefs: 00007FF6DF09F183

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Handle$ExclusiveLockQuery$AcquireCloseInformationProcessSystem_invalid_parameter_noinfo_noreturn$AddressCurrentFinalModuleNameObjectOpenPathProcRelease
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 4149831788-3955674919
Opcode ID: f2562741e349a99349bf9fbdd4a2689032d25329a2ca763909391ef5ac847b7b
Instruction ID: 1dab93e0bc083a01ecf28f4b61c27eabcf1a8916959e3e8c17d2f86f72ddc70d
Opcode Fuzzy Hash: f2562741e349a99349bf9fbdd4a2689032d25329a2ca763909391ef5ac847b7b
Instruction Fuzzy Hash: DDE19F62B08A819AFB00DF65D4643BC2361FB48B99F548536DE1DA7B99EF3CE165C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0C7830 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6DF0C787E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0C7EEA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0C8060
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0C831E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0C853E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0C877B
memcpy_s.LIBCPMT ref: 00007FF6DF0C8856
memcpy_s.LIBCPMT ref: 00007FF6DF0C8901
memcpy_s.LIBCPMT ref: 00007FF6DF0C89D0

Strings

1#IND, xrefs: 00007FF6DF0C796B
1#QNAN, xrefs: 00007FF6DF0C7997
1#INF, xrefs: 00007FF6DF0C79A7
1#SNAN, xrefs: 00007FF6DF0C798E

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: c5e876ca772328fb97aec2cc79d7cc9b942190f7e0823540ab8001b230db0c95
Instruction ID: ab6a03bb69266ea0cce739f17cfadd542fd7dea873acde675dda2c44cdcc5d71
Opcode Fuzzy Hash: c5e876ca772328fb97aec2cc79d7cc9b942190f7e0823540ab8001b230db0c95
Instruction Fuzzy Hash: 8BB2D172E182828BEB658F64D4607FD77E1FB54388F549136DA0D97A88DF38EA10CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0AD590 Relevance: 21.9, APIs: 14, Instructions: 865
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0AD701
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0AD70D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0AD895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0AD8A1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0ADA67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ADC31
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0ADDE5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ADDF1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0ADFAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ADFB6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0ADC25

Part of subcall function 00007FF6DF072490: __std_exception_copy.LIBVCRUNTIME ref: 00007FF6DF0724D8

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ADA73

Part of subcall function 00007FF6DF0CC580: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0CC5B0
Part of subcall function 00007FF6DF0CC580: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0CC5B6

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0AE138
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0AE144

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID:
API String ID: 3741619608-0
Opcode ID: 7f864cd145c1b37dbd6398310a558c5b47d3be5f7fddbc3ee37f12577edc1d72
Instruction ID: e61182fc10b6e5763bf37b1130028076f79bf585630f219f4b8da472f6d09694
Opcode Fuzzy Hash: 7f864cd145c1b37dbd6398310a558c5b47d3be5f7fddbc3ee37f12577edc1d72
Instruction Fuzzy Hash: AC52E322B09B8581EA20DB26E4249BE7394FB44BE4F548636EEAD977C5DF3CD061C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A3680 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF0A382D
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF0A383B
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF0A3ADD
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF0A3AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A3C86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A3C8C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A3CAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A3CB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A3CBB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A3CDE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A3CE4

Strings

value, xrefs: 00007FF6DF0A3756, 00007FF6DF0A3A0E

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 248876450d4c3ec0651d2e53ac619a801cd936c834002fcee5982df9f58dbb71
Instruction ID: 276365481285cc453d034a75b90aefccd015ef0cd9d1ab57d6bcecda10c79918
Opcode Fuzzy Hash: 248876450d4c3ec0651d2e53ac619a801cd936c834002fcee5982df9f58dbb71
Instruction Fuzzy Hash: 4A02B222A18BC185EB10CB79D8607AD77A1FB85794F505333EA9D93ADADF2CE194C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF091A80 Relevance: 16.8, APIs: 11, Instructions: 345
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF091AAB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF091AD0
std::_Facet_Register.LIBCPMT ref: 00007FF6DF091B7B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF091BC6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF091BFB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF091C20

Part of subcall function 00007FF6DF091F50: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF091FCE
Part of subcall function 00007FF6DF091F50: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6DF092017

std::_Facet_Register.LIBCPMT ref: 00007FF6DF091CCB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF091D16
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF091ED5

Part of subcall function 00007FF6DF072490: __std_exception_copy.LIBVCRUNTIME ref: 00007FF6DF0724D8

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF091EDB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF091F4A

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_task$Facet_Register_invalid_parameter_noinfo_noreturn$Locinfo::_Locinfo_ctor__std_exception_copy
String ID:
API String ID: 547876327-0
Opcode ID: 419aece7a95726e8b14d84824d5ede77fc41d941f359a36a29c7aab817f89eb2
Instruction ID: e15a7055148304aec6e439cb30934ace720b45f02fbc16b8e7cf2030d75dcb6d
Opcode Fuzzy Hash: 419aece7a95726e8b14d84824d5ede77fc41d941f359a36a29c7aab817f89eb2
Instruction Fuzzy Hash: 96D1D462B18B4190EF14DB16E8602BD6365FB88BD4F584633EA5D8B7D5EF3CE4618700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0AB510 Relevance: 15.4, APIs: 6, Strings: 2, Instructions: 1406COMMON

Download Yara Rule

Strings

iterator out of range, xrefs: 00007FF6DF0AB80A
iterator does not fit current value, xrefs: 00007FF6DF0AB7D6

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID: iterator does not fit current value$iterator out of range
API String ID: 0-1046077056
Opcode ID: 3a3940073ea05fff7c7397e53fce3ef79faf48c6a5268317bec3148e13283907
Instruction ID: bfa81cda593ddcd41314ece048117eae76cf1aec433b9d5c110950452121b9d3
Opcode Fuzzy Hash: 3a3940073ea05fff7c7397e53fce3ef79faf48c6a5268317bec3148e13283907
Instruction Fuzzy Hash: 0AD28D62B09B9989EB00CBB9D4A03AC3BB0F719B48F548426DF8D97B59DF38D561C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D6EF4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DF0D6C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0D6C69
Part of subcall function 00007FF6DF0D6C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0D6CE7
Part of subcall function 00007FF6DF0D6C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0D6D38

CreateFileW.KERNEL32 ref: 00007FF6DF0D6FFA
CreateFileW.KERNEL32 ref: 00007FF6DF0D704A
GetLastError.KERNEL32 ref: 00007FF6DF0D707A
GetFileType.KERNEL32 ref: 00007FF6DF0D708F
GetLastError.KERNEL32 ref: 00007FF6DF0D7099
CloseHandle.KERNEL32 ref: 00007FF6DF0D70CC
CloseHandle.KERNEL32 ref: 00007FF6DF0D722F
CreateFileW.KERNEL32 ref: 00007FF6DF0D7264
GetLastError.KERNEL32 ref: 00007FF6DF0D7273

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 6305d654d880c265465ec88e1e3bb8ce9f9decaff5ee571d2c1cd0f376e67421
Instruction ID: 792d2813a5e102d4265675a4253084381a15a577eec0706c980d3950c1d05630
Opcode Fuzzy Hash: 6305d654d880c265465ec88e1e3bb8ce9f9decaff5ee571d2c1cd0f376e67421
Instruction Fuzzy Hash: 6EC19136B24A4286EB10CFA5D8A16BD3775EB89B98B015236DE1ED77D4CF38D466C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0959C0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 498fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF6DF095C07
SetFilePointer.KERNEL32 ref: 00007FF6DF095CBA
ReadFile.KERNEL32 ref: 00007FF6DF095CE9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF09615E

