Edit tour

Windows Analysis Report
MbYnGuRGnm.exe

Overview

General Information

Sample name:	MbYnGuRGnm.exe renamed because original name is a hash value
Original sample name:	e57ce68c59b39ce145bbeec16942a48068fcaa26f6ff7d7a2c16b0d947d17873.exe
Analysis ID:	1410994
MD5:	f671843cfde5c734ce07aa5a35e32934
SHA1:	717d3b853415bd2f1645f7edcd0944b438e3d01a
SHA256:	e57ce68c59b39ce145bbeec16942a48068fcaa26f6ff7d7a2c16b0d947d17873
Tags:	exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Found large amount of non-executed APIs

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Classification

Process Tree

System is w10x64

MbYnGuRGnm.exe (PID: 7532 cmdline: C:\Users\user\Desktop\MbYnGuRGnm.exe MD5: F671843CFDE5C734CE07AA5A35E32934)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MbYnGuRGnm.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: MbYnGuRGnm.exe

ReversingLabs: Detection: 28%

Source: MbYnGuRGnm.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: MbYnGuRGnm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_00405841 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405841
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_00406393 FindFirstFileW,FindClose,	0_2_00406393

Source: MbYnGuRGnm.exe, 00000000.00000002.1282798108.0000000000618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: MbYnGuRGnm.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

Code function: 0_2_004052EE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052EE

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004032A0

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_00407040	0_2_00407040
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_00406869	0_2_00406869
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_00404B2B	0_2_00404B2B

Source: MbYnGuRGnm.exe, 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameavoke besully.exe: vs MbYnGuRGnm.exe
Source: MbYnGuRGnm.exe	Binary or memory string: OriginalFilenameavoke besully.exe: vs MbYnGuRGnm.exe

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Section loaded: wintypes.dll	Jump to behavior

Source: MbYnGuRGnm.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

0_2_004032A0

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

Code function: 0_2_004045AF GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045AF

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

File created: C:\Users\user\AppData\Local\Temp\nsxB483.tmp

Jump to behavior

Source: MbYnGuRGnm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MbYnGuRGnm.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

File read: C:\Users\user\Desktop\MbYnGuRGnm.exe

Jump to behavior

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: MbYnGuRGnm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

API coverage: 8.9 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_00405841 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405841
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\MbYnGuRGnm.exe	Code function: 0_2_00406393 FindFirstFileW,FindClose,	0_2_00406393

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

API call chain: ExitProcess graph end node

graph_0-2868

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\MbYnGuRGnm.exe

0_2_004032A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MbYnGuRGnm.exe	29%	ReversingLabs	Win32.Trojan.Generic
MbYnGuRGnm.exe	100%	Avira	TR/Crypt.XPACK.Gen

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	MbYnGuRGnm.exe, 00000000.00000002.1282798108.0000000000618000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	MbYnGuRGnm.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410994
Start date and time:	2024-03-18 14:37:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MbYnGuRGnm.exe renamed because original name is a hash value
Original Sample Name:	e57ce68c59b39ce145bbeec16942a48068fcaa26f6ff7d7a2c16b0d947d17873.exe
Detection:	MAL
Classification:	mal56.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: MbYnGuRGnm.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	3.5147110484087873
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MbYnGuRGnm.exe
File size:	334'336 bytes
MD5:	f671843cfde5c734ce07aa5a35e32934
SHA1:	717d3b853415bd2f1645f7edcd0944b438e3d01a
SHA256:	e57ce68c59b39ce145bbeec16942a48068fcaa26f6ff7d7a2c16b0d947d17873
SHA512:	eabc7f59785597c900b89bd38e3875cbad0793f59ae287317b9c6815717449d7dd714503d846e884b7abd5b1e1a2cec9728b22e327f8bff326f1099d36f37ebc
SSDEEP:	3072:14lLpkXGED6iNuVIJMyeLZGofkUQmk6gWX8PsjpWDe/hz:epkXGU5KsUv
TLSH:	16642A51BF04D652C41D1BF6CAFBA43983B24CA1150199336721BE6F3DBEF82B8295B4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..OP.._...P...s...P...V...P..Rich.P..........PE..L....c.W.................d...........2............@

File Icon


Icon Hash:	074b5b564e1e3e6c

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5795639D [Mon Jul 25 00:55:57 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e2a592076b17ef8bfb48b7e03965a3fc

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007EFC4CBE4203h
push ebx
call 00007EFC4CBE7344h
cmp eax, ebx
je 00007EFC4CBE41F9h
push 00000C00h
call eax
mov esi, 004082B8h
push esi
call 00007EFC4CBE72BEh
push esi
call dword ptr [0040815Ch]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007EFC4CBE41DCh
push ebp
push 00000009h
call 00007EFC4CBE7316h
push 00000007h
call 00007EFC4CBE730Fh
mov dword ptr [00434EE4h], eax
call dword ptr [0040803Ch]
push ebx
call dword ptr [004082A4h]
mov dword ptr [00434F98h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0042B208h
call dword ptr [00408188h]
push 0040A2C8h
push 00433EE0h
call 00007EFC4CBE6EF8h
call dword ptr [004080A8h]
mov ebp, 0043F000h
push eax
push ebp
call 00007EFC4CBE6EE6h
push ebx
call dword ptr [00408174h]
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x495b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7000	0x6400	4219bc0ba21196c40804cc23644c3170	False	0.671484375	data	6.484635885032963	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2000	0x1600	c55888d8b5fea0b52e7bde578e8da071	False	0.5363991477272727	data	5.421327062358691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0xa000	0x2b000	0x600	2aa587c909999ca52be17d0f1ffbd186	False	0.5188802083333334	data	4.039551377217298	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x23000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x58000	0x495b0	0x49600	771d7595b9749a41377500ec346a9449	False	0.1746067131601363	data	3.0539009359011295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x58388	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.15141876497914017
RT_ICON	0x9a3b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3052904564315353
RT_ICON	0x9c958	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.36186679174484054
RT_ICON	0x9da00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.4984008528784648
RT_ICON	0x9e8a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.41352459016393445
RT_ICON	0x9f230	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5482851985559567
RT_ICON	0x9fad8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.5
RT_ICON	0xa01a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.40390173410404623
RT_ICON	0xa0708	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.49379432624113473
RT_DIALOG	0xa0b70	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa0c70	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xa0d90	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa0e58	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa0eb8	0x84	data	English	United States	0.6666666666666666
RT_VERSION	0xa0f40	0x244	data	English	United States	0.5310344827586206
RT_MANIFEST	0xa1188	0x422	XML 1.0 document, ASCII text, with very long lines (1058), with no line terminators	English	United States	0.5122873345935728

