Edit tour

Windows Analysis Report
INSIGNON.EXE

Overview

General Information

Sample name:	INSIGNON.EXE
Analysis ID:	1417006
MD5:	4eb9ce3332c6d41fc80ed09cfc939c38
SHA1:	3f129474c227f5b21595a11934401759065b29db
SHA256:	9fdc124fcf1a99c7af2bf8b8f799aaa310906c8940805b6149158355c5127459
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

INSIGNON.EXE (PID: 1164 cmdline: "C:\Users\user\Desktop\INSIGNON.EXE" MD5: 4EB9CE3332C6D41FC80ED09CFC939C38)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: INSIGNON.EXE

Virustotal: Detection: 13%

Perma Link

Source: INSIGNON.EXE

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 4x nop then push ebp	0_2_00537C30
Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 4x nop then push ebp	0_2_00522670
Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 4x nop then push ebp	0_2_00547B90

Source: INSIGNON.EXE	String found in binary or memory: http://Icons.Tritech.com/customericons
Source: INSIGNON.EXE	String found in binary or memory: http://maps.google.com/mapfiles/kml
Source: INSIGNON.EXE	String found in binary or memory: http://maps.google.com/mapfiles/ms/micons

Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 0_3_02AE0000	0_3_02AE0000
Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 0_3_02AE005C	0_3_02AE005C
Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 0_2_00545930	0_2_00545930

Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Section loaded: wbtrv32.dll	Jump to behavior

Source: INSIGNON.EXE

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: sus36.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\INSIGNON.EXE

File created: C:\Users\user\Desktop\ImcSys.log

Jump to behavior

Source: C:\Users\user\Desktop\INSIGNON.EXE

Mutant created: NULL

Source: INSIGNON.EXE

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\INSIGNON.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: INSIGNON.EXE

Virustotal: Detection: 13%

Source: INSIGNON.EXE	String found in binary or memory: rly re-started.
Source: INSIGNON.EXE	String found in binary or memory: ted or Pervasive Server ('Microkernel') may need to be shut down and re-started.
Source: INSIGNON.EXE	String found in binary or memory: If all other workstations get this same error, check the server. Pervasive on the server or the server itself may need to be properly re-started.
Source: INSIGNON.EXE	String found in binary or memory: If rebooting every single workstation including pollers doesn't clear this error, the server may need to be properly downed re-started or Pervasive Server ('Microkernel') may need to be shut down and re-started.

Source: C:\Users\user\Desktop\INSIGNON.EXE	Automated click: OK
Source: C:\Users\user\Desktop\INSIGNON.EXE	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: INSIGNON.EXE

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: INSIGNON.EXE

Static file information: File size 1429504 > 1048576

Source: INSIGNON.EXE

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x150000

Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 0_2_00403058 push ebx; ret		0_2_00403069
Source: C:\Users\user\Desktop\INSIGNON.EXE	Code function: 0_2_00401739 push cs; ret		0_2_00401871

Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INSIGNON.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\INSIGNON.EXE

API coverage: 7.1 %

Source: C:\Users\user\Desktop\INSIGNON.EXE

Code function: 0_2_00524430 __vbaChkstk,__vbaStrMove,__vbaOnError,__vbaGenerateBoundsError,__vbaStrCat,__vbaStrMove,__vbaStrCat,__vbaStrMove,__vbaFreeStr,__vbaStrCat,__vbaStrMove,#576,__vbaFreeStr,__vbaStrCat,__vbaStrMove,__vbaStrMove,__vbaStrCat,__vbaStrMove,__vbaFreeStr,__vbaStrMove,__vbaStrCat,__vbaStrMove,__vbaFreeStr,#576,LdrInitializeThunk,__vbaStrMove,__vbaStrCat,__vbaStrMove,__vbaFreeStr,__vbaGenerateBoundsError,__vbaStrCat,__vbaStrMove,#576,__vbaFreeStr,__vbaFreeStr,__vbaFreeStr,__vbaErrorOverflow,__vbaChkstk,__vbaStrMove,__vbaOnError,__vbaGenerateBoundsError,__vbaStrCat,__vbaStrMove,__vbaFreeStr,__vbaGenerateBoundsError,__vbaStrCat,__vbaStrMove,#578,__vbaFreeStr,__vbaStrCat,__vbaStrMove,__vbaFreeStr,#648,__vbaFreeVar,__vbaStrCat,__vbaStrMove,__vbaFileOpen,__vbaFreeStr,__vbaStrMove,__vbaStrMove,__vbaPrintFile,__vbaFreeStrList,__vbaFileClose,

0_2_00524430

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
INSIGNON.EXE	12%	ReversingLabs
INSIGNON.EXE	14%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://Icons.Tritech.com/customericons	0%	Avira URL Cloud	safe
http://Icons.Tritech.com/customericons	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://Icons.Tritech.com/customericons	INSIGNON.EXE	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://maps.google.com/mapfiles/kml	INSIGNON.EXE	false		high
http://maps.google.com/mapfiles/ms/micons	INSIGNON.EXE	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417006
Start date and time:	2024-03-28 13:40:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	INSIGNON.EXE
Detection:	SUS
Classification:	sus36.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 19 Number of non-executed functions: 150
Cookbook Comments:	Found application associated with file extension: .EXE Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://colourlyrics.com/fe/KtHc5ruvtRkZFoArrtthaJsvCmg3Rb7X4JToP666Ry87hz3e3rFuRJGAPKBcoBZjAZJZK4pouqXoieozb8x97ijrpxmdxNfsxaBCR2nGFdZnrhtCVLagarbeJ5bjm2rcgeCmZPnkCo2NqoSFB3o6MQ	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://ablecolony.com/aa/48/4e/aa484ee4f0938d31820b2b60d41aea96.js	Get hash	malicious	Unknown	Browse	192.229.211.108
	SecuriteInfo.com.Win32.Evo-gen.18602.10500.dll	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://cloudflare-ipfs.com/ipfs/bafybeific5oh7p6dvnpe2yvzaxfuvvaf5c6xpacgz774hqgtk4xznu2v5m/#r.cortes@system-asefin.com	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Get hash	malicious	Clipboard Hijacker, XWorm, Xmrig	Browse	192.229.211.108
	http://statisticsong.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	8tUCycu3Wq.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	192.229.211.108
	https://usersync.tiqcdn.net/ping/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://login.service-mediobanca.com/?rid=5spGrj3	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://new-26766nbnberor44567789097jhjghgfvchg.s3.us-east-2.amazonaws.com/Win/index.html?tk=6mwXE1vq8p4KlPfsD2IC9FoU7MuHtzcB	Get hash	malicious	TechSupportScam	Browse	192.229.211.108