Strings

ios_base::failbit set, xrefs: 00007FF6DF0961AC
ios_base::eofbit set, xrefs: 00007FF6DF0961B3
ios_base::badbit set, xrefs: 00007FF6DF096178, 00007FF6DF0961A0, 00007FF6DF096200

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: File$PointerReadSize_invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2478245620-1866435925
Opcode ID: ebc14059675afdffc1c0e00e02e81ee7f2b23703b5d5e47db5ed10acfccf5cca
Instruction ID: 041f1d66be654b088dbb059dbb397750f7cd89a818cb3ed2840ae264aebb2ce1
Opcode Fuzzy Hash: ebc14059675afdffc1c0e00e02e81ee7f2b23703b5d5e47db5ed10acfccf5cca
Instruction Fuzzy Hash: 80421932A15BC589EB20CF29D8903ED77A1FB85748F448236DA4D87B59EF78D664C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A8090 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF6DF0A82EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A837F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A8385
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A838B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A8391
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A8397

Strings

parse_error, xrefs: 00007FF6DF0A811C

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: parse_error
API String ID: 1944019136-3903021949
Opcode ID: 3503dd9d560496cc456b1a85817b0fc74169cb4bb1818516a66f2a5e07f554f2
Instruction ID: d7d09a8b8d23ada7ed79617c3503cc747c8688b64838b22c5dea6b73c07266ae
Opcode Fuzzy Hash: 3503dd9d560496cc456b1a85817b0fc74169cb4bb1818516a66f2a5e07f554f2
Instruction Fuzzy Hash: C2A1A162F14B8185EB10CB65E4643BD3361FB85798F509332EA9C57AD9EF78E1A4C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0C6678 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6DF0B8318: GetLastError.KERNEL32 ref: 00007FF6DF0B8327
Part of subcall function 00007FF6DF0B8318: FlsGetValue.KERNEL32 ref: 00007FF6DF0B833C
Part of subcall function 00007FF6DF0B8318: SetLastError.KERNEL32 ref: 00007FF6DF0B83C7

TranslateName.LIBCMT ref: 00007FF6DF0C66E2
TranslateName.LIBCMT ref: 00007FF6DF0C671D
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF6DF0B8F08), ref: 00007FF6DF0C6764
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF6DF0B8F08), ref: 00007FF6DF0C679C
GetLocaleInfoW.KERNEL32 ref: 00007FF6DF0C6959

Strings

utf8, xrefs: 00007FF6DF0C6880

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: cae4d8fe2d339fedd3641ce39a67522b094084baf9723c6f317c4c3e480531b0
Instruction ID: 7d3070f0632ede3615b3ae3d0c37c4ef1f1b7ec2bea834fc8df4cdc12c4ef13e
Opcode Fuzzy Hash: cae4d8fe2d339fedd3641ce39a67522b094084baf9723c6f317c4c3e480531b0
Instruction Fuzzy Hash: E2918C32A0878286FB349F22D5612BD23A4EF84B84F444632DE5D8779ADF3CE565C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0C70C0 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6DF0B8318: GetLastError.KERNEL32 ref: 00007FF6DF0B8327
Part of subcall function 00007FF6DF0B8318: FlsGetValue.KERNEL32 ref: 00007FF6DF0B833C
Part of subcall function 00007FF6DF0B8318: SetLastError.KERNEL32 ref: 00007FF6DF0B83C7

Part of subcall function 00007FF6DF0B8318: FlsSetValue.KERNEL32 ref: 00007FF6DF0B835D
Part of subcall function 00007FF6DF0B8318: FlsGetValue.KERNEL32 ref: 00007FF6DF0B83FD

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF6DF0C7230

Part of subcall function 00007FF6DF0B8318: FlsSetValue.KERNEL32 ref: 00007FF6DF0B838A
Part of subcall function 00007FF6DF0B8318: FlsSetValue.KERNEL32 ref: 00007FF6DF0B839B
Part of subcall function 00007FF6DF0B8318: FlsSetValue.KERNEL32 ref: 00007FF6DF0B83AC
Part of subcall function 00007FF6DF0B8318: FlsSetValue.KERNEL32 ref: 00007FF6DF0B841C
Part of subcall function 00007FF6DF0B8318: FlsSetValue.KERNEL32 ref: 00007FF6DF0B8444

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF6DF0B8F01), ref: 00007FF6DF0C7217
ProcessCodePage.LIBCMT ref: 00007FF6DF0C725A
IsValidCodePage.KERNEL32 ref: 00007FF6DF0C726C
IsValidLocale.KERNEL32 ref: 00007FF6DF0C7282
GetLocaleInfoW.KERNEL32 ref: 00007FF6DF0C72DE
GetLocaleInfoW.KERNEL32 ref: 00007FF6DF0C72FA

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 1b101f68b72b9e63831ac9c1a8c55107b6bd1a777d81b40b91e723d4836e9b85
Instruction ID: 7b86c8a6a659ad9cae9ebce15d46b10f281c2292a09cbb48c2d75e60ee79af4b
Opcode Fuzzy Hash: 1b101f68b72b9e63831ac9c1a8c55107b6bd1a777d81b40b91e723d4836e9b85
Instruction Fuzzy Hash: 7F716B22F0860289FB219B65E9606BD33A4BF44B48F448537CE1DD7695EF3CE865C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A7180 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 378COMMON

Download Yara Rule

Strings

value, xrefs: 00007FF6DF0A7E63
parse_error, xrefs: 00007FF6DF0A811C

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID: parse_error$value
API String ID: 0-1739288027
Opcode ID: c606767a549cfb17dded79a14f1380d0adaa52440e96362eae97215e151a2f73
Instruction ID: fee41e23049737e9ea42be146464723427c085842e5156c2143b6feb59385adf
Opcode Fuzzy Hash: c606767a549cfb17dded79a14f1380d0adaa52440e96362eae97215e151a2f73
Instruction Fuzzy Hash: FA02B562F18A8295FB10CB74D4616FD77A1EB95398F509232DA4C979DAEF3CE1A4C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0AE280 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6DF0AE2F9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6DF0AE311
RtlVirtualUnwind.KERNEL32 ref: 00007FF6DF0AE34C
IsDebuggerPresent.KERNEL32 ref: 00007FF6DF0AE385
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6DF0AE38F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6DF0AE39A

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 232773d37e55a069ded19441184962d741e03d13251d397c164fd4b25c33d808
Instruction ID: 9aa50ccbaeb36275a480323cace04512f56b48be0d93b554babba45731b2cb36
Opcode Fuzzy Hash: 232773d37e55a069ded19441184962d741e03d13251d397c164fd4b25c33d808
Instruction Fuzzy Hash: 96316032608F8186EB60CF25E8506EE73A4FB88758F504136EA9D83B94EF3CD565CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A83A0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 429COMMON