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, WaitForSingleObject, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GlobalFree, GlobalAlloc, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, ExpandEnvironmentStringsW, lstrcmpW, GlobalUnlock, lstrcpynW, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, LoadImageW, SetTimer, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, DrawTextW, EndPaint, CreateDialogParamW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	14:38:43
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\MbYnGuRGnm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\MbYnGuRGnm.exe
Imagebase:	0x400000
File size:	334'336 bytes
MD5 hash:	F671843CFDE5C734CE07AA5A35E32934
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.4%
Total number of Nodes:	1306
Total number of Limit Nodes:	17

Executed Functions

Function 004032A0 Relevance: 79.2, APIs: 33, Strings: 12, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C3
GetVersion.KERNEL32 ref: 004032C9
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004032F2
#17.COMCTL32(00000007,00000009), ref: 00403315
OleInitialize.OLE32(00000000), ref: 0040331C
SHGetFileInfoW.SHELL32(0042B208,00000000,?,000002B4,00000000), ref: 00403338
GetCommandLineW.KERNEL32(00433EE0,NSIS Error), ref: 0040334D
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403360
CharNextW.USER32(00000000,0043F000,00000020), ref: 00403387

Part of subcall function 0040642A: GetModuleHandleA.KERNEL32(?,00000020,?,00403309,00000009), ref: 0040643C
Part of subcall function 0040642A: GetProcAddress.KERNEL32(00000000,?), ref: 00406457

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C1
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D2
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034DE
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F2
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FA
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350B
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403513
DeleteFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsxB483.tmp), ref: 00403527

Part of subcall function 00406050: lstrcpynW.KERNEL32(?,?,00000400,0040334D,00433EE0,NSIS Error), ref: 0040605D

OleUninitialize.OLE32(?), ref: 004035F2
ExitProcess.KERNEL32 ref: 00403613
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403626
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403635
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403640
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00440800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,0043F000,00000000,?), ref: 0040364C
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403668
DeleteFileW.KERNEL32(0042AA08,0042AA08,?,00435000,?), ref: 004036C2
CopyFileW.KERNEL32(00442800,0042AA08,00000001), ref: 004036D6
CloseHandle.KERNEL32(00000000,0042AA08,0042AA08,?,0042AA08,00000000), ref: 00403703
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403732
OpenProcessToken.ADVAPI32(00000000), ref: 00403739
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040374E
AdjustTokenPrivileges.ADVAPI32 ref: 00403771
ExitWindowsEx.USER32(00000002,80040002), ref: 00403796
ExitProcess.KERNEL32 ref: 004037B9

Strings

SeShutdownPrivilege, xrefs: 00403748
Low, xrefs: 004034F4
NSIS Error, xrefs: 0040333E
C:\Users\user\AppData\Local\Temp\nsxB483.tmp, xrefs: 00403522
UXTHEME, xrefs: 004032E6, 004032EB, 004032F1
Error launching installer, xrefs: 004035A9
C:\Users\user\AppData\Local\Temp\, xrefs: 004034B6, 004034BB, 004034D1, 004034DD, 004034EC, 004034F9, 00403505, 0040350D, 00403623, 00403634, 0040363F, 0040364B, 00403658, 00403667, 00403718
TEMP, xrefs: 00403506
TMP, xrefs: 0040350E
.tmp, xrefs: 0040363A
~nsu, xrefs: 0040361E
\Temp, xrefs: 004034D8

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsxB483.tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-4288650713
Opcode ID: 2ff4eeaa59d63db16641e32b56e8f41dd6deb8ab6398678d654e83296b586d17
Instruction ID: bc0dc6ca93ec9440221f6a1154d69e62cad873230aa3e7f423b6c7eed9202452
Opcode Fuzzy Hash: 2ff4eeaa59d63db16641e32b56e8f41dd6deb8ab6398678d654e83296b586d17
Instruction Fuzzy Hash: 60D1F470600300ABE710BF759D45B2B3AADEB8074AF51443FF581B62E1DB7D8A458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 004063BA Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D1
wsprintfW.USER32 ref: 0040640C
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406420

Strings

UXTHEME, xrefs: 004063C3
\, xrefs: 004063E2
%s%S.dll, xrefs: 00406406

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 9cd176900e46196ffcfca9c6351026e8055dbc09b9427d0f5483d49a535bfda6
Instruction ID: 7b807a610878b0bc4ee9c08e82fc2c2c0a074289e2a27b7b834fb84ffe8ff7bb
Opcode Fuzzy Hash: 9cd176900e46196ffcfca9c6351026e8055dbc09b9427d0f5483d49a535bfda6
Instruction Fuzzy Hash: 09F0F670500219A7DB10AB68ED0DF9B3A6CEB00304F50443AA946F10D1EBB8DA29CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 00405C54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C72
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,0043F000,0040329E,C:\Users\user\AppData\Local\Temp\nsxB483.tmp,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 00405C8D

Strings

nsa, xrefs: 00405C61
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C59

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2042855515
Opcode ID: da3add3990966c57ea49aa46ced784fea404a948837784a5301244cb17f573d8
Instruction ID: 1b208e64e042baf7dbd80c3cabdcb34a7d602449cab37475291322263c582f77
Opcode Fuzzy Hash: da3add3990966c57ea49aa46ced784fea404a948837784a5301244cb17f573d8
Instruction Fuzzy Hash: 7CF09076700708BFEB00DF59DD49A9BBBBCEB91710F10403AF940E7180E6B49A548B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040642A Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403309,00000009), ref: 0040643C
GetProcAddress.KERNEL32(00000000,?), ref: 00406457

Part of subcall function 004063BA: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D1
Part of subcall function 004063BA: wsprintfW.USER32 ref: 0040640C
Part of subcall function 004063BA: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406420

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 82069e22af83b56f915537a5bbc2862a2b5ba3ad8f84c774fb382a69f2dcb8e0
Instruction ID: 08b0c8f2ef2dcefd2b61a20e7fd6ba3d75d00ffdaa245a95e4079d340ab3ded5
Opcode Fuzzy Hash: 82069e22af83b56f915537a5bbc2862a2b5ba3ad8f84c774fb382a69f2dcb8e0
Instruction Fuzzy Hash: D2E0863260462056D25197745E4493773AD9E99744302043EFA46F2080DB789C329B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405C25 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,00442800,80000000,00000003,?,?,0043F000,00403536,?), ref: 00405C29
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,0043F000,00403536,?), ref: 00405C4B

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Uniqueness

Uniqueness Score: -1.00%

Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 00405701
GetLastError.KERNEL32 ref: 0040570F

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: e63be1853aafe68c2793134b37a867bebc3d2beebaf226ad42ac31f610d1a78e
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: 7CC04C30225602DBDA105B60DE087177A94AB90741F118439A146E21A0DA348415ED2D

Uniqueness

Uniqueness Score: -1.00%

Function 00405CA8 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CBC

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: ab2ba72c7da8d0590a5026c7b9f2a747677d692c160b15db9e96a66b9068c41a
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 01E0EC3221425AABEF109E659C04EEB7B6CEB15361F104437F915F6150E631E861ABB4