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\Desktop\ImcSys.log

Download File

Process:	C:\Users\user\Desktop\INSIGNON.EXE
File Type:	ASCII text, with very long lines (728), with CRLF line terminators
Category:	dropped
Size (bytes):	1866
Entropy (8bit):	2.375314708306924
Encrypted:	false
SSDEEP:	24:FNnAJz9ONoiRHQ8QGQ+8QGQXzP7PQ9J6d:bnAZ9nihl0f0bsO
MD5:	CA482B77DA23875B19695F5C890DD495
SHA1:	E4F5A411E9D1FF035C7263D3A24445247B333C6A
SHA-256:	873ED861F33554824DD0EEB9FBEAA74BBC926A49B5C51529F0F9CA411A250641
SHA-512:	C56DBF7D942294E448345F02F4DF98E45F6BD0332F3D6009DD09E33120902CCD45493E4981ADFFFFC92ED2DE8717391999ECE8D5743957263D412460824B91AF
Malicious:	false
Reputation:	low
Preview:	TYP SYS DATE TIME CODE-SOURCE DATABASE OP ERR-CODE ERR-DESC EXE VER COMP-NAME OFFICER AGENCY ERR-SOURCE M-ACTIVE-FORM M-ACTIVE-CTRL MIX S-ACTIVE-FORM S-ACTIVE-CTRL SIX SPECIAL-MSG..RUN 03/28/24 1341 ZipSupport.ZipInitialize 91 Object variable or With block variable not set INSIGNON 6.13.4 878411 InSignon

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.776543952745954
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	INSIGNON.EXE
File size:	1'429'504 bytes
MD5:	4eb9ce3332c6d41fc80ed09cfc939c38
SHA1:	3f129474c227f5b21595a11934401759065b29db
SHA256:	9fdc124fcf1a99c7af2bf8b8f799aaa310906c8940805b6149158355c5127459
SHA512:	c7f3680f2d71dfde171e636929c83937969302027dd021d452dc55aa1357d01cc3539b53a2ba2714bffdfe44c0455229937dd51d29866e30c4f8ec9b98d511d7
SSDEEP:	12288:L7/zHL6IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIuWC:H/0/5fRdz4uLhz
TLSH:	1F65A5F1B384F48AD8E316B59839D6741476BCABE062B50E354F7A149473B8314BAB0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a...%.u.%.u.%.u...{.$.u.j.\|.1.u...x.$.u.Rich%.u.........................PE..L......e.....................P.......M............@

File Icon


Icon Hash:	3c76566c76030105

Static PE Info

General

Entrypoint:	0x404db8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x65D39318 [Mon Feb 19 17:42:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4ee9c2664b06dc70f91898b482cdffce

Entrypoint Preview

Instruction
push 00404FD4h
call 00007F061CC999C5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+6B956A5Ch], cl
mov edi, E89B4F35h
int A6h
fldenv [ecx]
dec esp
rol byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+6Eh], cl
push ebx
imul esp, dword ptr [edi+6Eh], 00006E6Fh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add al, 00h
movsb
add byte ptr [eax+00h], 00000000h
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14fde4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15b000	0xa768	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x3f4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14fdd4	0x150000	a5a67c8d250523ce688bd3e5e03aa7cb	False	0.16601998465401785	data	5.7664700977071695	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x151000	0x9094	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x15b000	0xa768	0xb000	1d926619c7386c980633527525f16321	False	0.5943492542613636	data	5.693237055225028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x165480	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0			0.4018817204301075
RT_ICON	0x165358	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0			0.5101351351351351
RT_ICON	0x1644b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.503731343283582
RT_ICON	0x163c08	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.6105595667870036
RT_ICON	0x1636a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.6228323699421965
RT_ICON	0x15efd0	0x46d0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9975176522506619
RT_ICON	0x15ca28	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.2411825726141079
RT_ICON	0x15b980	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.2847091932457786
RT_ICON	0x15b518	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.3599290780141844
RT_GROUP_ICON	0x15b494	0x84	data			0.75
RT_VERSION	0x15b270	0x224	data	English	United States	0.5072992700729927

Imports

DLL

Import

MSVBVM60.DLL

EVENT_SINK_GetIDsOfNames, __vbaVarSub, __vbaStrI2, _CIcos, _adj_fptan, __vbaVarMove, __vbaStrI4, __vbaVarVargNofree, __vbaAryMove, __vbaFreeVar, __vbaLateIdCall, __vbaLineInputStr, __vbaStrVarMove, __vbaLenBstr, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, EVENT_SINK_Invoke, __vbaVarIndexStore, __vbaRaiseEvent, __vbaNextEachVar, __vbaFreeObjList, __vbaGetFxStr4, __vbaStrErrVarCopy, __vbaVarFix, _adj_fprem1, __vbaRecAnsiToUni, __vbaResume, __vbaCopyBytes, __vbaForEachCollAd, __vbaVarCmpNe, __vbaFileLock, __vbaStrCat, __vbaLsetFixstr, __vbaStrDate, __vbaSetSystemError, __vbaRecDestruct, __vbaHresultCheckObj, __vbaLenVar, _adj_fdiv_m32, __vbaAryVar, Zombie_GetTypeInfo, __vbaAryDestruct, __vbaVarIndexLoadRefLock, __vbaLateMemSt, __vbaForEachCollObj, __vbaBoolStr, __vbaExitProc, __vbaFileCloseAll, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarIndexLoad, __vbaFpR4, __vbaCyStr, __vbaBoolVar, __vbaStrFixstr, __vbaRefVarAry, __vbaVargVar, __vbaVarTstLt, __vbaFpR8, __vbaBoolVarNull, _CIsin, __vbaErase, __vbaVargVarMove, __vbaNextEachCollObj, __vbaVarZero, __vbaVarCmpGt, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaVarAbs, __vbaGenerateBoundsError, __vbaCyI2, __vbaStrCmp, __vbaAryConstruct2, __vbaVarTstEq, __vbaObjVar, __vbaI2I4, DllFunctionCall, __vbaVarOr, __vbaVarLateMemSt, __vbaFpUI1, __vbaCastObjVar, __vbaLbound, _adj_fpatan, __vbaFixstrConstruct, __vbaLateIdCallLd, Zombie_GetTypeInfoCount, __vbaStrR8, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, __vbaLateIdCallSt, __vbaObjIs, __vbaVarAnd, EVENT_SINK_QueryInterface, __vbaStr2Vec, __vbaUI1I4, __vbaStrUI1, __vbaVarMul, __vbaExceptHandler, __vbaInputFile, __vbaPrintFile, __vbaStrToUnicode, __vbaDateStr, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaR8ErrVar, __vbaVarDiv, __vbaFPException, __vbaStrCompVar, __vbaInStrVar, __vbaUbound, __vbaStrVarVal, __vbaVarCat, __vbaGetOwner4, __vbaCheckType, __vbaDateVar, __vbaI2Var, __vbaExitEachVar, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaVarSetObj, __vbaStrCopy, __vbaVarCmpLt, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, __vbaR8Var, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarCmpEq, __vbaVarAdd, __vbaLateMemCall, __vbaAryLock, __vbaStrToAnsi, __vbaVarDup, __vbaFpI2, __vbaCheckTypeVar, __vbaUnkVar, __vbaVarCopy, __vbaVarLateMemCallLd, __vbaFpI4, __vbaR8IntI2, __vbaVarSetObjAddref, __vbaLateMemCallLd, __vbaRecDestructAnsi, _CIatan, __vbaI2ErrVar, __vbaCastObj, __vbaAryCopy, __vbaStrMove, __vbaForEachVar, __vbaStrVarCopy, _allmul, __vbaLateIdSt, __vbaLateMemCallSt, _CItan, __vbaNextEachCollAd, __vbaAryUnlock, _CIexp, __vbaMidStmtBstr, __vbaFreeObj, __vbaFreeStr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 13:41:42.553437948 CET	1.1.1.1	192.168.2.5	0x2c21	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:41:42.553437948 CET	1.1.1.1	192.168.2.5	0x2c21	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:41:21
Start date:	28/03/2024
Path:	C:\Users\user\Desktop\INSIGNON.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\INSIGNON.EXE"
Imagebase:	0x400000
File size:	1'429'504 bytes
MD5 hash:	4EB9CE3332C6D41FC80ED09CFC939C38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0.1%
Signature Coverage:	14.1%
Total number of Nodes:	1524
Total number of Limit Nodes:	176