Download Yara Rule

Strings

cannot get value, xrefs: 00007FF6DF0A950D
value, xrefs: 00007FF6DF0A8E88

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID: cannot get value$value
API String ID: 0-2898753692
Opcode ID: e4b3684f87bd621bf198c0071bfaada2cc9814266a7fd9d59047bb45257ba9fe
Instruction ID: 85c41eba3746e05344d7595547c5f5e9c6ecf3e1272c84bb92df5e4850a78e5d
Opcode Fuzzy Hash: e4b3684f87bd621bf198c0071bfaada2cc9814266a7fd9d59047bb45257ba9fe
Instruction Fuzzy Hash: 8C02CF63B08A8295EB10CB35D8A16FD77B1EB95788F444233EB4C97A9ADF38D565C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0CD3CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6DF0CD3F8
GetCurrentThreadId.KERNEL32 ref: 00007FF6DF0CD406
GetCurrentProcessId.KERNEL32 ref: 00007FF6DF0CD412
QueryPerformanceCounter.KERNEL32 ref: 00007FF6DF0CD422

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c31ceebb870f15682e9cbc60434d20966c96c390c5f1a515c1752a9c8c79f626
Instruction ID: b9a885baf6ae3fcdb37364cb3b52b9c134d129659afaa5db622a4b94d700ad5d
Opcode Fuzzy Hash: c31ceebb870f15682e9cbc60434d20966c96c390c5f1a515c1752a9c8c79f626
Instruction Fuzzy Hash: F1112E36B18F018AEB00DF61E8542BC33A4F719768F441E36DA6D877A4DF78D1A58340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B6110 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6DF0B6176
memcpy_s.LIBCPMT ref: 00007FF6DF0B61A1

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 8101bab96facb9530bfb020494a0e1e968264cdbe7156957248635d7c5768935
Instruction ID: 0964052a273beb0334d982228bced5bc2986db7138d53392dd4b59b1018fe684
Opcode Fuzzy Hash: 8101bab96facb9530bfb020494a0e1e968264cdbe7156957248635d7c5768935
Instruction Fuzzy Hash: 49C1D372B1C68687EB24CF19E15466EB7A1F798B84F448536DB4A83784DF3DE821CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BA4DC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF6DF0B90DA), ref: 00007FF6DF0BA550

Strings

GetLocaleInfoEx, xrefs: 00007FF6DF0BA4F8, 00007FF6DF0BA509

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: f065cd492f56ebf8fdb96fbee4f494c41a6fd0c3a67e997235c05111211f873c
Instruction ID: 6a092d9d02e874492f3c882c6e39bb190cccef7a9a4ff471045f8562e9e1eb14
Opcode Fuzzy Hash: f065cd492f56ebf8fdb96fbee4f494c41a6fd0c3a67e997235c05111211f873c
Instruction Fuzzy Hash: 4F01D121B0CB8285EB408B56B4500AEB760FF98BC0F588437EE4DC7BA9CE3CD5658340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BD488 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6DF0BD6D7
RaiseException.KERNEL32 ref: 00007FF6DF0BD6E8

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: f4a5526b932b69e9ce5f40527f91a572126b7255d163c3a713e7a1986eaa3783
Instruction ID: 454627d82b7b0a77118e9e0c3030018afc40e94a5438a0ea851bd164d348a0e5
Opcode Fuzzy Hash: f4a5526b932b69e9ce5f40527f91a572126b7255d163c3a713e7a1986eaa3783
Instruction Fuzzy Hash: EFB16D73A05B898BEB15CF29C85636C7BA0F744B88F148922DB5D837A4CF39D461C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF075AD0 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

dumps, xrefs: 00007FF6DF075B4C
emoji, xrefs: 00007FF6DF075B77

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: dumps$emoji
API String ID: 4021432409-2873254224
Opcode ID: 3f1f093d587588a36e019ea42e551b905328b6084370b8046c144ffb50549b2f
Instruction ID: 957fc0d76e156cfcb63d2a40f43bd30295c37a0d7576f6e3ac216758b4b61745
Opcode Fuzzy Hash: 3f1f093d587588a36e019ea42e551b905328b6084370b8046c144ffb50549b2f
Instruction Fuzzy Hash: ACC17A32E15B86C9E700CF75E9801AC33B5EB49788B405276EE4CA7B99DF38E1A5C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BBF9C Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6DF0BC0A9
gfff, xrefs: 00007FF6DF0BC126

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: bcb0979baf6f2a0dc32efa5edafdd338046048a5fea5f299f9dee62206340c8c
Instruction ID: 84a738a0e96d4262b35ac2366be3a519f3fbb8b54a378d6cea6e2a86f9d73ded
Opcode Fuzzy Hash: bcb0979baf6f2a0dc32efa5edafdd338046048a5fea5f299f9dee62206340c8c
Instruction Fuzzy Hash: F8513662B286C586E7248F35986076EAB95E745B94F08CA32CB98CBAD5CF3DE450C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0C69D4 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6DF0B8318: GetLastError.KERNEL32 ref: 00007FF6DF0B8327
Part of subcall function 00007FF6DF0B8318: FlsGetValue.KERNEL32 ref: 00007FF6DF0B833C
Part of subcall function 00007FF6DF0B8318: SetLastError.KERNEL32 ref: 00007FF6DF0B83C7

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6DF0C71C3,?,00000000,00000092,?,?,00000000,?,00007FF6DF0B8F01), ref: 00007FF6DF0C6A72

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 15be25467689dc08095486fceb79fd93fb848ed56f233dc2ec919878b58a73fd
Instruction ID: e7cdd148738e2b8310ed081e660c2d8bcb814064b2494ef8728d99c15e826374
Opcode Fuzzy Hash: 15be25467689dc08095486fceb79fd93fb848ed56f233dc2ec919878b58a73fd
Instruction Fuzzy Hash: F911B467A08645CAEB259F15D0906ACB7A0FB90FA4F449136D66D833D0DE38D5E1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0C6AA4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6DF0B8318: GetLastError.KERNEL32 ref: 00007FF6DF0B8327
Part of subcall function 00007FF6DF0B8318: FlsGetValue.KERNEL32 ref: 00007FF6DF0B833C
Part of subcall function 00007FF6DF0B8318: SetLastError.KERNEL32 ref: 00007FF6DF0B83C7

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6DF0C717F,?,00000000,00000092,?,?,00000000,?,00007FF6DF0B8F01), ref: 00007FF6DF0C6B22

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 94c53289251789d7f71ffd127a5f3d4f02ca299b4af7a6dfa8e9d981be19ec78
Instruction ID: 4cfe9938c8410d086d2793e5e7e89663e8f27146b053321eeec04806250c7b4a
Opcode Fuzzy Hash: 94c53289251789d7f71ffd127a5f3d4f02ca299b4af7a6dfa8e9d981be19ec78
Instruction Fuzzy Hash: 6F01B1A2F0828286EB205B15E5607BEBBE1EB40BA4F459233D66C872D4CF7994E1C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B9F9C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF6DF0BA3EB,?,?,?,?,?,?,?,?,00000000,00007FF6DF0C6024), ref: 00007FF6DF0B9FEB

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bb03dad6bfc93157cce2339d4a2506c1db6583d6fd6528948ede6fef768c66be
Instruction ID: ee5d7436d0d4064f3eac4b4848e4507e2ed05f62b78ba5f0d0d4c924b1d5d97d
Opcode Fuzzy Hash: bb03dad6bfc93157cce2339d4a2506c1db6583d6fd6528948ede6fef768c66be
Instruction Fuzzy Hash: DAF019B6B08B4583E704DB16E8A05A93365EB98784F948037DA5DC3765DF7CD8718300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BBB08 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6DF0BBE4A