Uniqueness

Uniqueness Score: -1.00%

Function 00405795 Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxIndirectW.USER32(0040A3B8), ref: 004057F0

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: ccd026c5384589d9d91cd1dc4b0848bd3c598ee9e9c1ce5f4514bc091511ba40
Instruction ID: d7df18c7d1cfe7968f91a71e4ce65a96867a43453752e6a410af80c0e71b783f
Opcode Fuzzy Hash: ccd026c5384589d9d91cd1dc4b0848bd3c598ee9e9c1ce5f4514bc091511ba40
Instruction Fuzzy Hash: 45F0DF75620300CBC354CF58EA457963BE0F388315F54603AE945A63A0C77899A4DF0A

Uniqueness

Uniqueness Score: -1.00%

Function 004037BF Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(FFFFFFFF,004035F2,?), ref: 004037CA

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 11f2164fdcf4882d09a4a0de7c791955399c7c72b14224a7a720262371b4e31f
Instruction ID: f140588c7f0437f4feb7db645ea9abd6b0460cad5339c8afa3da759f722761b4
Opcode Fuzzy Hash: 11f2164fdcf4882d09a4a0de7c791955399c7c72b14224a7a720262371b4e31f
Instruction Fuzzy Hash: 9CC0223010070042D0203F349E4F6143A546B00339FA08336B1F8B14F0C73C02A9881D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004052EE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040534C
GetDlgItem.USER32(?,000003EE), ref: 0040535B
GetClientRect.USER32(?,?), ref: 00405398
GetSystemMetrics.USER32(00000002), ref: 0040539F
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C0
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D1
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E4
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F2
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405405
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405427
ShowWindow.USER32(?,00000008), ref: 0040543B
GetDlgItem.USER32(?,000003EC), ref: 0040545C
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040546C
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405485
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405491
GetDlgItem.USER32(?,000003F8), ref: 0040536A

Part of subcall function 00404149: SendMessageW.USER32(00000028,?,00000001,00403F75), ref: 00404157

GetDlgItem.USER32(?,000003EC), ref: 004054AE
CreateThread.KERNEL32(00000000,00000000,Function_00005282,00000000), ref: 004054BC
CloseHandle.KERNEL32(00000000), ref: 004054C3
ShowWindow.USER32(00000000), ref: 004054E7
ShowWindow.USER32(?,00000008), ref: 004054EC
ShowWindow.USER32(00000008), ref: 00405536
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556A
CreatePopupMenu.USER32 ref: 0040557B
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040558F
GetWindowRect.USER32(?,?), ref: 004055AF
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055C8
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405600
OpenClipboard.USER32(00000000), ref: 00405610
EmptyClipboard.USER32 ref: 00405616
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405622
GlobalLock.KERNEL32(00000000), ref: 0040562C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405640
GlobalUnlock.KERNEL32(00000000), ref: 00405660
SetClipboardData.USER32(0000000D,00000000), ref: 0040566B
CloseClipboard.USER32 ref: 00405671

Strings

{, xrefs: 00405554

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 5a079ba3fa072edfcc104ec433df7a761f0ace007a27466cf36ce9faf3e20e8c
Instruction ID: 61e351ecde1d042c29ac1aa70548d375e1b8ad830a3fa6051c24e393c3684683
Opcode Fuzzy Hash: 5a079ba3fa072edfcc104ec433df7a761f0ace007a27466cf36ce9faf3e20e8c
Instruction Fuzzy Hash: FAB14971800608BFDB119F60DD89EAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404B2B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B43
GetDlgItem.USER32(?,00000408), ref: 00404B4E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B98
LoadBitmapW.USER32(0000006E), ref: 00404BAB
SetWindowLongW.USER32(?,000000FC,00405123), ref: 00404BC4
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BD8
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEA
SendMessageW.USER32(?,00001109,00000002), ref: 00404C00
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C0C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C1E
DeleteObject.GDI32(00000000), ref: 00404C21
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C4C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C58
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CEE
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D19
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D2D
GetWindowLongW.USER32(?,000000F0), ref: 00404D5C
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6A
ShowWindow.USER32(?,00000005), ref: 00404D7B
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E78
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EDD
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF2
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F16
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F36
ImageList_Destroy.COMCTL32(?), ref: 00404F4B
GlobalFree.KERNEL32(?), ref: 00404F5B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD4
SendMessageW.USER32(?,00001102,?,?), ref: 0040507D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040508C
InvalidateRect.USER32(?,00000000,00000001), ref: 004050AC
ShowWindow.USER32(?,00000000), ref: 004050FA
GetDlgItem.USER32(?,000003FE), ref: 00405105
ShowWindow.USER32(00000000), ref: 0040510C

Strings

M, xrefs: 00404CD5
N, xrefs: 00404DB6
, xrefs: 004050E4

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 8c45a3bebccd838025462a13ae5546f6c20f9e3bfbd9b3af7d062b47be19aa5d
Instruction ID: 92be4e2f0a71e0becefd48613cebd317121b53e3330ca333a75e7b8088edbb55
Opcode Fuzzy Hash: 8c45a3bebccd838025462a13ae5546f6c20f9e3bfbd9b3af7d062b47be19aa5d
Instruction Fuzzy Hash: 49027FB0900209EFDB209F95DD85AAE7BB5FB84314F10817AF610BA2E1C7799D42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004045AF Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004045FE
SetWindowTextW.USER32(00000000,?), ref: 00404628
SHBrowseForFolderW.SHELL32(?), ref: 004046D9
CoTaskMemFree.OLE32(00000000), ref: 004046E4
lstrcmpiW.KERNEL32(00432E80,0042D248,00000000,?,?), ref: 00404716
lstrcatW.KERNEL32(?,00432E80), ref: 00404722
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404734

Part of subcall function 00405779: GetDlgItemTextW.USER32(?,?,00000400,0040476B), ref: 0040578C

Part of subcall function 004062E4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 00406347
Part of subcall function 004062E4: CharNextW.USER32(?,?,?,00000000), ref: 00406356
Part of subcall function 004062E4: CharNextW.USER32(?,00000000,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 0040635B
Part of subcall function 004062E4: CharPrevW.USER32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 0040636E

GetDiskFreeSpaceW.KERNEL32(0042B218,?,?,0000040F,?,0042B218,0042B218,?,00000001,0042B218,?,?,000003FB,?), ref: 004047F7
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404812

Part of subcall function 0040496B: lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A0C
Part of subcall function 0040496B: wsprintfW.USER32 ref: 00404A15
Part of subcall function 0040496B: SetDlgItemTextW.USER32(?,0042D248), ref: 00404A28