Executed Functions

Function 00524430 Relevance: 115.9, APIs: 60, Strings: 6, Instructions: 369
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000033,004047D6), ref: 0052444E
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000000,00000000,00000033,004047D6), ref: 0052447E
__vbaGenerateBoundsError.MSVBVM60 ref: 005244A1
__vbaStrCat.MSVBVM60(ImcSys.log), ref: 005244BC
__vbaStrMove.MSVBVM60 ref: 005244C7
__vbaStrCat.MSVBVM60(.INT.FIRST,?), ref: 005244DD
__vbaStrMove.MSVBVM60 ref: 005244E8
__vbaFreeStr.MSVBVM60(?), ref: 00524506
__vbaStrCat.MSVBVM60(.INT.FIRST,?), ref: 00524524
__vbaStrMove.MSVBVM60 ref: 0052452F
#576.MSVBVM60(?,00000000), ref: 0052453A
__vbaFreeStr.MSVBVM60 ref: 00524543
__vbaStrCat.MSVBVM60(.INT,?), ref: 00524559
__vbaStrMove.MSVBVM60 ref: 00524564
__vbaStrMove.MSVBVM60(00000009,?), ref: 005245BC
__vbaStrCat.MSVBVM60(00000000), ref: 005245C3
__vbaStrMove.MSVBVM60 ref: 005245CE
__vbaFreeStr.MSVBVM60 ref: 005245D7
__vbaStrMove.MSVBVM60(00000008,?), ref: 005245FF
__vbaStrCat.MSVBVM60(00000000), ref: 00524606
__vbaStrMove.MSVBVM60 ref: 00524611
__vbaFreeStr.MSVBVM60 ref: 0052461A
#576.MSVBVM60(?,?), ref: 0052462F

Part of subcall function 00522410: __vbaVarDup.MSVBVM60(6D02D8B1,00000000,00000000), ref: 00522469
Part of subcall function 00522410: #660.MSVBVM60(?,?,?,?,?), ref: 0052248C
Part of subcall function 00522410: __vbaVarCat.MSVBVM60(?,?,?), ref: 0052249E
Part of subcall function 00522410: __vbaStrVarMove.MSVBVM60(00000000), ref: 005224A5
Part of subcall function 00522410: __vbaStrMove.MSVBVM60 ref: 005224B0
Part of subcall function 00522410: __vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 005224C4

__vbaStrMove.MSVBVM60(?,?), ref: 00524658
__vbaStrCat.MSVBVM60(00000000), ref: 0052465F
__vbaStrMove.MSVBVM60 ref: 0052466A
__vbaFreeStr.MSVBVM60 ref: 00524673
__vbaGenerateBoundsError.MSVBVM60 ref: 00524696
__vbaStrCat.MSVBVM60(ImcSys.log), ref: 005246B1
__vbaStrMove.MSVBVM60 ref: 005246BC
#576.MSVBVM60(?,?), ref: 005246D1
__vbaFreeStr.MSVBVM60(00524710), ref: 005246F7
__vbaFreeStr.MSVBVM60 ref: 00524700
__vbaFreeStr.MSVBVM60 ref: 00524709
__vbaErrorOverflow.MSVBVM60(?), ref: 00524721
__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,0051FF91,?,?), ref: 0052474E
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000000,00000000,00000000,004047D6), ref: 0052477E
__vbaStrCat.MSVBVM60(ImcSys.log,00000000), ref: 005247D2
__vbaStrMove.MSVBVM60 ref: 005247DD
__vbaFreeStr.MSVBVM60(?), ref: 005247F3
__vbaStrCat.MSVBVM60(ImcSys.log), ref: 0052483D
__vbaStrMove.MSVBVM60 ref: 00524848
#578.MSVBVM60(00000000), ref: 0052484F
__vbaFreeStr.MSVBVM60 ref: 0052485B
__vbaStrCat.MSVBVM60(ImcSys.log,00000000), ref: 00524A33

Strings

3, xrefs: 00524AB0
.INT, xrefs: 00524554
3, xrefs: 00524813
ImcSys.log, xrefs: 00523539, 0052394C, 00524297, 005244B7, 005246AC, 005247CD, 00524838, 00524A2E, 00524ADB
.INT.FIRST, xrefs: 005244D8, 0052451F
3, xrefs: 00524687