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 27cb439475e82ecb28d5fff70dc598369cf91446bdfbb9a1551da527ae7a01bc
Instruction ID: deb5497428123da3e18720aeaaa32d532f44e618a5efbe9bbe1907c4c321cafd
Opcode Fuzzy Hash: 27cb439475e82ecb28d5fff70dc598369cf91446bdfbb9a1551da527ae7a01bc
Instruction Fuzzy Hash: 3AA156A2A087C687EB25CF26A4207AE7B91EB607C4F018432DF8D87795EE3DD411C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF080790 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF6DF080819

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 52bd2959f18820258bf82267d1548700a3730a9b899ad7775dfc78fafd797603
Instruction ID: 47efe48ea5c4d7f010a8e6718910227c6c944b74df97076ae5e2a87101816846
Opcode Fuzzy Hash: 52bd2959f18820258bf82267d1548700a3730a9b899ad7775dfc78fafd797603
Instruction Fuzzy Hash: 5641C363A1D6E08AD702CB39841127D7FB2E766B88B1CC162DBD88774ADA2DD256C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0510E0 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c67487f25f27a81f9c88534c1435f214ab043a6f9bb0a0e72422fd12cb374a2
Instruction ID: e0dc8e8f764f7dddf4e7d9776c5402f7185f484d514216327dc99919f131521e
Opcode Fuzzy Hash: 9c67487f25f27a81f9c88534c1435f214ab043a6f9bb0a0e72422fd12cb374a2
Instruction Fuzzy Hash: 31729232905FC5AED7618F39DC802E877A8F759788F509226EA8C5BB59EF709394C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B0874 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29da48a445a8d74a530d1f9310ddd391d06b70c14c42cab432ab39b56ae3622f
Instruction ID: 44acaf2666873c9b833cdf3b23b09ed4a45eaafcaec423d8b5e78f8fa6663739
Opcode Fuzzy Hash: 29da48a445a8d74a530d1f9310ddd391d06b70c14c42cab432ab39b56ae3622f
Instruction Fuzzy Hash: F2D1CF22A0864786FB688F29847467D37A0FF45B48F188A37CE4E97695DF3DE865C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B8D50 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: a60a87b73dc126d53cd38972014eeb2ae2649f6c6f5a23fb58f30f8edbbfe1f3
Instruction ID: fd76be7277940e884608a1563b255fc8dcf9021adba2edde25a6488f47de664d
Opcode Fuzzy Hash: a60a87b73dc126d53cd38972014eeb2ae2649f6c6f5a23fb58f30f8edbbfe1f3
Instruction Fuzzy Hash: 73C1D666B0868285EB609B62D8203BE67E5FB94B8CF408833DE4DC7695DF3CD565C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B036C Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaab0e22a10d019a9d37feb41161a6f82f575a0615b00055f0a527e1dc41d23
Instruction ID: 6bb19b137c8bd96e9b35734a6bc099bc4d147061a89ffc7a20b18d7af360ea4b
Opcode Fuzzy Hash: bfaab0e22a10d019a9d37feb41161a6f82f575a0615b00055f0a527e1dc41d23
Instruction Fuzzy Hash: 8DB180B290879589EB648F39C06023D3BA4FB45B48F288537CB4E87795DF39D961C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D4F90 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 016e06e118f6e72abd969c81d9ee1565c237d24093ddecda5226a23047575563
Instruction ID: 38a719daee746976274d33948e7b70194c291f48698971cff15fa66c25d036ab
Opcode Fuzzy Hash: 016e06e118f6e72abd969c81d9ee1565c237d24093ddecda5226a23047575563
Instruction Fuzzy Hash: 5481B172A04B5186EB60CF25D8A17BD27A4FB84B98F544637EE1EC7B99CF38D0618340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BC61C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0076737848a656ac8b0bf958e11f50487e780bbf46ce8457cc12b5fc7fd19b
Instruction ID: bff1734abca2bd73396425bee6695740bd51697518b0ce0016eadac9e824d05f
Opcode Fuzzy Hash: cb0076737848a656ac8b0bf958e11f50487e780bbf46ce8457cc12b5fc7fd19b
Instruction Fuzzy Hash: E981D4B2A0878186E774CB1994A077E6B91FB457D4F14863BDA9E87B99DF3CD410CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D69A8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e88f7f6b4088201f1d6d54c4c9254369c597506d9e09caf11f39825c8fb400bd
Instruction ID: d17f9b4481cfbe22d4a058fda117b2a83af2d74b9ab1b3714f6749b0160c2516
Opcode Fuzzy Hash: e88f7f6b4088201f1d6d54c4c9254369c597506d9e09caf11f39825c8fb400bd
Instruction Fuzzy Hash: B161F922F1969286FB688A2C8C7427D6790AFC1774F144237D66DC7ED1DE7DE8A08700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0AF7A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: ab9456eb5f44b58e3bb3e8e76666f4a97993a54c7aa90a4660a96022f757302f
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 23518236A1879285E7248B29D060A3C77E1EB4DB59F244172CE4D97798CF3AEC63D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0AF9A4 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 314e37203917dbfb8fae56fdceaef1728b4faaa4c7bf91b7dcaf65b42ea75032
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: BC518576A2879186E7248B29D060A7C77E0EB5CF59F245132CE4D87794DF3AE863C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0AF59C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 1ce45c5210b9f0b7d35229ba06ab385fe705a8f30f0a60df224b59297cd5638a
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: 02515F36A1879186EB248F29D064A3C37E4EB4DB59F245132CE4D977A4CF3AE863C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BB200 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: c38df702ad1cd7bd8676610964d002ed7ee257a7de35b02d7e799bc71ac0ca8b
Instruction ID: e8ab0bcb68b00c9aa582a5c4ca0f6f102c941a13011c571ee469d5349fda7614
Opcode Fuzzy Hash: c38df702ad1cd7bd8676610964d002ed7ee257a7de35b02d7e799bc71ac0ca8b
Instruction Fuzzy Hash: 5941BFB2718A5586EF44CF2AD96416E63A1FB48FD0B499433EE4D87B58DF7CD0628300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B8318 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF6DF0B8327
FlsGetValue.KERNEL32 ref: 00007FF6DF0B833C
FlsSetValue.KERNEL32 ref: 00007FF6DF0B835D
FlsSetValue.KERNEL32 ref: 00007FF6DF0B838A
FlsSetValue.KERNEL32 ref: 00007FF6DF0B839B
FlsSetValue.KERNEL32 ref: 00007FF6DF0B83AC
SetLastError.KERNEL32 ref: 00007FF6DF0B83C7
FlsGetValue.KERNEL32 ref: 00007FF6DF0B83FD
FlsSetValue.KERNEL32 ref: 00007FF6DF0B841C

Part of subcall function 00007FF6DF0BB708: HeapAlloc.KERNEL32(?,?,00000000,00007FF6DF0B84F2,?,?,8000000000000000,00007FF6DF0B7459,?,?,?,?,00007FF6DF0BB7D0,?,?,?), ref: 00007FF6DF0BB75D

FlsSetValue.KERNEL32 ref: 00007FF6DF0B8444

Part of subcall function 00007FF6DF0BAEE0: HeapFree.KERNEL32(?,?,?,00007FF6DF0C54DA,?,?,?,00007FF6DF0C5857,?,?,00000000,00007FF6DF0C35D9,?,?,?,00007FF6DF0C350B), ref: 00007FF6DF0BAEF6
Part of subcall function 00007FF6DF0BAEE0: GetLastError.KERNEL32(?,?,?,00007FF6DF0C54DA,?,?,?,00007FF6DF0C5857,?,?,00000000,00007FF6DF0C35D9,?,?,?,00007FF6DF0C350B), ref: 00007FF6DF0BAF00