Strings

A, xrefs: 004046D2

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 2012bd4a833c4d898378cba450fc69f200c02d46a41c020b3c2c2ea494a7c68c
Instruction ID: d238959ebaf25b01a045b7410cfe39ad7a074a1c0e4d09bd35cd2a97c430e078
Opcode Fuzzy Hash: 2012bd4a833c4d898378cba450fc69f200c02d46a41c020b3c2c2ea494a7c68c
Instruction Fuzzy Hash: 25A171B1900209ABDB11AFA5CD85AAFB7B8EF85314F10843BF601B72D1D77C89418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405841 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040586A
lstrcatW.KERNEL32(0042F250,\*.*), ref: 004058B2
lstrcatW.KERNEL32(?,0040A014), ref: 004058D5
lstrlenW.KERNEL32(?,?,0040A014,?,0042F250,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058DB
FindFirstFileW.KERNEL32(0042F250,?,?,?,0040A014,?,0042F250,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058EB
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 0040598B
FindClose.KERNEL32(00000000), ref: 0040599A

Strings

\*.*, xrefs: 004058AC
C:\Users\user\AppData\Local\Temp\, xrefs: 0040584E

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3151436664
Opcode ID: 0834fff36565ee898563603d92d026ad614ba3aa6e0f956547113d163bc73b70
Instruction ID: caf420165dc21d0a99f0983ed575dd8be70d76c6b9b5ff92ec706b465e099e4b
Opcode Fuzzy Hash: 0834fff36565ee898563603d92d026ad614ba3aa6e0f956547113d163bc73b70
Instruction Fuzzy Hash: DB41B171800A14EADB21AB65CD49BBF7678EF85764F10423BF801B11D1D77C4A82DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406393 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00430298,0042FA50,00405B55,0042FA50,0042FA50,00000000,0042FA50,0042FA50, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405861,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 0040639E
FindClose.KERNEL32(00000000), ref: 004063AA

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 395586dc4edb235965e2a282b5d7432a8e50c5a064bd8b1b9b8a05e290e3bc0b
Instruction ID: 351587cf9ce3a522800e1c73501a9738d9f8821b35168cd3fdb078f4a7df3edc
Opcode Fuzzy Hash: 395586dc4edb235965e2a282b5d7432a8e50c5a064bd8b1b9b8a05e290e3bc0b
Instruction Fuzzy Hash: C2D012315081209BC34157787E0C84B7B5C9F1A3317259F36F96AF12E1CB348C2286DC

Uniqueness

Uniqueness Score: -1.00%

Function 00407040 Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

p!C, xrefs: 00407190, 004071B2, 00407262, 00407234, 004071B7
p!C, xrefs: 00407274

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID:
String ID: p!C$p!C
API String ID: 0-3125587631
Opcode ID: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction ID: 15f69c865bc8d9ec0e9cf8060aa07673d574756af28658d99b75493111c5da86
Opcode Fuzzy Hash: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction Fuzzy Hash: 1DC15831E042598BCF18CF68D4905EEB7B2FF99314F25826AD8567B380D7346A42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00402095 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 56003168661b43130369e71dd8cf878fc49476dd3371d308d312326e99dcc780
Instruction ID: c02b05589a316e099dfb0d7529d526a00835c5092bff723ddb1c3c0439b696db
Opcode Fuzzy Hash: 56003168661b43130369e71dd8cf878fc49476dd3371d308d312326e99dcc780
Instruction Fuzzy Hash: E5412A71A00208AFCF00DFA4CD88AAD7BB6FF48314B24457AF515EB2D1DBB99A41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d6f78358f7ade9e8f3d23659ba78f034e892842c8f99be51438fbb4c03911560
Instruction ID: 34d4ac1ca0ba7345d9811ef03afe410f99a72e11e7e6ea98f315d3ade0c6d005
Opcode Fuzzy Hash: d6f78358f7ade9e8f3d23659ba78f034e892842c8f99be51438fbb4c03911560
Instruction Fuzzy Hash: 32F08C71A012149BDB01EBA4DE49AAEB378FF45324F20457BE105F21E1E7B89A409B29

Uniqueness

Uniqueness Score: -1.00%

Function 00406869 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction ID: c1774f2f946c4964f784778ac851d6f11cf56bcc8977249e4dfbf1b2b48c2d4a
Opcode Fuzzy Hash: 9639f9c0007cb4c124acbb6985d7f6f1a05031d6bc3fffd11e08744ca1378656
Instruction Fuzzy Hash: B2E17A71A0070ADFDB24CF58C880BAAB7F5EF45305F15892EE497A7291D738AA91CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00403C3C Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C78
ShowWindow.USER32(?), ref: 00403C95
DestroyWindow.USER32 ref: 00403CA9
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CC5
GetDlgItem.USER32(?,?), ref: 00403CE6
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFA
IsWindowEnabled.USER32(00000000), ref: 00403D01
GetDlgItem.USER32(?,00000001), ref: 00403DAF
GetDlgItem.USER32(?,00000002), ref: 00403DB9
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD3
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E24
GetDlgItem.USER32(?,00000003), ref: 00403ECA
ShowWindow.USER32(00000000,?), ref: 00403EEB
EnableWindow.USER32(?,?), ref: 00403EFD
EnableWindow.USER32(?,?), ref: 00403F18
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F2E
EnableMenuItem.USER32(00000000), ref: 00403F35
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F4D
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F60
lstrlenW.KERNEL32(0042D248,?,0042D248,00433EE0), ref: 00403F89
SetWindowTextW.USER32(?,0042D248), ref: 00403F9D
ShowWindow.USER32(?,0000000A), ref: 004040D1

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: e1775bd96034a2e9b84b6caeea95e75ccf973f15f4dd1e1e4651a04b425f50ef
Instruction ID: 977002fee4e807fcea2a4689fe207fdbad8331f3a024ab3ce592dbd86d7f0908
Opcode Fuzzy Hash: e1775bd96034a2e9b84b6caeea95e75ccf973f15f4dd1e1e4651a04b425f50ef
Instruction Fuzzy Hash: 2EC1D171504204BFDB216F61EE89E2B3A69FB88706F04053EF641B21F0CB799991DB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403899 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642A: GetModuleHandleA.KERNEL32(?,00000020,?,00403309,00000009), ref: 0040643C
Part of subcall function 0040642A: GetProcAddress.KERNEL32(00000000,?), ref: 00406457

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsxB483.tmp,0042D248), ref: 0040391A
lstrlenW.KERNEL32(00432E80,?,?,?,00432E80,00000000,0043F800,C:\Users\user\AppData\Local\Temp\nsxB483.tmp,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,756F3420), ref: 0040399A
lstrcmpiW.KERNEL32(00432E78,.exe,00432E80,?,?,?,00432E80,00000000,0043F800,C:\Users\user\AppData\Local\Temp\nsxB483.tmp,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000), ref: 004039AD
GetFileAttributesW.KERNEL32(00432E80), ref: 004039B8
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A01