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Error$#576$BoundsChkstkGenerate$#578#660ListOverflow
String ID: .INT$.INT.FIRST$3$3$3$ImcSys.log
API String ID: 733187479-2330285427
Opcode ID: 8163d3b823dab04d85d59df17748dc7c379de68f1771b134e6391a49f5e3cc74
Instruction ID: e695c00ab3b040fc7d5789b35d2b03dae63b1e2d7b8a2f9a571ef3f2e1a203e6
Opcode Fuzzy Hash: 8163d3b823dab04d85d59df17748dc7c379de68f1771b134e6391a49f5e3cc74
Instruction Fuzzy Hash: 7BF10474D00218EFDB00DFA4EA98BEDBBB5BF49705F10816AE802B76A0DB745A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00532D90 Relevance: 875.8, APIs: 381, Strings: 118, Instructions: 2509COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00532EB7
__vbaVarDup.MSVBVM60 ref: 00532EBF
__vbaOnError.MSVBVM60(?), ref: 00532EC7
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00532EDF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018), ref: 00532F07
__vbaI2I4.MSVBVM60 ref: 00532F20
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,0000007C), ref: 00532F42
__vbaFreeObj.MSVBVM60 ref: 00532F4E
__vbaStrCopy.MSVBVM60 ref: 00532F5C
#669.MSVBVM60 ref: 00532F5E
__vbaStrMove.MSVBVM60 ref: 00532F6F
#616.MSVBVM60(?,?), ref: 00532F77
__vbaStrMove.MSVBVM60 ref: 00532F85
__vbaStrCmp.MSVBVM60(0041D8A0,00000000), ref: 00532F8D
__vbaFreeStr.MSVBVM60 ref: 00532FA2
#631.MSVBVM60(?,00000002,0000000A), ref: 00532FCE
__vbaStrMove.MSVBVM60 ref: 00532FD9
__vbaFreeVar.MSVBVM60 ref: 00532FE1
__vbaStrCopy.MSVBVM60(?), ref: 00532FF8
#670.MSVBVM60(?), ref: 00533006
#518.MSVBVM60(?,?), ref: 0053301A
__vbaVarDup.MSVBVM60 ref: 00533040
__vbaStrVarVal.MSVBVM60(?,?,?,000000FF,00000000), ref: 0053305F
#711.MSVBVM60(?,00000000), ref: 0053306D
__vbaAryVar.MSVBVM60(00002008,?), ref: 0053307F
__vbaAryCopy.MSVBVM60(?,?), ref: 00533096
__vbaFreeStr.MSVBVM60 ref: 005330A2
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 005330C6
__vbaUbound.MSVBVM60(?,?), ref: 005330D5
__vbaI2I4.MSVBVM60 ref: 005330E3
__vbaLbound.MSVBVM60(?,?), ref: 005330F1
__vbaI2I4.MSVBVM60 ref: 005330F9
__vbaGenerateBoundsError.MSVBVM60 ref: 00533123
__vbaGenerateBoundsError.MSVBVM60 ref: 00533135
__vbaStrCmp.MSVBVM60(/force), ref: 0053314A
__vbaGenerateBoundsError.MSVBVM60 ref: 00533179
__vbaGenerateBoundsError.MSVBVM60 ref: 0053318B
__vbaStrCmp.MSVBVM60(/remove), ref: 005331A0
__vbaAryLock.MSVBVM60(?,?), ref: 005331CE
__vbaGenerateBoundsError.MSVBVM60 ref: 005331E9
__vbaGenerateBoundsError.MSVBVM60 ref: 00533201
__vbaAryUnlock.MSVBVM60(?,?,/cmndatapath:,FFFFFFFF), ref: 0053322B
__vbaAryLock.MSVBVM60(?,?), ref: 0053325B
__vbaGenerateBoundsError.MSVBVM60 ref: 00533276
__vbaGenerateBoundsError.MSVBVM60 ref: 00533288
__vbaLenBstr.MSVBVM60(/cmndatapath:,0000000A), ref: 005332B2
#632.MSVBVM60(?,00004008,-00000001), ref: 005332D0
__vbaAryUnlock.MSVBVM60(?), ref: 005332DA
__vbaStrVarMove.MSVBVM60(?), ref: 005332E7
__vbaAryLock.MSVBVM60(?,?), ref: 00533309
__vbaGenerateBoundsError.MSVBVM60 ref: 00533324
__vbaGenerateBoundsError.MSVBVM60 ref: 0053333C
__vbaAryUnlock.MSVBVM60(?,?,/cmnpath:,FFFFFFFF), ref: 00533366
__vbaAryLock.MSVBVM60(?,?), ref: 00533396
__vbaGenerateBoundsError.MSVBVM60 ref: 005333B1
__vbaGenerateBoundsError.MSVBVM60 ref: 005333C3
__vbaLenBstr.MSVBVM60(/cmnpath:,0000000A), ref: 005333ED
#632.MSVBVM60(?,00004008,-00000001), ref: 0053340B
__vbaAryUnlock.MSVBVM60(?), ref: 00533415
__vbaStrVarMove.MSVBVM60(?), ref: 00533422
__vbaStrMove.MSVBVM60 ref: 0053342D
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 0053343F
__vbaGenerateBoundsError.MSVBVM60 ref: 0053346D
__vbaGenerateBoundsError.MSVBVM60 ref: 0053347F
__vbaStrCmp.MSVBVM60(/noservice), ref: 00533494
__vbaFreeStrList.MSVBVM60(00000002,00000000,?,00000000,?,?,0000000A,?), ref: 00533E2C
__vbaFreeVar.MSVBVM60 ref: 00533E3B

Part of subcall function 005266D0: __vbaChkstk.MSVBVM60(FFFFFFFF,004047D6), ref: 005266EE
Part of subcall function 005266D0: __vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000,FFFFFFFF,004047D6), ref: 0052671E
Part of subcall function 005266D0: __vbaExitProc.MSVBVM60 ref: 00527049

__vbaGenerateBoundsError.MSVBVM60 ref: 005334C0

Part of subcall function 00526160: __vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000), ref: 005261DB
Part of subcall function 00526160: __vbaObjIs.MSVBVM60(?,00000000), ref: 005261E8
Part of subcall function 00526160: __vbaVargVar.MSVBVM60(?), ref: 00526285