FlsSetValue.KERNEL32 ref: 00007FF6DF0B8455
FlsSetValue.KERNEL32 ref: 00007FF6DF0B8466

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 142b0d750e11022f993b11fa3105a8e5230c7cf4a8e06bc9f771e789c5e31b15
Instruction ID: 35939136b7a2a62ac061966cd935b44da9c30161d8f826c6804ebbb70fde252b
Opcode Fuzzy Hash: 142b0d750e11022f993b11fa3105a8e5230c7cf4a8e06bc9f771e789c5e31b15
Instruction Fuzzy Hash: 6F410A60A0D60246FA58B721597517E23829F84BB0F588F37DD3EDB6E6DF2CB4728610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A4680 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4BDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4BE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4BE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4BEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4BF2

Strings

; expected , xrefs: 00007FF6DF0A4B37
while parsing , xrefs: 00007FF6DF0A4726
; last read: ', xrefs: 00007FF6DF0A48AC
syntax error , xrefs: 00007FF6DF0A46BD
unexpected , xrefs: 00007FF6DF0A4A37

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 3668304517-4239264347
Opcode ID: bf2c6a3dbc4ebe8e6f6f02efdb94b6935a189523ced9c98331939a6088174238
Instruction ID: 36e58735344d04177eb6b3e22c971fb173bebe861f67467b14c1fd949c3984a6
Opcode Fuzzy Hash: bf2c6a3dbc4ebe8e6f6f02efdb94b6935a189523ced9c98331939a6088174238
Instruction Fuzzy Hash: 57F1D466F1468188FB00DBA4E4503EC3BB2FB457A8F604236DE1CA7AD9DF7895A5C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF073BC0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF6DF073C1F

Part of subcall function 00007FF6DF0D2D3C: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF6DF0836E6,?,?,?,00000000,FFFFFFFF,?,?,00007FF6DF0760EA), ref: 00007FF6DF0D2D4E

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF073E20
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF073E26
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF073EB7

Strings

: ", xrefs: 00007FF6DF073CC8
", ", xrefs: 00007FF6DF073CFB

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_exception_destroy__std_fs_code_page
String ID: ", "$: "
API String ID: 2261858363-747220369
Opcode ID: 2d0fd51da2a97440119ab09b1080441983739d265db453ad23bb54c0850d6247
Instruction ID: 585eedb2d744a0ab715922284f12b2cc690a726ceae815ebbc7960005b664f0c
Opcode Fuzzy Hash: 2d0fd51da2a97440119ab09b1080441983739d265db453ad23bb54c0850d6247
Instruction Fuzzy Hash: 4EA1AC72B08A8185FB04DF65E4A43AD3366FB48B88F508532DE5C87B9ADF79D4A5C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF091F50 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 173COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF091FCE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6DF092017
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF092193
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0921A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0921AC

Strings

bad locale name, xrefs: 00007FF6DF092199
true, xrefs: 00007FF6DF0920CB
false, xrefs: 00007FF6DF09209E

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 0e023d3a70087abb8cb7f41ef3c4db963ea3e006f3ebe339350d3f2a4e60cca4
Instruction ID: 09b5bd7b80d73f73ae581426f94bfc399248f0d04470c89c65736078db43f86b
Opcode Fuzzy Hash: 0e023d3a70087abb8cb7f41ef3c4db963ea3e006f3ebe339350d3f2a4e60cca4
Instruction Fuzzy Hash: D2715D22B09B418AEB15DF61E8602BC33B5EF94748F184136DE4DA7A99DF38E471D348

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF09EF10 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6DF09EF74
GetProcessId.KERNEL32 ref: 00007FF6DF09EF7D

Part of subcall function 00007FF6DF0CC49C: AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00007FF6DF09EF95), ref: 00007FF6DF0CC4AC
Part of subcall function 00007FF6DF0CC49C: ReleaseSRWLockExclusive.KERNEL32(?,?,00000000,00007FF6DF09EF95), ref: 00007FF6DF0CC4EC

RmStartSession.RSTRTMGR ref: 00007FF6DF09EFAC
RmRegisterResources.RSTRTMGR ref: 00007FF6DF09EFD5
RmGetList.RSTRTMGR ref: 00007FF6DF09F00E
RmGetList.RSTRTMGR ref: 00007FF6DF09F070
RmEndSession.RSTRTMGR ref: 00007FF6DF09F0AC

Part of subcall function 00007FF6DF0CC508: AcquireSRWLockExclusive.KERNEL32(?,?,00000000,00007FF6DF09EF6B), ref: 00007FF6DF0CC518

RmEndSession.RSTRTMGR ref: 00007FF6DF09F0E4
RmEndSession.RSTRTMGR ref: 00007FF6DF09F0F9

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Session$ExclusiveLock$AcquireListProcess$CurrentRegisterReleaseResourcesStart
String ID:
API String ID: 1125094793-0
Opcode ID: 9224aefd456c5a56f14eb00f4f82c7ff3c1e505fea830415aac720a8f641c836
Instruction ID: 69ed09678ff4a2adf62136a42e34c115be1f1c5e9504fff7d989a1f7817f1230
Opcode Fuzzy Hash: 9224aefd456c5a56f14eb00f4f82c7ff3c1e505fea830415aac720a8f641c836
Instruction Fuzzy Hash: 36514E72B086428AF710CFA5E8606AC33B5FB88758F444536DA4ED7B94EF38E925C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B1CC4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0B1D07
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0B20F4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0B2390

Strings

p, xrefs: 00007FF6DF0B1E31
p, xrefs: 00007FF6DF0B1DB9
f, xrefs: 00007FF6DF0B1E29

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 041123ea1ae73b1056cdf3cb09bcf9ac158754c1906be7325b4519b920a27214
Instruction ID: abcc4ed946b8a26679ef1995f26f1d6f0371259edb7c0ec0ef26a5c331b2d418
Opcode Fuzzy Hash: 041123ea1ae73b1056cdf3cb09bcf9ac158754c1906be7325b4519b920a27214
Instruction Fuzzy Hash: B7129F22E1814386FB21AB15D5642BE77A1FB50754F944937EEA9C76C8DF3CE8A0CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0C2C20 Relevance: 10.8, APIs: 7, Instructions: 290COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0C304D

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b4da801f1259168053745cd1e4cf0e15fe88548eb24a1c6b213108a9908027a9
Instruction ID: cbd76e43bc6d2c3162b835c3243c33979f7f5523229aaf44100a6062e572b7c4
Opcode Fuzzy Hash: b4da801f1259168053745cd1e4cf0e15fe88548eb24a1c6b213108a9908027a9
Instruction Fuzzy Hash: 41C10532A0C78641E7609B1594602BE7B55FF90B80F5A4137EE4E87BA1CF7CE865C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0ACB00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF6DF0ACCDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ACD62
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ACD68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ACD6E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0ACD74

Strings

invalid_iterator, xrefs: 00007FF6DF0ACB72

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: invalid_iterator
API String ID: 1944019136-2508626007
Opcode ID: ad605efa5f4ff98795b83beeeb94bd7016d81a0ad85fffbed83e05510bcfadb6
Instruction ID: 4e1c72ca0246b8724714c174fe9dce50473c4f3d1a6f08dedc15562410ca03b5
Opcode Fuzzy Hash: ad605efa5f4ff98795b83beeeb94bd7016d81a0ad85fffbed83e05510bcfadb6
Instruction Fuzzy Hash: C8718363F19B8185FB00DB79D4607BC3361AB95798F509232DE6C97AD9EE38E1A5C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF081A80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF6DF081C61
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF081CEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF081CF1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF081CF7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF081CFD