Part of subcall function 00405F97: wsprintfW.USER32 ref: 00405FA4

RegisterClassW.USER32(00433E80), ref: 00403A3E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A56
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A8B
ShowWindow.USER32(00000005,00000000), ref: 00403AC1
GetClassInfoW.USER32(00000000,RichEdit20W,00433E80), ref: 00403AED
GetClassInfoW.USER32(00000000,RichEdit,00433E80), ref: 00403AFA
RegisterClassW.USER32(00433E80), ref: 00403B03
DialogBoxParamW.USER32(?,00000000,00403C3C,00000000), ref: 00403B22

Strings

RichEd20, xrefs: 00403AC7
C:\Users\user\AppData\Local\Temp\nsxB483.tmp, xrefs: 004038B9, 00403915
RichEdit20W, xrefs: 00403AE5, 00403AEB
RichEd32, xrefs: 00403AD5
C:\Users\user\AppData\Local\Temp\, xrefs: 0040389E
RichEdit, xrefs: 00403AF4
.DEFAULT\Control Panel\International, xrefs: 00403905
Control Panel\Desktop\ResourceLocale, xrefs: 004038CD
_Nb, xrefs: 00403A1D, 00403A85
.exe, xrefs: 004039A7

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsxB483.tmp$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2553315635
Opcode ID: 1e5cccfba524a45f2d4d11677c2131e391572546f947df2dae94b256ac055dae
Instruction ID: d3915a60f35156ec108069fee93d058ae2b4a83f87b830a45993cae0616e5fa0
Opcode Fuzzy Hash: 1e5cccfba524a45f2d4d11677c2131e391572546f947df2dae94b256ac055dae
Instruction Fuzzy Hash: EF61AA71640700AFD310AF659D46F2B3A6CEB84B4AF40113FF941B51E2DB7D6941CA2D

Uniqueness

Uniqueness Score: -1.00%

Function 004042B1 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040434F
GetDlgItem.USER32(?,000003E8), ref: 00404363
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404380
GetSysColor.USER32(?), ref: 00404391
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040439F
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043AD
lstrlenW.KERNEL32(?), ref: 004043B2
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043BF
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D4
GetDlgItem.USER32(?,0000040A), ref: 0040442D
SendMessageW.USER32(00000000), ref: 00404434
GetDlgItem.USER32(?,000003E8), ref: 0040445F
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A2
LoadCursorW.USER32(00000000,00007F02), ref: 004044B0
SetCursor.USER32(00000000), ref: 004044B3
ShellExecuteW.SHELL32(0000070B,open,00432E80,00000000,00000000,00000001), ref: 004044C8
LoadCursorW.USER32(00000000,00007F00), ref: 004044D4
SetCursor.USER32(00000000), ref: 004044D7
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404506
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404518

Strings

(B@, xrefs: 004044BD
open, xrefs: 004044C0
N, xrefs: 0040444D

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: (B@$N$open
API String ID: 3615053054-3643564497
Opcode ID: a63e6e2122d515d214c502fe3e454e68733c502862964fa3bbe4886b2a00d4bb
Instruction ID: 98cd9110a96fdc90c980e8b88af1c06473e6a142e5aecddf25117f52f4c400a7
Opcode Fuzzy Hash: a63e6e2122d515d214c502fe3e454e68733c502862964fa3bbe4886b2a00d4bb
Instruction Fuzzy Hash: 217181B1900209BFDB109F60DD89AAA7B79FB84745F00803AF745B62D1C778AD51CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2f348b4d91443a475dcd35d85824ce7e5a946905d26cbae13f88812008241038
Instruction ID: 99fcf956b6c6492db4cb7183bc7c026c58e5ce6762c1973727186ff321cad974
Opcode Fuzzy Hash: 2f348b4d91443a475dcd35d85824ce7e5a946905d26cbae13f88812008241038
Instruction Fuzzy Hash: 81418A71800209AFCF058F95DE459AFBBB9FF44315F04842EF991AA1A0C778EA54DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7F Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(004308E8,NUL), ref: 00405D8E
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00405F12,?,?), ref: 00405DB2
GetShortPathNameW.KERNEL32(?,004308E8,00000400), ref: 00405DBB

Part of subcall function 00405B8A: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E6B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9A
Part of subcall function 00405B8A: lstrlenA.KERNEL32(00000000,?,00000000,00405E6B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BCC

GetShortPathNameW.KERNEL32(004310E8,004310E8,00000400), ref: 00405DD8
wsprintfA.USER32 ref: 00405DF6
GetFileSize.KERNEL32(00000000,00000000,004310E8,C0000000,00000004,004310E8,?,?,?,?,?), ref: 00405E31
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E40
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E78
SetFilePointer.KERNEL32(0040A558,00000000,00000000,00000000,00000000,004304E8,00000000,-0000000A,0040A558,00000000,[Rename],00000000,00000000,00000000), ref: 00405ECE
GlobalFree.KERNEL32(00000000), ref: 00405EDF
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EE6

Part of subcall function 00405C25: GetFileAttributesW.KERNELBASE(00000003,00402E2E,00442800,80000000,00000003,?,?,0043F000,00403536,?), ref: 00405C29
Part of subcall function 00405C25: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,0043F000,00403536,?), ref: 00405C4B

Strings

[Rename], xrefs: 00405E60, 00405E72
NUL, xrefs: 00405D88
%ls=%ls, xrefs: 00405DEC

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: 0a66907fe9b0217bb8d17ec5212d88e84616c82850af9cfedb14c7ec6270a046
Instruction ID: 0ee0d7f4969d0e8ff8498481139b35b4394cb67f0e1a7fb2b2bdcfef73d002b4
Opcode Fuzzy Hash: 0a66907fe9b0217bb8d17ec5212d88e84616c82850af9cfedb14c7ec6270a046
Instruction Fuzzy Hash: 59310230200B147BD2207B619D49F6B3A6CDF45759F14003BBA85F62D2DA7C9E018EEC

Uniqueness

Uniqueness Score: -1.00%

Function 00402DEE Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,0043F000,00403536,?), ref: 00402E1B

Part of subcall function 00405C25: GetFileAttributesW.KERNELBASE(00000003,00402E2E,00442800,80000000,00000003,?,?,0043F000,00403536,?), ref: 00405C29
Part of subcall function 00405C25: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,0043F000,00403536,?), ref: 00405C4B

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,0043F000,00403536,?), ref: 00402E67

Strings

Inst, xrefs: 00402ED3
Null, xrefs: 00402EE5
Error launching installer, xrefs: 00402E3E
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
soft, xrefs: 00402EDC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d, xrefs: 00402E7C, 00402E9D, 00402EB9, 00402F45