__vbaGenerateBoundsError.MSVBVM60 ref: 005334D2
__vbaStrCmp.MSVBVM60(/verbose), ref: 005334E7
__vbaStrCopy.MSVBVM60 ref: 00533500
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00533529
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000014), ref: 00533551
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F7B8,00000050), ref: 0053357B
__vbaStrMove.MSVBVM60 ref: 00533597
__vbaFreeStr.MSVBVM60(?), ref: 005335AB
__vbaFreeObj.MSVBVM60 ref: 005335B7
__vbaStrCopy.MSVBVM60 ref: 005335C5
__vbaStrCopy.MSVBVM60 ref: 005335D2
__vbaFreeStr.MSVBVM60(00000000), ref: 005335E6
__vbaStrCopy.MSVBVM60 ref: 00533601
__vbaNew.MSVBVM60(0040564C), ref: 0053360E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00533615
__vbaNew.MSVBVM60(004051A8), ref: 00533620
__vbaObjSet.MSVBVM60(?,00000000), ref: 00533627
__vbaUbound.MSVBVM60(?,0055102C), ref: 00533634
__vbaLbound.MSVBVM60(?,0055102C), ref: 00533647
__vbaGenerateBoundsError.MSVBVM60 ref: 00533660
#520.MSVBVM60(?,00004008), ref: 0053368D
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 005336B5
__vbaFreeVar.MSVBVM60 ref: 005336C8
__vbaGenerateBoundsError.MSVBVM60 ref: 005336E1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CBD0,00000024), ref: 00533713
__vbaGenerateBoundsError.MSVBVM60 ref: 0053371E
__vbaStrVarMove.MSVBVM60(?), ref: 0053372B
__vbaStrMove.MSVBVM60 ref: 00533739
__vbaStrCopy.MSVBVM60 ref: 00533745
__vbaFreeStr.MSVBVM60 ref: 0053374D
__vbaFreeVar.MSVBVM60 ref: 00533759
__vbaGenerateBoundsError.MSVBVM60 ref: 00533778
#632.MSVBVM60(?,00004008,00000002,00000002), ref: 005337AE
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 005337D6
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 005337F3
__vbaGenerateBoundsError.MSVBVM60 ref: 00533823
#632.MSVBVM60(?,00004008,?,00000002), ref: 00533859
__vbaStrCopy.MSVBVM60 ref: 0053386A
__vbaVarCat.MSVBVM60(?,?,00008008), ref: 005338AC
__vbaVarCat.MSVBVM60(?,?,00000000), ref: 005338BD
__vbaStrVarMove.MSVBVM60(00000000), ref: 005338C0
__vbaStrMove.MSVBVM60 ref: 005338CE
__vbaHresultCheckObj.MSVBVM60(00000000,?,004202F0,00000038), ref: 00533900
__vbaStrMove.MSVBVM60 ref: 00533919
__vbaFreeStrList.MSVBVM60(00000002,00000000,?), ref: 0053392B
__vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 0053394F
#520.MSVBVM60(00000002,00004008), ref: 00533979
__vbaVarTstNe.MSVBVM60(00008008,00000002), ref: 005339A1
__vbaFreeVar.MSVBVM60 ref: 005339B0
__vbaGenerateBoundsError.MSVBVM60 ref: 005339EB
#632.MSVBVM60(?,00004008,00000003,0000000A), ref: 00533A20
__vbaGenerateBoundsError.MSVBVM60 ref: 00533A2B
__vbaVarCat.MSVBVM60(?,?,00000008), ref: 00533A46
__vbaStrVarMove.MSVBVM60(00000000), ref: 00533A4D
__vbaStrMove.MSVBVM60 ref: 00533A5B
__vbaStrCopy.MSVBVM60 ref: 00533A67
__vbaFreeStr.MSVBVM60 ref: 00533A73
__vbaFreeVarList.MSVBVM60(00000003,0000000A,?,?), ref: 00533A90
__vbaCastObj.MSVBVM60(00000000,0041CBD0), ref: 00533AB8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00533AC9
__vbaCastObj.MSVBVM60(00000000,004202F0), ref: 00533AD2
__vbaObjSet.MSVBVM60(?,00000000), ref: 00533ADD
__vbaStrCopy.MSVBVM60 ref: 00533AE9
__vbaStrCmp.MSVBVM60(CFG,00000000), ref: 00533AF3
__vbaStrCopy.MSVBVM60 ref: 00533B09
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00533B1E
__vbaNew2.MSVBVM60(00406A6C,0055609C), ref: 00533B43
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00533B59
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414108,0000000C), ref: 00533B7B
__vbaFreeObj.MSVBVM60 ref: 00533B87
__vbaStrCat.MSVBVM60(ShutDown.ZUR,?), ref: 00533B9C
__vbaStrMove.MSVBVM60 ref: 00533BAA
__vbaFreeStr.MSVBVM60(00000000), ref: 00533BCA
__vbaVarDup.MSVBVM60 ref: 00533C1C
__vbaStrCat.MSVBVM60(IMC,The ), ref: 00533C32
__vbaStrMove.MSVBVM60 ref: 00533C3C
__vbaStrCat.MSVBVM60( software is currently shut down. Please try again later.,00000000), ref: 00533C44
#595.MSVBVM60(?,00001010,?,?,?), ref: 00533C73
__vbaFreeStr.MSVBVM60 ref: 00533C7F
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 00533CA3
__vbaStrCopy.MSVBVM60 ref: 00533CB9
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 00533CCA
__vbaStrCopy.MSVBVM60 ref: 00533CDB
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 00533CE6
__vbaStrCopy.MSVBVM60 ref: 00533CF8
__vbaStrCopy.MSVBVM60 ref: 00533D05
__vbaStrCopy.MSVBVM60 ref: 00533D13
__vbaStrCopy.MSVBVM60 ref: 00533D20
__vbaStrCopy.MSVBVM60 ref: 00533D2E
__vbaStrCopy.MSVBVM60 ref: 00533D38
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F5EC,0000002C), ref: 00533D64
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,00000040), ref: 00533D9A
__vbaFreeObj.MSVBVM60 ref: 00533DAD
__vbaStrCopy.MSVBVM60 ref: 00533DE5
__vbaStrCopy.MSVBVM60 ref: 00533DF2
__vbaExitProc.MSVBVM60 ref: 005351D3
__vbaFreeStr.MSVBVM60(005352EE), ref: 00535294
__vbaFreeStr.MSVBVM60 ref: 00535299
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 005352A1
__vbaFreeObj.MSVBVM60 ref: 005352B0
__vbaFreeStr.MSVBVM60 ref: 005352B5
__vbaFreeStr.MSVBVM60 ref: 005352BA
__vbaFreeStr.MSVBVM60 ref: 005352BF
__vbaFreeStr.MSVBVM60 ref: 005352C4
__vbaFreeObj.MSVBVM60 ref: 005352C9
__vbaFreeStr.MSVBVM60 ref: 005352CE
__vbaFreeVar.MSVBVM60 ref: 005352D3
__vbaFreeStr.MSVBVM60 ref: 005352DC
__vbaFreeStr.MSVBVM60 ref: 005352E1
__vbaFreeStr.MSVBVM60 ref: 005352E6
__vbaFreeStr.MSVBVM60 ref: 005352EB