Strings

other_error, xrefs: 00007FF6DF081AF0

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: other_error
API String ID: 1944019136-896093151
Opcode ID: 3027fed06361fb3a5dadd376c1d5dac625760c33528e380cba5ef62c381b4d6e
Instruction ID: 4d9910a4949b17f9b9d95a7ffd802e9197c222f9547feeebec4b8bb71dc22cba
Opcode Fuzzy Hash: 3027fed06361fb3a5dadd376c1d5dac625760c33528e380cba5ef62c381b4d6e
Instruction Fuzzy Hash: 9F719462F18B8198FB00DB75D4603AC3361AF953A8F509333EA5C97AD9EE78D1A5C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF080FD0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF6DF0811AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF081232
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF081238
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF08123E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF081244

Strings

type_error, xrefs: 00007FF6DF081042

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: type_error
API String ID: 1944019136-1406221190
Opcode ID: a71837deddd9ef77c740ff3000a57f75b4692660e40bbd89b3af669be55d46cc
Instruction ID: b2b6dfdee58528a8e6d51ac0f4476805344157bf7a8b308ee9b25eaaefd3dc95
Opcode Fuzzy Hash: a71837deddd9ef77c740ff3000a57f75b4692660e40bbd89b3af669be55d46cc
Instruction Fuzzy Hash: 1D719563F19B8198FB00DB75D4613EC2321AF857A8F509332DE6C976D9EE78A1A5C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0946D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF094872
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF094878
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF0948B0
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF0948BD

Strings

at line , xrefs: 00007FF6DF09475A
, column , xrefs: 00007FF6DF094788

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: __std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 729085983-191570568
Opcode ID: 4aa65757a4dfbd17e01377d747f016017521376861a771e4b66811c38d452e8c
Instruction ID: 8388d0126899ede0cd2a28ee89bfc397d54934e379bac38b962461ba2df73f2d
Opcode Fuzzy Hash: 4aa65757a4dfbd17e01377d747f016017521376861a771e4b66811c38d452e8c
Instruction Fuzzy Hash: 1451C772A0878581EB14DB15E16426E7721FB85BD4F548232EB9C87BD6DF3CE1A1C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0CB0E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6DF0CB111
GetLastError.KERNEL32 ref: 00007FF6DF0CB11D
CloseHandle.KERNEL32 ref: 00007FF6DF0CB135
CreateFileW.KERNEL32 ref: 00007FF6DF0CB160
WriteConsoleW.KERNEL32 ref: 00007FF6DF0CB17F

Strings

CONOUT$, xrefs: 00007FF6DF0CB141

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: a31fbbc51efb013240dbae52d240f628ffe7e4362ba99ccc1f003ae6e1d3dd90
Instruction ID: 1544972ae848eb33c4bf25823398c5e022e6c02d0fc0c96d5f3ec6981bf492e9
Opcode Fuzzy Hash: a31fbbc51efb013240dbae52d240f628ffe7e4362ba99ccc1f003ae6e1d3dd90
Instruction Fuzzy Hash: 24119D72B18A4186E3508B56E86436D63A4FB98FE8F444236EE5EC77E4DF7CD8248740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D43D8 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6DF0D444A
MultiByteToWideChar.KERNEL32 ref: 00007FF6DF0D44F2
LCMapStringEx.KERNEL32 ref: 00007FF6DF0D4529
LCMapStringEx.KERNEL32 ref: 00007FF6DF0D4582
LCMapStringEx.KERNEL32 ref: 00007FF6DF0D462F
WideCharToMultiByte.KERNEL32 ref: 00007FF6DF0D4671

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 02d7407602bfee31715a6bc1cba33474870e9b56b20ba3235c26d731ac343351
Instruction ID: 7eabdb5e543c4fc77f95fa4bcc7dc4a325f4858787bc9e4ad7da11f55c179933
Opcode Fuzzy Hash: 02d7407602bfee31715a6bc1cba33474870e9b56b20ba3235c26d731ac343351
Instruction Fuzzy Hash: 1B81A076A0974186EB208F21E86037E63A1FF847A8F044636EA5E9BFC8DF7CD5558700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A3EA0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A42A8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0A42B4

Part of subcall function 00007FF6DF0A2A50: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF0A2A7B
Part of subcall function 00007FF6DF0A2A50: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF0A2AA0

Strings

ios_base::failbit set, xrefs: 00007FF6DF0A4084
ios_base::eofbit set, xrefs: 00007FF6DF0A408B
ios_base::badbit set, xrefs: 00007FF6DF0A4079

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3294575841-1866435925
Opcode ID: 361e196d3f17deaaceb189b7e2bc1bfaec2dfbc40cef2e27739264da22a5e767
Instruction ID: 52c740252d6e63782c1b77f446e6e770de86bbf510654d75aa339f149e675c1a
Opcode Fuzzy Hash: 361e196d3f17deaaceb189b7e2bc1bfaec2dfbc40cef2e27739264da22a5e767
Instruction Fuzzy Hash: 18D1CD36A08B8196EB14CF25E5602AD73A4FB48B84F544636CB9D837A5DF3DE2B5C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B8490 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,8000000000000000,00007FF6DF0B7459,?,?,?,?,00007FF6DF0BB7D0,?,?,?,00007FF6DF0CE247), ref: 00007FF6DF0B849F
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF6DF0B7459,?,?,?,?,00007FF6DF0BB7D0,?,?,?,00007FF6DF0CE247), ref: 00007FF6DF0B84D5
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF6DF0B7459,?,?,?,?,00007FF6DF0BB7D0,?,?,?,00007FF6DF0CE247), ref: 00007FF6DF0B8502
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF6DF0B7459,?,?,?,?,00007FF6DF0BB7D0,?,?,?,00007FF6DF0CE247), ref: 00007FF6DF0B8513
FlsSetValue.KERNEL32(?,?,8000000000000000,00007FF6DF0B7459,?,?,?,?,00007FF6DF0BB7D0,?,?,?,00007FF6DF0CE247), ref: 00007FF6DF0B8524
SetLastError.KERNEL32(?,?,8000000000000000,00007FF6DF0B7459,?,?,?,?,00007FF6DF0BB7D0,?,?,?,00007FF6DF0CE247), ref: 00007FF6DF0B853F

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b1e42cd46dd091a5dc78ccb70ba89562456f872cb82161c5ad98c3cbe01ccb08
Instruction ID: 9933855f2704bb9655e881f93c7013ed2e2be1561e3703d5ccb646bc7b877932
Opcode Fuzzy Hash: b1e42cd46dd091a5dc78ccb70ba89562456f872cb82161c5ad98c3cbe01ccb08
Instruction Fuzzy Hash: 5E115E60A0D64242FA54A721696513E63926F887F0F548F37DC3ECB6E6DF6CE4628200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A2A50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF0A2A7B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF0A2AA0
std::_Facet_Register.LIBCPMT ref: 00007FF6DF0A2B4B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF0A2B96