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d$soft
API String ID: 4283519449-1435006166
Opcode ID: 05824455060977a7bb7252739558d1f5cb77a7710911f7e6d34bdacea54ead92
Instruction ID: ecf8b1e823d6f98de7c15f593086dd5554d056807b59ad61161c89ef3c81dadd
Opcode Fuzzy Hash: 05824455060977a7bb7252739558d1f5cb77a7710911f7e6d34bdacea54ead92
Instruction Fuzzy Hash: AF51F671900216ABDB109F61DE89B9F7BB8FB54394F21413BF904B62C1C7B89D409B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00406072 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C228,?,004051E6,0042C228,00000000,00000000,?), ref: 00406135
GetSystemDirectoryW.KERNEL32(00432E80,00000400), ref: 004061B3
GetWindowsDirectoryW.KERNEL32(00432E80,00000400), ref: 004061C6
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406202
SHGetPathFromIDListW.SHELL32(?,00432E80), ref: 00406210
CoTaskMemFree.OLE32(?), ref: 0040621B
lstrcatW.KERNEL32(00432E80,\Microsoft\Internet Explorer\Quick Launch), ref: 0040623F
lstrlenW.KERNEL32(00432E80,00000000,0042C228,?,004051E6,0042C228,00000000,00000000,?), ref: 00406299

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406181
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406239

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 0e6e7012782d552d3a91de86c70f0f64d15dea142bf4888c7ca5ccf2af425d1f
Instruction ID: 6a0e75f8176bdfaa808a817e977aa907b1c5d4b6119349843486ba00336cef2a
Opcode Fuzzy Hash: 0e6e7012782d552d3a91de86c70f0f64d15dea142bf4888c7ca5ccf2af425d1f
Instruction Fuzzy Hash: 45611E71A00105ABDF20AF65CC41AEE37A5EF45314F12817FE852BA2D0D73D8AA1CB4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040417B Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404198
GetSysColor.USER32(00000000), ref: 004041B4
SetTextColor.GDI32(?,00000000), ref: 004041C0
SetBkMode.GDI32(?,?), ref: 004041CC
GetSysColor.USER32(?), ref: 004041DF
SetBkColor.GDI32(?,?), ref: 004041EF
DeleteObject.GDI32(?), ref: 00404209
CreateBrushIndirect.GDI32(?), ref: 00404213

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: 1f16dc129e5574868776b4f98a2cc19ea4617ee8107c94e5cfbd03f7ded5ca1d
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 1F2181B1500704ABCB219F68DE08B5BBBF8AF41714B04896DF992F66A0D734E944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00403027 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

@, xrefs: 004030AB
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$@
API String ID: 551687249-3859443358
Opcode ID: b9c73abe30954886df544254ff6dcb1187f966f7efd401cac9ed90b15a2befc5
Instruction ID: a151fef9e86e41fc3429002d146a23742bf049d8b35666da4da471479faf367b
Opcode Fuzzy Hash: b9c73abe30954886df544254ff6dcb1187f966f7efd401cac9ed90b15a2befc5
Instruction Fuzzy Hash: F9517C71901219EBDB10CF65DA44BAE3BA8AF05766F10417BF815B72C0C7789A41CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D06: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D1C

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c65befc1453d79e0c2e8f89943b80396fddc1db08f78317adda9697148674731
Instruction ID: c1a49ad6acc88ab736a24109aaa050e218125fd0ad183605519c9d8fb0938606
Opcode Fuzzy Hash: c65befc1453d79e0c2e8f89943b80396fddc1db08f78317adda9697148674731
Instruction Fuzzy Hash: EC510874D00219AADF209F94CA88AAEB779FF04344F50447BE501F72D0D7B99982DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004051AF Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051E7
lstrlenW.KERNEL32(0040318B,0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051F7
lstrcatW.KERNEL32(0042C228,0040318B), ref: 0040520A
SetWindowTextW.USER32(0042C228,0042C228), ref: 0040521C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405242
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040525C
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526A

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 661b82109fdd2a37eb13e55163fdf06ea5e70fc68841ee5fa768d2a587fa1c0b
Instruction ID: 3abc69651b1b947d68a29ef5f67bb3ab151c750651a003a3f474b57aa403b91e
Opcode Fuzzy Hash: 661b82109fdd2a37eb13e55163fdf06ea5e70fc68841ee5fa768d2a587fa1c0b
Instruction Fuzzy Hash: E6216D71900518BACB119FA5DD85ECFBFB8EF45354F14807AF944B62A0C7798A50CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004062E4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 00406347
CharNextW.USER32(?,?,?,00000000), ref: 00406356
CharNextW.USER32(?,00000000,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 0040635B
CharPrevW.USER32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 0040636E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004062E5
*?|<>/":, xrefs: 00406336

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-681532160
Opcode ID: 7b766ee50bb8b1a0f4eab2cbe77ea87c6d078045d263edb3b82a780548374b37
Instruction ID: 318300b0f17d4b51c4b24ffcfd5e9ca079934b39012f6efb3a6e40df4f12a45c
Opcode Fuzzy Hash: 7b766ee50bb8b1a0f4eab2cbe77ea87c6d078045d263edb3b82a780548374b37
Instruction Fuzzy Hash: EF11B22680071695DB303B149C40AB7A2B8EF58790B56903FED8AB32C1F77C5C9286FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404A79 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A94
GetMessagePos.USER32 ref: 00404A9C
ScreenToClient.USER32(?,?), ref: 00404AB6
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AC8
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AEE

Strings

f, xrefs: 00404ACA

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: f7db0f90848f06194adfa2b80852422f0d01f782293f8b66888e1da33f3275eb
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: 28015271E4021CBADB00DB94DD85FFEBBBCAF59711F10012BBA51B61C0C7B495018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,00000064,00051A00), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 9823b761f001492aa494ef634f2695fad7e965f30442b605b2107c3f38143bb8
Instruction ID: e3b7989a6944ee3f74a5da6e22ee0ffb045f4e525cc1af55651639455de3416a
Opcode Fuzzy Hash: 9823b761f001492aa494ef634f2695fad7e965f30442b605b2107c3f38143bb8
Instruction Fuzzy Hash: F9014F7064020DBBEF249F61DE49FEA3B69FB04304F008439FA02A91E0DBB889559B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d38b97de9adbc21ced8ed8a744625ac0d1ee3a783b6f23ffb60f529b6eaed753
Instruction ID: 1aef917cd227803a683e0008524bb9a83fcfbb8b8ade77014dfab24c7f5e3f69
Opcode Fuzzy Hash: d38b97de9adbc21ced8ed8a744625ac0d1ee3a783b6f23ffb60f529b6eaed753
Instruction Fuzzy Hash: F121C172800128BBCF216FA5CE49D9E7E79EF09324F20023AF510762E1C7795D418FA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040567E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004056C1
GetLastError.KERNEL32 ref: 004056D5
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EA
GetLastError.KERNEL32 ref: 004056F4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A4

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-1881609536
Opcode ID: 00ef7c6a0f32c1044080c086edeac3c819c61aa9b54d8d974478d91d60ac005e
Instruction ID: dfae01ed47dc7750d2476d71b6e364c3d252909874df994a371284b211a748b1
Opcode Fuzzy Hash: 00ef7c6a0f32c1044080c086edeac3c819c61aa9b54d8d974478d91d60ac005e
Instruction Fuzzy Hash: 18011A71D10619DADF009FA0CA447EFBFB8EF14304F00443AD549B6190E7799608CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5D0,0040A5D0,00000000,00000000,0040A5D0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406050: lstrcpynW.KERNEL32(?,?,00000400,0040334D,00433EE0,NSIS Error), ref: 0040605D