Strings

. Contact Client Services for assistance., xrefs: 00534E59
IMSGXA.exe, xrefs: 00534906
/verbose, xrefs: 005334E2
IMSGRMS.exe, xrefs: 0053485E
CGT, xrefs: 00534A13
Signon, xrefs: 00534D30, 00534E36
IDBIInt.exe, xrefs: 00534A02
IMSGINV.exe, xrefs: 0053487A
JailTran.exe, xrefs: 0053471F
Records.exe, xrefs: 005344AD
\RemotePath, xrefs: 00533881
CallTracking.exe, xrefs: 005347C7
Signon Failed to find an appropriate program to run. Contact Client Services for assistance., xrefs: 00534D3D
RCM, xrefs: 00534B1C
Repostry.exe, xrefs: 005347AB
IImcFTP.exe, xrefs: 005349E6
PAC, xrefs: 0053494F
## updateclient, xrefs: 00533D30
## shutdownchecker, xrefs: 00533B01
software is out of date on this workstation. Reboot this workstation, shut down all , xrefs: 005340ED
## setdisklines, xrefs: 00533CB1
FMS, xrefs: 005346F8
LAPPAK.DAT, xrefs: 00534232, 005344DC
Pl.exe, xrefs: 005346DE
RMS, xrefs: 0053420E
FTP, xrefs: 005349DB
/cmnpath:, xrefs: 0053334C, 005333E8
MPS, xrefs: 005344BE
\HKEY_CURRENT_USER\Network\, xrefs: 0053386C
MOR, xrefs: 00534A2F
ChangeUnit.On, xrefs: 005347FA
IComInt.exe, xrefs: 00534A56
AVS, xrefs: 00534C81
Failed to remove all or part of the auto-updating client on this workstation. See , xrefs: 00533E5F
/FromSignon, xrefs: 005347D1
## opendiskdat, xrefs: 005335BD
The auto-updating client on this workstation was removed successfully., xrefs: 00533DE7
OHDTSHR, xrefs: 00534ABB
/RMSIGNON, xrefs: 005343C0
## resetdisklines, xrefs: 005341A8
## checkexecutableexists, xrefs: 00534DF2
EMS, xrefs: 00534A83
ITelInt.exe, xrefs: 005349CA
IZetron.exe, xrefs: 00534AAA
ChangeMobileUnit.exe, xrefs: 00534838
JMS, xrefs: 00534714
/cmndatapath:, xrefs: 00533211, 005332AD
MIR, xrefs: 00534853
AMS, xrefs: 00534768
SIG, xrefs: 00534917
IMSGFMS.exe, xrefs: 00534896
CIV, xrefs: 0053474C
/force, xrefs: 00533145
ShutDown.ZUR, xrefs: 00533B97
## commandline, xrefs: 00532F54
Invest.exe, xrefs: 0053473B
iIMCMobl.exe, xrefs: 00534842
## shell, xrefs: 00534EE0
IPackInt.exe, xrefs: 0053495A
/RMSIGNONONLY, xrefs: 005343CD
SCA, xrefs: 0053496B
IDataInt.exe, xrefs: 005349AE
CADXCHG, xrefs: 00534B3D
MIF, xrefs: 0053488B
911CSvr, xrefs: 00534AD7
IMorpho.exe, xrefs: 00534A3A
ICmtImc.exe, xrefs: 00534A72
AVC, xrefs: 00534C9F
## getexecutable, xrefs: 005341EF
COM, xrefs: 00534A4B
DBI, xrefs: 005349F7
CFG, xrefs: 00533AEE, 00534CDC
ISCAInt.exe, xrefs: 00534976
I911CSvr.exe, xrefs: 00534AE2
IOHDTSHR.exe, xrefs: 00534AC6
Quest.exe, xrefs: 0053478F
MIE, xrefs: 005348DF
IMSGEMS.exe, xrefs: 005348EA
Shut Down, xrefs: 00533BFB
IMC, xrefs: 00533C27, 00533DDA, 00533E52, 005340C3, 005340D5, 005340FF
QST, xrefs: 00534784
Admin.exe, xrefs: 00534773
I911.exe, xrefs: 0053493E
REP, xrefs: 005347A0
MII, xrefs: 0053486F
ConfigUtil.exe, xrefs: 00534CE7
## checkexecutablelength, xrefs: 00534CF1
TEL, xrefs: 005349BF
INV, xrefs: 00534730
Fire.exe, xrefs: 00534703
/remove, xrefs: 0053319B
Signon was unable to find the executable file , xrefs: 00534E43
## terminate, xrefs: 00534F76
Civil.exe, xrefs: 00534757
software and then try again. If this error is still received, have your system administrator log into this workstation as a user, xrefs: 00534111
DMX, xrefs: 005349A3
MIX, xrefs: 005348FB
iIMCSWCH.exe, xrefs: 005348CE
/SIGNON, xrefs: 005345C0, 00534B08
software is currently shut down. Please try again later., xrefs: 00533C3F
ZTN, xrefs: 00534A9F
IMSGMPS.exe, xrefs: 005348B2
MMB, xrefs: 005347E5
ICogent.exe, xrefs: 00534A1E
LANNCIC, xrefs: 00534AF3
911, xrefs: 00534933
CMT, xrefs: 00534A67
The , xrefs: 00533C22, 005340D0
MIM, xrefs: 005348A7
MSW, xrefs: 005348C3
ImcSys.log for details., xrefs: 00533E81
IImcFax.exe, xrefs: 00534992
FAX, xrefs: 00534987
iIMCLAN.exe, xrefs: 0053436D, 00534496, 005345B6, 005346CB, 00534AFE
/noservice, xrefs: 0053348F
## runfromservice, xrefs: 005335F9
IAlrmInt.exe, xrefs: 00534922
Ems.exe, xrefs: 00534A8E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Error$BoundsCopyGenerate$Move$CheckHresult$List$#632$LockNew2Unlock$#520BstrCastExitLboundProcUbound$#518#595#616#631#669#670#711AddrefChkstkDestructVarg
String ID: software and then try again. If this error is still received, have your system administrator log into this workstation as a user$ software is currently shut down. Please try again later.$ software is out of date on this workstation. Reboot this workstation, shut down all $## checkexecutableexists$## checkexecutablelength$## commandline$## getexecutable$## opendiskdat$## resetdisklines$## runfromservice$## setdisklines$## shell$## shutdownchecker$## terminate$## updateclient$. Contact Client Services for assistance.$/FromSignon$/RMSIGNON$/RMSIGNONONLY$/SIGNON$/cmndatapath:$/cmnpath:$/force$/noservice$/remove$/verbose$911$911CSvr$AMS$AVC$AVS$Admin.exe$CADXCHG$CFG$CGT$CIV$CMT$COM$CallTracking.exe$ChangeMobileUnit.exe$ChangeUnit.On$Civil.exe$ConfigUtil.exe$DBI$DMX$EMS$Ems.exe$FAX$FMS$FTP$Failed to remove all or part of the auto-updating client on this workstation. See $Fire.exe$I911.exe$I911CSvr.exe$IAlrmInt.exe$ICmtImc.exe$ICogent.exe$IComInt.exe$IDBIInt.exe$IDataInt.exe$IImcFTP.exe$IImcFax.exe$IMC$IMSGEMS.exe$IMSGFMS.exe$IMSGINV.exe$IMSGMPS.exe$IMSGRMS.exe$IMSGXA.exe$IMorpho.exe$INV$IOHDTSHR.exe$IPackInt.exe$ISCAInt.exe$ITelInt.exe$IZetron.exe$ImcSys.log for details.$Invest.exe$JMS$JailTran.exe$LANNCIC$LAPPAK.DAT$MIE$MIF$MII$MIM$MIR$MIX$MMB$MOR$MPS$MSW$OHDTSHR$PAC$Pl.exe$QST$Quest.exe$RCM$REP$RMS$Records.exe$Repostry.exe$SCA$SIG$Shut Down$ShutDown.ZUR$Signon$Signon Failed to find an appropriate program to run. Contact Client Services for assistance.$Signon was unable to find the executable file $TEL$The $The auto-updating client on this workstation was removed successfully.$ZTN$\HKEY_CURRENT_USER\Network\$\RemotePath$iIMCLAN.exe$iIMCMobl.exe$iIMCSWCH.exe