Strings

cannot use at() with , xrefs: 00007FF6DF0A2C19

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID: cannot use at() with
API String ID: 1168246061-1462974127
Opcode ID: b0f02359b70497739aadaf27562320c49df78749e6bccfddbf07e9b7ed634968
Instruction ID: 429ae4eb2bec8fab2f4933a9b6ec6d606c7bab29b79c6c174ddecca1cc14df9d
Opcode Fuzzy Hash: b0f02359b70497739aadaf27562320c49df78749e6bccfddbf07e9b7ed634968
Instruction Fuzzy Hash: C4518032A18B4185EB20DF15E85027DB7A4FB94B94F584633DE9D87BA5DF7CD0A28700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A42F0 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4443
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4449
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A444F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A44BC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0A4525

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 34f558122bf865e906197af462b18e5a852b25263ca10d9f4a0b1783e48121ce
Instruction ID: 56f24c14c7f68d4dfa8f93fcfd76c76b6519af0c7395a3d9250dbc860177b5f0
Opcode Fuzzy Hash: 34f558122bf865e906197af462b18e5a852b25263ca10d9f4a0b1783e48121ce
Instruction Fuzzy Hash: 32518966B16B8181EF08CF69E06436C73A5FB44F94F544636EB6C87A99DF2CD5A0C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0CB6FC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6DF0CB724
_set_statfp.LIBCMT ref: 00007FF6DF0CB73F
_set_statfp.LIBCMT ref: 00007FF6DF0CB75B
_set_statfp.LIBCMT ref: 00007FF6DF0CB797

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 3db377e8cdbf53e49e91e2e74fb0c015a106e25631abdc3b155b97891ea90345
Instruction ID: c35de75fbac9d2ab149233fbafca223d7ff8f66ab06c319d8eddf060d5c06581
Opcode Fuzzy Hash: 3db377e8cdbf53e49e91e2e74fb0c015a106e25631abdc3b155b97891ea90345
Instruction Fuzzy Hash: A01191A6E1CA0301F774152AE56637D5342AF543B4E080B36EE6E976FADE6CA8704224

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0B8558 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6DF0AE20F,?,?,00000000,00007FF6DF0AE4AA,?,?,?,?,8000000000000000,00007FF6DF0AE436), ref: 00007FF6DF0B8577
FlsSetValue.KERNEL32(?,?,?,00007FF6DF0AE20F,?,?,00000000,00007FF6DF0AE4AA,?,?,?,?,8000000000000000,00007FF6DF0AE436), ref: 00007FF6DF0B8596
FlsSetValue.KERNEL32(?,?,?,00007FF6DF0AE20F,?,?,00000000,00007FF6DF0AE4AA,?,?,?,?,8000000000000000,00007FF6DF0AE436), ref: 00007FF6DF0B85BE
FlsSetValue.KERNEL32(?,?,?,00007FF6DF0AE20F,?,?,00000000,00007FF6DF0AE4AA,?,?,?,?,8000000000000000,00007FF6DF0AE436), ref: 00007FF6DF0B85CF
FlsSetValue.KERNEL32(?,?,?,00007FF6DF0AE20F,?,?,00000000,00007FF6DF0AE4AA,?,?,?,?,8000000000000000,00007FF6DF0AE436), ref: 00007FF6DF0B85E0

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 078a902eec1aa32f9bbb7f0bccf8443e93c26390936cae6de50c508c51a1d619
Instruction ID: c0be4f76ae23301a5a797c78b09e6055c0f4d191af530e7e6e45be72df843c90
Opcode Fuzzy Hash: 078a902eec1aa32f9bbb7f0bccf8443e93c26390936cae6de50c508c51a1d619
Instruction Fuzzy Hash: 9E114C60E0C64241FA58A726696517E63869F847B0F448F37ED3DCB6E6DE2CF4728600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D5FDC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0D62BB

Part of subcall function 00007FF6DF0CA02C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6DF0CA049

Strings

UTF-8, xrefs: 00007FF6DF0D623A
ccs, xrefs: 00007FF6DF0D61F6
UTF-16LEUNICODE, xrefs: 00007FF6DF0D6259

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7284a90c9f2e9dd3f7227fabfef20605241c7f268e52af124d130a8212c007cf
Instruction ID: c041e159e2a27acbc97ddf6d4aeac5a0df9f4570ba09681439b8fb552802b2fd
Opcode Fuzzy Hash: 7284a90c9f2e9dd3f7227fabfef20605241c7f268e52af124d130a8212c007cf
Instruction Fuzzy Hash: 7381D53AE0C60385FB754F698D7023D2BA4AB91748F598037CA0ED7A86DF2DE4229701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF088D60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF088DCE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6DF088E16
_Getctype.LIBCPMT ref: 00007FF6DF088E54

Strings

bad locale name, xrefs: 00007FF6DF088F0D

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: b9d950414393fc73db6700ce3be29ab8677aec3015980b7ffe4ac9adb3849b91
Instruction ID: fcd753ff8235b085dcfd47b7b562e7331ac54ec0918954beb4deeb861fc7b7ea
Opcode Fuzzy Hash: b9d950414393fc73db6700ce3be29ab8677aec3015980b7ffe4ac9adb3849b91
Instruction Fuzzy Hash: 79919C32B09B418AFB11DF21D8A02FC37A6EF90784F144436DA8D97A9ADF38E565C354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF074990 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 00007FF6DF074AA4

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 6fe8fb0c9968038b29a8638f9797f4334faf7de4f1b8b181b4a0abe00a99f196
Instruction ID: 0979561749a0584a006275f268efbf3c598310180439949b053ee37a7782127d
Opcode Fuzzy Hash: 6fe8fb0c9968038b29a8638f9797f4334faf7de4f1b8b181b4a0abe00a99f196
Instruction Fuzzy Hash: C261C376E18B8182EB10CF29E46036EB761EBC5B94F544232EA9D47B9ACF7CD161C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BF308 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6DF0BF387
WriteFile.KERNEL32 ref: 00007FF6DF0BF64F
WriteFile.KERNEL32 ref: 00007FF6DF0BF695
GetLastError.KERNEL32 ref: 00007FF6DF0BF74B

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f9d86d9bd444fd118df228010101dc81beb47c4f6f150a854bed3fc07db29987
Instruction ID: ad5ed94b343286ee2ec4dc87da54601e21083b5059ae9851cef51d32cf5c453f
Opcode Fuzzy Hash: f9d86d9bd444fd118df228010101dc81beb47c4f6f150a854bed3fc07db29987
Instruction Fuzzy Hash: 0BD1F536B18A818AE710CFB9D4502EC37B5FB58798B548636CE5DD7B99DE38D426C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF082AA0 Relevance: 6.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF082C0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF082C18
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF082D8C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF082D98

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 41ff5cef601d685c722a1ad8a358c84b4c3d29c7c1d14b1135a6f44c8b1a1f07
Instruction ID: 3a515fb4c76672e5255d644b026ce78836673344e562a92c0fa6c723ecb0b698
Opcode Fuzzy Hash: 41ff5cef601d685c722a1ad8a358c84b4c3d29c7c1d14b1135a6f44c8b1a1f07
Instruction Fuzzy Hash: 04711762B09B8681ED14EB56E4245BE6790FB44BE4F944A36DFAD87BD5CF3CE0618300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BFCC8 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6DF0BFCB3), ref: 00007FF6DF0BFDE4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6DF0BFCB3), ref: 00007FF6DF0BFE6F