Part of subcall function 004051AF: lstrlenW.KERNEL32(0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051E7
Part of subcall function 004051AF: lstrlenW.KERNEL32(0040318B,0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051F7
Part of subcall function 004051AF: lstrcatW.KERNEL32(0042C228,0040318B), ref: 0040520A
Part of subcall function 004051AF: SetWindowTextW.USER32(0042C228,0042C228), ref: 0040521C
Part of subcall function 004051AF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405242
Part of subcall function 004051AF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040525C
Part of subcall function 004051AF: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526A

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 6775144717fc476b5dbb97c3b6100e3a591b898303e6615bd834b0ce0a67ae3b
Instruction ID: fa226e2697354f8a36450ecb7523776f7f82d9f29d3b914395726c71c929f9d2
Opcode Fuzzy Hash: 6775144717fc476b5dbb97c3b6100e3a591b898303e6615bd834b0ce0a67ae3b
Instruction Fuzzy Hash: 37418471900514BADF11BBB5CC46EAF7679EF45328F20823BF522B10E1DB3C8A519A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 1537f09e12a9e60e0b2a8eae30c6507c5457e656f0290ab1b216bb77a8747b60
Instruction ID: a55e164afb4a2c5db24f06852be026e23ac61ce6859740a963365f2f7f7eec81
Opcode Fuzzy Hash: 1537f09e12a9e60e0b2a8eae30c6507c5457e656f0290ab1b216bb77a8747b60
Instruction Fuzzy Hash: 2F116771904119FFEF11AF90DF8CEAE3B79FB54388B10003AF905E10A0D7B49E55AA28

Uniqueness

Uniqueness Score: -1.00%

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 31fd25822ce6b79118aa2e1ca3bb08fcdcc3158db0601b843d79d25736b73e43
Instruction ID: d5b0b812c52730b156692ce296a05b57ce8d9064807eae1c9fc7a35bbe74f0db
Opcode Fuzzy Hash: 31fd25822ce6b79118aa2e1ca3bb08fcdcc3158db0601b843d79d25736b73e43
Instruction Fuzzy Hash: C7F0E172501504AFD701DBE4DE88CEEBBBDEB48311B10447AF541F51A1CA749D018B28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401DD1

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e2cc8dd5de9789456435784dbdd19b949a1a7a801120b19954393673f8e1d613
Instruction ID: 1901d7d296450183f5894fa9bbb5198f988e596920eebf68b9e2cfe033e75292
Opcode Fuzzy Hash: e2cc8dd5de9789456435784dbdd19b949a1a7a801120b19954393673f8e1d613
Instruction Fuzzy Hash: 0A016271984640FFEB01ABB4AF8AB9A3F75AF65301F104579E541F61E2D97800059B2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040496B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A0C
wsprintfW.USER32 ref: 00404A15
SetDlgItemTextW.USER32(?,0042D248), ref: 00404A28

Strings

%u.%u%s%s, xrefs: 004049F6

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 11697fbeee2ec27caa838f9577c25575cb5a28f5da9000204df2581051c2f439
Instruction ID: 0b736bf888c47b86caf201b097c22cff5488322ea99b5df57e3066faec5b3164
Opcode Fuzzy Hash: 11697fbeee2ec27caa838f9577c25575cb5a28f5da9000204df2581051c2f439
Instruction Fuzzy Hash: 9011E773A041283BDB10957D9C41EAF329CAB85334F254237FA25F31D1D978CD2182E9

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: d1ce46bd28cc36f50990ff65351f506775fb0047ee6065fba40e47d3ae025a49
Instruction ID: 7183083e97b306686418f33f328e020de39305092e82b8c4ae23370839422ec4
Opcode Fuzzy Hash: d1ce46bd28cc36f50990ff65351f506775fb0047ee6065fba40e47d3ae025a49
Instruction Fuzzy Hash: 48219071940209BEEF01AFB5CE4AABE7B75EB44744F10403EF601B61D1D6B89A40DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401FC3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004051AF: lstrlenW.KERNEL32(0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051E7
Part of subcall function 004051AF: lstrlenW.KERNEL32(0040318B,0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051F7
Part of subcall function 004051AF: lstrcatW.KERNEL32(0042C228,0040318B), ref: 0040520A
Part of subcall function 004051AF: SetWindowTextW.USER32(0042C228,0042C228), ref: 0040521C
Part of subcall function 004051AF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405242
Part of subcall function 004051AF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040525C
Part of subcall function 004051AF: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526A

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Strings

`OC, xrefs: 0040203C

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: `OC
API String ID: 334405425-799166930
Opcode ID: 5181d75713787ffd6a629225a60919502673a9056936f114145810241d72ddad
Instruction ID: b14b73648b0fa08bf6b9a57eaf8eef0284e6afbfa2af330353af538dc438c051
Opcode Fuzzy Hash: 5181d75713787ffd6a629225a60919502673a9056936f114145810241d72ddad
Instruction Fuzzy Hash: E0218431900219EBDF20AFA5CE49A9E7E71AF04358F20427FF511B51E1CBBD8A81DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405B0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406050: lstrcpynW.KERNEL32(?,?,00000400,0040334D,00433EE0,NSIS Error), ref: 0040605D

Part of subcall function 00405AAF: CharNextW.USER32(?,?,0042FA50,?,00405B23,0042FA50,0042FA50, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405861,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405ABD
Part of subcall function 00405AAF: CharNextW.USER32(00000000), ref: 00405AC2
Part of subcall function 00405AAF: CharNextW.USER32(00000000), ref: 00405ADA

lstrlenW.KERNEL32(0042FA50,00000000,0042FA50,0042FA50, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405861,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B65
GetFileAttributesW.KERNEL32(0042FA50,0042FA50,0042FA50,0042FA50,0042FA50,0042FA50,00000000,0042FA50,0042FA50, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405861,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 00405B75

Strings

4ou, xrefs: 00405B0E
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B0C

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4ou$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-2259175124
Opcode ID: 1860d25d1cedceeae653fbc66b59fe140c8df0ce2729e3c8c9131a1b177ba99c
Instruction ID: 63a6569c831ee5581447f3e1e8ec18e6ac74a78ddfb021a14ce772f4501d9fee
Opcode Fuzzy Hash: 1860d25d1cedceeae653fbc66b59fe140c8df0ce2729e3c8c9131a1b177ba99c
Instruction Fuzzy Hash: 32F0F435100E1119D62632361C49BAF2664CF82324B4A023FF952B22D1DB3CB993CC7E