API String ID: 3942975489-2576323987
Opcode ID: 75597cea9618637450ef8f85c636a9fd7de69287bc8b04a3d614cf3ac5c1ee91
Instruction ID: ec66b79b99f0f1c3ee9e7d5690a48e40902ae332feb1bb50c4556271f65f06a4
Opcode Fuzzy Hash: 75597cea9618637450ef8f85c636a9fd7de69287bc8b04a3d614cf3ac5c1ee91
Instruction Fuzzy Hash: BF236371A002199BDB14DBA4DD84FEEBBB9FF84700F10819AE50AA71A1DF706E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0051DCB0 Relevance: 704.1, APIs: 373, Strings: 28, Instructions: 2381COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,0051C3AB,?), ref: 0051DCCE
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051DCFE
__vbaStrCopy.MSVBVM60 ref: 0051DD13
__vbaInStr.MSVBVM60(00000000,00414B08,?,?), ref: 0051DD2D
#616.MSVBVM60(?,-00000001), ref: 0051DD6D
__vbaStrMove.MSVBVM60 ref: 0051DD78
__vbaStrCat.MSVBVM60( | ,00000000), ref: 0051DD84
__vbaStrMove.MSVBVM60 ref: 0051DD8F
#631.MSVBVM60(?,-00000002,0000000A,00000000), ref: 0051DDAB
__vbaStrMove.MSVBVM60 ref: 0051DDB6
__vbaStrCat.MSVBVM60(00000000), ref: 0051DDBD
__vbaStrMove.MSVBVM60 ref: 0051DDC8
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0051DDDC
__vbaFreeVar.MSVBVM60 ref: 0051DDE8
__vbaInStr.MSVBVM60(00000000,00414B08,?,00000000), ref: 0051DE04
__vbaInStr.MSVBVM60(00000000,00414B20,?,?), ref: 0051DE26
#616.MSVBVM60(?,-00000001), ref: 0051DE66
__vbaStrMove.MSVBVM60 ref: 0051DE71
__vbaStrCat.MSVBVM60( | ,00000000), ref: 0051DE7D
__vbaStrMove.MSVBVM60 ref: 0051DE88
#631.MSVBVM60(?,-00000001,0000000A,00000000), ref: 0051DEA4
__vbaStrMove.MSVBVM60 ref: 0051DEAF
__vbaStrCat.MSVBVM60(00000000), ref: 0051DEB6
__vbaStrMove.MSVBVM60 ref: 0051DEC1
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0051DED5
__vbaFreeVar.MSVBVM60 ref: 0051DEE1
__vbaInStr.MSVBVM60(00000000,00414B20,?,00000000), ref: 0051DEFD
__vbaInStr.MSVBVM60(00000000,00414B28,?,?), ref: 0051DF1F
#616.MSVBVM60(?,-00000001), ref: 0051DF5F
__vbaStrMove.MSVBVM60 ref: 0051DF6A
__vbaStrCat.MSVBVM60( | ,00000000), ref: 0051DF76
__vbaStrMove.MSVBVM60 ref: 0051DF81
#631.MSVBVM60(?,-00000001,0000000A,00000000), ref: 0051DF9D
__vbaStrMove.MSVBVM60 ref: 0051DFA8
__vbaStrCat.MSVBVM60(00000000), ref: 0051DFAF
__vbaStrMove.MSVBVM60 ref: 0051DFBA
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0051DFCE
__vbaFreeVar.MSVBVM60 ref: 0051DFDA
__vbaInStr.MSVBVM60(00000000,00414B28,?,00000000), ref: 0051DFF6
__vbaStrCopy.MSVBVM60 ref: 0051E011
__vbaFreeStr.MSVBVM60(0051E05C), ref: 0051E055
__vbaErrorOverflow.MSVBVM60 ref: 0051E072
__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0051E09E
__vbaStrFixstr.MSVBVM60(000007D0,?,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051E0D8
__vbaStrMove.MSVBVM60 ref: 0051E0E6
__vbaLenBstr.MSVBVM60(00000000), ref: 0051E0ED
#525.MSVBVM60(00000000), ref: 0051E0F4
__vbaStrMove.MSVBVM60 ref: 0051E102
__vbaLsetFixstr.MSVBVM60(000007D0,?,00000000), ref: 0051E115
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051E12B
__vbaCopyBytes.MSVBVM60(000007EE,?,?), ref: 0051E14E
#685.MSVBVM60 ref: 0051E15B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0051E169
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000001C), ref: 0051E1B4
__vbaStrI4.MSVBVM60(?), ref: 0051E1D3
__vbaStrMove.MSVBVM60 ref: 0051E1E1
__vbaLsetFixstr.MSVBVM60(0000000A,?,00000000), ref: 0051E1F1
__vbaFreeStr.MSVBVM60 ref: 0051E1FD
__vbaFreeObj.MSVBVM60 ref: 0051E209
#685.MSVBVM60 ref: 0051E216
__vbaObjSet.MSVBVM60(?,00000000), ref: 0051E224
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000002C), ref: 0051E26F
__vbaLsetFixstr.MSVBVM60(00000096,?,?), ref: 0051E29A
__vbaFreeStr.MSVBVM60 ref: 0051E2A6
__vbaFreeObj.MSVBVM60 ref: 0051E2B2
#685.MSVBVM60 ref: 0051E2BF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0051E2CD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,00000024), ref: 0051E318
__vbaLsetFixstr.MSVBVM60(00000096,?,?), ref: 0051E343
__vbaFreeStr.MSVBVM60 ref: 0051E34F
__vbaFreeObj.MSVBVM60 ref: 0051E35B
__vbaOnError.MSVBVM60(000000FF), ref: 0051E36A
__vbaStrFixstr.MSVBVM60(0000000A,?), ref: 0051E397
__vbaStrMove.MSVBVM60 ref: 0051E3A5
#523.MSVBVM60(00000000), ref: 0051E3AC
__vbaStrMove.MSVBVM60 ref: 0051E3BA
__vbaLsetFixstr.MSVBVM60(0000000A,?,?), ref: 0051E3D0
__vbaStrCmp.MSVBVM60(0041A4BC,?), ref: 0051E3E2
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051E406
__vbaStrFixstr.MSVBVM60(00000096,?,00000007), ref: 0051E433
__vbaStrMove.MSVBVM60 ref: 0051E441
#616.MSVBVM60(00000000), ref: 0051E448
__vbaStrMove.MSVBVM60 ref: 0051E456
__vbaLsetFixstr.MSVBVM60(00000096,?,?), ref: 0051E46F
__vbaStrCmp.MSVBVM60(RunTime,?), ref: 0051E481
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051E4A5
__vbaOnError.MSVBVM60(00000000), ref: 0051E4C6
__vbaStrFixstr.MSVBVM60(00000096,?), ref: 0051E4DF
__vbaStrMove.MSVBVM60 ref: 0051E4ED
#523.MSVBVM60(00000000), ref: 0051E4F4
__vbaStrMove.MSVBVM60 ref: 0051E502
__vbaFreeStr.MSVBVM60(00520555), ref: 00520533
__vbaFreeStr.MSVBVM60 ref: 0052053C
__vbaFreeStr.MSVBVM60 ref: 00520545
__vbaFreeStr.MSVBVM60 ref: 0052054E