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: d409dfd16bc18727b876812e7f265304e9354bdde45e1157d8325eb742d43cc0
Instruction ID: 53f6bc30166a173a74426783e7848d4b618af3cfdcd66e0dc67cf9c014ea9409
Opcode Fuzzy Hash: d409dfd16bc18727b876812e7f265304e9354bdde45e1157d8325eb742d43cc0
Instruction Fuzzy Hash: AF91D332F1869285F7608FA5D4602BD2BA1BB49B8AF54453BDE1ED7A95CF3CD462C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF072740 Relevance: 6.2, APIs: 4, Instructions: 184COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0728AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0728B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF072988
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6DF0729B2

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID:
API String ID: 1346393832-0
Opcode ID: a368585bf3662c78e9a9efab872df86b2ce5959888669c2c45dc9db72dab3b8b
Instruction ID: 36137490cd9de54d98e95cb44656184b79740ef15d4f17902c96e4e10aa854a5
Opcode Fuzzy Hash: a368585bf3662c78e9a9efab872df86b2ce5959888669c2c45dc9db72dab3b8b
Instruction Fuzzy Hash: 9371A262E08B8181EB109B25E45136DB361FB89BD4F549232EF9C43B9ADF7CE1A0C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0D2ED0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6DF0D2F19
GetLastError.KERNEL32 ref: 00007FF6DF0D2F27
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF6DF080559), ref: 00007FF6DF0D2F5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF6DF080559), ref: 00007FF6DF0D2F6A

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 66186533058f7cadebb3082776b351f2adfa147ae5296369620ec292b25ff590
Instruction ID: 6a721a3e9bdb7040d3913088380e836c0da2408909ef6b7865e06123f871164d
Opcode Fuzzy Hash: 66186533058f7cadebb3082776b351f2adfa147ae5296369620ec292b25ff590
Instruction Fuzzy Hash: 4E21F976A28B858AE3508F11E85432EB7B4FB89B94F544139DB8993B54DF3DD811CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0A3CF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF0A3D5E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6DF0A3DA6

Strings

bad locale name, xrefs: 00007FF6DF0A3E85

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 96ef8150aa1f0eba1261c1f9aa30cc89bf3811c7c2501a4edfb691f47747fcc1
Instruction ID: 24d711b8a4e9ec6c80d2af080edd55b9d4f1920736ed8928e16611861d6033a8
Opcode Fuzzy Hash: 96ef8150aa1f0eba1261c1f9aa30cc89bf3811c7c2501a4edfb691f47747fcc1
Instruction Fuzzy Hash: 2CA16936609B419AEB10CF65E8A06AC73A8FB88B44F444136DB8D97BA5DF38E575C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF07E680 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF07E7BE
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6DF07E7CA

Strings

cannot use push_back() with , xrefs: 00007FF6DF07E870

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: cannot use push_back() with
API String ID: 73155330-4122110429
Opcode ID: 770dbedafe867ed2f0c2a7fb682f8e03d833e983382234f98b866b15cd3830e3
Instruction ID: 1b9a7fc4be8b4e6d58dc1b60113da4032854b73c797a38c8e77b6539b1298ce1
Opcode Fuzzy Hash: 770dbedafe867ed2f0c2a7fb682f8e03d833e983382234f98b866b15cd3830e3
Instruction Fuzzy Hash: ED519632A09B8281EA609F21F4503AEA3A5FF48794F584532DF9D87B96DF3CD461C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0921C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6DF09222E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6DF092276

Strings

bad locale name, xrefs: 00007FF6DF09234B

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 91db57b10f62ca1347222afa0fda0f7146d0f222da3f1973ca5202cc53bb3525
Instruction ID: f48af0d3035f77303ce0af7a4b0ed6fefefa5f2db996d27fb2709a59461c8001
Opcode Fuzzy Hash: 91db57b10f62ca1347222afa0fda0f7146d0f222da3f1973ca5202cc53bb3525
Instruction Fuzzy Hash: FE516E32B09A419AEB14DF71E8A02FC33A4EF54B48F484436EF4DA7A95DE38D562C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0BF9A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6DF0BFAB7
GetLastError.KERNEL32 ref: 00007FF6DF0BFAD9

Strings

U, xrefs: 00007FF6DF0BFA63

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: fe8bda706c613ae14a45258dbcdb5513988a1c9fb56f42e7dad01d90755ce01d
Instruction ID: 5557b615218d426fa51a11231ed96dd03933091edaf339465ebb104d6163a1cb
Opcode Fuzzy Hash: fe8bda706c613ae14a45258dbcdb5513988a1c9fb56f42e7dad01d90755ce01d
Instruction Fuzzy Hash: 0841A272B18A8186EB20CF65E8543AEA7A0FB98B94F844432EE4DC7798DF7CD451C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0888A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF0889FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6DF088A03

Strings

iostream, xrefs: 00007FF6DF088A10

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: iostream
API String ID: 3668304517-2522040138
Opcode ID: 0656a1b7ccf82d60add90f479d50827246c7bbe713b1ccb287cc66060cc9d5cb
Instruction ID: 2cefc13e201ea0ca7e88554a493afb636b138b51b6a9e9d46aa0d08b73b85171
Opcode Fuzzy Hash: 0656a1b7ccf82d60add90f479d50827246c7bbe713b1ccb287cc66060cc9d5cb
Instruction Fuzzy Hash: C0418562E18BC641EE119B28E4513AE6351FFD57A4F509332EAEC836D6EF2CD194C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DF0CF3F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6DF0D35EE), ref: 00007FF6DF0CF444
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF6DF0D35EE), ref: 00007FF6DF0CF485

Strings

csm, xrefs: 00007FF6DF0CF472

Memory Dump Source

Source File: 00000000.00000002.1642161747.00007FF6DF051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DF050000, based on PE: true

Associated: 00000000.00000002.1642152918.00007FF6DF050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642198658.00007FF6DF0E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642215267.00007FF6DF108000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1642224826.00007FF6DF10D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6df050000_Metamask_setup.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 5f9d82367ba7d16b9c020008a7c4cdc299bef0669957e85fe42ba619740a2db2
Instruction ID: 684d94d05fa7fb8ae887d6acbdbe4b09b125a892ccdf32eca8e49807b5fe094d
Opcode Fuzzy Hash: 5f9d82367ba7d16b9c020008a7c4cdc299bef0669957e85fe42ba619740a2db2
Instruction Fuzzy Hash: 10113032618B8182EB218F25F4502AD77E4FB88B99F584236DF8C47B58DF3DD5618710

Uniqueness

Uniqueness Score: -1.00%

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Metamask_setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Metamask_setup.exePID: 7064, Parent PID: 2580

General

Chronological Activities

Disassembly

Windows Analysis Report
Metamask_setup.exe

Function 00007FF6DF0BA018 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Function 00007FF6DF07E4B0 Relevance: 3.1, APIs: 2, Instructions: 141
COMMON

Function 00007FF6DF07EEE0 Relevance: 3.1, APIs: 2, Instructions: 107
COMMON

Function 00007FF6DF0CC580 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Function 00007FF6DF0D5278 Relevance: 1.6, APIs: 1, Instructions: 64
COMMONLIBRARYCODE

Function 00007FF6DF0BB780 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Function 00007FF6DF0D308C Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00007FF6DF09F110 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 371
nativelibraryloaderCOMMON

Function 00007FF6DF0AD590 Relevance: 21.9, APIs: 14, Instructions: 865
COMMON

Function 00007FF6DF0A3680 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 405
COMMON

Function 00007FF6DF091A80 Relevance: 16.8, APIs: 11, Instructions: 345
COMMON

Function 00007FF6DF0B8318 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Function 00007FF6DF0A4680 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 364
COMMON