Uniqueness

Uniqueness Score: -1.00%

Function 00405A04 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 00405A0A
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034C8), ref: 00405A14
lstrcatW.KERNEL32(?,0040A014), ref: 00405A26

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A04

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-1881609536
Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction ID: e6cb25dffc9e5a2bb3a1dbad45cd46e4450efeecdd43702cab0598af126a0af2
Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction Fuzzy Hash: 06D05E31211534AAC211AB589D05CDB629C9E46304341442AF241B20A1C779595186FE

Uniqueness

Uniqueness Score: -1.00%

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5D0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5D0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5D0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: bfedc165a8574070aa25792ea214acd43fbdea90d1c39bf4e8f4e2e036591c34
Instruction ID: 52a733b9c8e4ab95676b633cdda8f3d85a752b7ae8d5fcc25206d9d14f9091af
Opcode Fuzzy Hash: bfedc165a8574070aa25792ea214acd43fbdea90d1c39bf4e8f4e2e036591c34
Instruction Fuzzy Hash: A4118E71A00108BFEB11AFA5DE89DAE777DEB44358F11403AF904B61D1DBB85E409668

Uniqueness

Uniqueness Score: -1.00%

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051AF: lstrlenW.KERNEL32(0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051E7
Part of subcall function 004051AF: lstrlenW.KERNEL32(0040318B,0042C228,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051F7
Part of subcall function 004051AF: lstrcatW.KERNEL32(0042C228,0040318B), ref: 0040520A
Part of subcall function 004051AF: SetWindowTextW.USER32(0042C228,0042C228), ref: 0040521C
Part of subcall function 004051AF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405242
Part of subcall function 004051AF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040525C
Part of subcall function 004051AF: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526A

Part of subcall function 00405730: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 00405759
Part of subcall function 00405730: CloseHandle.KERNEL32(?), ref: 00405766

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: e8bd30eb30573bb393d6b9c1201975896ec1614d82597cab9a1ef0ab8b9eb6fa
Instruction ID: 5d6a9cd2629b2ba724fb53646afbed83d489e6abcf8a7a9a4f308d22f643bc11
Opcode Fuzzy Hash: e8bd30eb30573bb393d6b9c1201975896ec1614d82597cab9a1ef0ab8b9eb6fa
Instruction Fuzzy Hash: 2011AD31900508EBDF21AFA1CD849DE7AB6EF40354F21403BF605B61E1C7798A82DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,0043F000,00403536,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,0043F000,00403536,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: df109012b7806b8de8df2929ec67b86acfc6093236d2d9f47b9f955c0080d778
Instruction ID: 9565580f91e6c8b036764476f8379a8a9497e0cf8b36b33943f0ae23fa557cda
Opcode Fuzzy Hash: df109012b7806b8de8df2929ec67b86acfc6093236d2d9f47b9f955c0080d778
Instruction Fuzzy Hash: FFF05E30501520BBC671AB20FF4DA9B7B64FB40B11701447AF042B15E4C7B80D828B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00405123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405152
CallWindowProcW.USER32(?,?,?,?), ref: 004051A3

Part of subcall function 00404160: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404172

Strings

, xrefs: 00405133

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 340d3c0ef1b6191d39bf660b6c525c67a0e16f797af015efc8e2bb8f4ca6604a
Instruction ID: 3a757cf3c9e7612e230a46be1b13aa2d047f9f757cddf2eb8b5381add8f22129
Opcode Fuzzy Hash: 340d3c0ef1b6191d39bf660b6c525c67a0e16f797af015efc8e2bb8f4ca6604a
Instruction Fuzzy Hash: 43017C71A00609ABEB218F51ED84B9B3B2AEB84750F504037F6047D1E0C77A8C929E2A

Uniqueness

Uniqueness Score: -1.00%

Function 00405730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 00405759
CloseHandle.KERNEL32(?), ref: 00405766

Strings

Error launching installer, xrefs: 00405743

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 4fc88ca41c3c45648a755c19479fc4b71f2ef519cf2e9afda518322c17047a2d
Instruction ID: 828b4cc1025806f2bb1dde6e09e5b56a6c7607ab0cffe69e3a18accb3258c2b6
Opcode Fuzzy Hash: 4fc88ca41c3c45648a755c19479fc4b71f2ef519cf2e9afda518322c17047a2d
Instruction Fuzzy Hash: 9CE092B4600209BFEB10AB64AE49F7BBBACEB04704F004565BA51F2190D774E8148A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00403804 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,756F3420,00000000,C:\Users\user\AppData\Local\Temp\,004037DC,004035F2,?), ref: 0040381E
GlobalFree.KERNEL32(?), ref: 00403825

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403804

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-1881609536
Opcode ID: da2816148213eaf2ca9be615ca64e0b95c5ba1132a9b108e3e9160e8cd70995f
Instruction ID: c0ef5988400ca03a2919d730679f4c8cdc7c60ab336a91eb80d60266565c467d
Opcode Fuzzy Hash: da2816148213eaf2ca9be615ca64e0b95c5ba1132a9b108e3e9160e8cd70995f
Instruction Fuzzy Hash: D2E0C2735015309BC6212F45ED0871EB7ACAF59B22F0580BAF8907B26087781C428FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405B8A Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E6B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9A
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB2
CharNextA.USER32(00000000,?,00000000,00405E6B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC3
lstrlenA.KERNEL32(00000000,?,00000000,00405E6B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BCC

Memory Dump Source

Source File: 00000000.00000002.1282549877.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1282535891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282563211.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1282653189.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_MbYnGuRGnm.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: e0aa3f8b5d9062cafbb7b658161da2b40476d8243bb4b83799a9e8f5804b25e7
Instruction ID: 8848f7d8d782bbf7f3224fb8fd0babd0dea9e1ab2e05ea72f699364142252924
Opcode Fuzzy Hash: e0aa3f8b5d9062cafbb7b658161da2b40476d8243bb4b83799a9e8f5804b25e7
Instruction Fuzzy Hash: 72F0C231100914EFCB029FA5CD4099FBFB8EF06350B2540A9E840F7311D674FE019BA8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MbYnGuRGnm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: MbYnGuRGnm.exePID: 7532, Parent PID: 2592

General

Chronological Activities

Disassembly

Analysis Process: MbYnGuRGnm.exePID: 7532, Parent PID: 2592COMMON

Execution Graph

Graph

Executed Functions

Function 004032A0 Relevance: 79.2, APIs: 33, Strings: 12, Instructions: 401stringfilecomCOMMON

Windows Analysis Report
MbYnGuRGnm.exe

Function 004032A0 Relevance: 79.2, APIs: 33, Strings: 12, Instructions: 401
stringfilecomCOMMON

Function 004063BA Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405C54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 0040642A Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 00405C25 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 00405CA8 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 00405795 Relevance: 1.5, APIs: 1, Instructions: 21
windowCOMMON

Function 004037BF Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Function 004052EE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00404B2B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00403C3C Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00403899 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 215
stringregistryCOMMON