Strings

frmPreview., xrefs: 0051EDBE
hqU, xrefs: 0051F5EC
RUN, xrefs: 0051EEBB
| , xrefs: 0051DD7F, 0051DE78, 0051DF71
automation error, xrefs: 0051EC2E
Index, xrefs: 0051FA78, 0051FEEB
| Full Executable: , xrefs: 0051F31D
Application Error - Ver. , xrefs: 005200A1, 0052022B, 005202E7
| Full Code Source: , xrefs: 0051F092
Name, xrefs: 0051F8E6, 0051F9AF, 0051FD79
hqU, xrefs: 0051FB13
hqU, xrefs: 0051FE21
hqU, xrefs: 0051F4E5
TerminateProgram, xrefs: 0051E5D5
other applications and reboot this computer before continuing., xrefs: 0051EB9A, 0051EE6F
This application will now shutdown. You should close all, xrefs: 0051EB66, 0051EE3B
hqU, xrefs: 0051F3F2
hqU, xrefs: 0051F16B
You have encountered several errors. Would you like to terminate this program? Click YES to terminate or click NO to ignore the , xrefs: 005200F8
hqU, xrefs: 0051FCAF
RunTime, xrefs: 0051D94D, 0051E47C
Reports Error Number: , xrefs: 0051E9CB
NarrRpt., xrefs: 0051ECA6
c, xrefs: 00520464
DisplayNonModalText, xrefs: 005203A9
NarrEdit., xrefs: 0051ED32
x`U, xrefs: 0051FFBB, 00520485
Terminating due to the preceding error. , xrefs: 0051E7A1

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Fixstr$ListLset$#616Error$#631#685CheckCopyHresult$#523Chkstk$#525BstrBytesOverflow
String ID: Reports Error Number: $ | $ | Full Code Source: $ | Full Executable: $Application Error - Ver. $DisplayNonModalText$Index$Name$NarrEdit.$NarrRpt.$RUN$RunTime$TerminateProgram$Terminating due to the preceding error. $This application will now shutdown. You should close all$You have encountered several errors. Would you like to terminate this program? Click YES to terminate or click NO to ignore the $automation error$c$frmPreview.$hqU$hqU$hqU$hqU$hqU$hqU$hqU$other applications and reboot this computer before continuing.$x`U
API String ID: 3741614136-2887844071
Opcode ID: 8ddeede81fd7a6b0cb33fddf166266ed927647a1de242aaca3675141c070e2a3
Instruction ID: 2b934f432e268ebe4f589b14884f3b5461fff1560488f2bd36fe0f2f827fae7e
Opcode Fuzzy Hash: 8ddeede81fd7a6b0cb33fddf166266ed927647a1de242aaca3675141c070e2a3
Instruction Fuzzy Hash: 05330875900218EFDB14DFA0DD58AEAB7F8FB48701F1081E9F50AA62A0DB745B85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0051C330 Relevance: 398.9, APIs: 265, Instructions: 1376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,0051BEB2,?), ref: 0051C34E
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051C37E
__vbaStrFixstr.MSVBVM60(00000003,0051BEB2), ref: 0051C391
__vbaStrMove.MSVBVM60 ref: 0051C39C

Part of subcall function 0051DCB0: __vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,0051C3AB,?), ref: 0051DCCE
Part of subcall function 0051DCB0: __vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051DCFE
Part of subcall function 0051DCB0: __vbaStrCopy.MSVBVM60 ref: 0051DD13
Part of subcall function 0051DCB0: __vbaInStr.MSVBVM60(00000000,00414B08,?,?), ref: 0051DD2D
Part of subcall function 0051DCB0: #616.MSVBVM60(?,-00000001), ref: 0051DD6D
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DD78
Part of subcall function 0051DCB0: __vbaStrCat.MSVBVM60( | ,00000000), ref: 0051DD84
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DD8F
Part of subcall function 0051DCB0: #631.MSVBVM60(?,-00000002,0000000A,00000000), ref: 0051DDAB
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DDB6
Part of subcall function 0051DCB0: __vbaStrCat.MSVBVM60(00000000), ref: 0051DDBD
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DDC8
Part of subcall function 0051DCB0: __vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0051DDDC
Part of subcall function 0051DCB0: __vbaFreeVar.MSVBVM60 ref: 0051DDE8
Part of subcall function 0051DCB0: __vbaInStr.MSVBVM60(00000000,00414B08,?,00000000), ref: 0051DE04

__vbaStrMove.MSVBVM60(?), ref: 0051C3B0
__vbaLsetFixstr.MSVBVM60(00000003,0051BEB2,?), ref: 0051C3C0
__vbaLsetFixstr.MSVBVM60(00000003,0051BEB2,?), ref: 0051C3D0
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C3E0
__vbaStrFixstr.MSVBVM60(00000003,0051BEAC), ref: 0051C3F9
__vbaStrMove.MSVBVM60 ref: 0051C404

Part of subcall function 0051DCB0: __vbaInStr.MSVBVM60(00000000,00414B20,?,?), ref: 0051DE26
Part of subcall function 0051DCB0: #616.MSVBVM60(?,-00000001), ref: 0051DE66
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DE71
Part of subcall function 0051DCB0: __vbaStrCat.MSVBVM60( | ,00000000), ref: 0051DE7D
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DE88
Part of subcall function 0051DCB0: #631.MSVBVM60(?,-00000001,0000000A,00000000), ref: 0051DEA4
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DEAF
Part of subcall function 0051DCB0: __vbaStrCat.MSVBVM60(00000000), ref: 0051DEB6
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DEC1
Part of subcall function 0051DCB0: __vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0051DED5
Part of subcall function 0051DCB0: __vbaFreeVar.MSVBVM60 ref: 0051DEE1
Part of subcall function 0051DCB0: __vbaInStr.MSVBVM60(00000000,00414B20,?,00000000), ref: 0051DEFD
Part of subcall function 0051DCB0: __vbaInStr.MSVBVM60(00000000,00414B28,?,?), ref: 0051DF1F
Part of subcall function 0051DCB0: #616.MSVBVM60(?,-00000001), ref: 0051DF5F
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DF6A
Part of subcall function 0051DCB0: __vbaStrCat.MSVBVM60( | ,00000000), ref: 0051DF76
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DF81

__vbaStrMove.MSVBVM60(?), ref: 0051C418
__vbaLsetFixstr.MSVBVM60(00000003,0051BEAC,?), ref: 0051C42B
__vbaLsetFixstr.MSVBVM60(00000003,0051BEAC,?), ref: 0051C43E
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C44E
__vbaStrFixstr.MSVBVM60(00000008,0051BEA6), ref: 0051C467
__vbaStrMove.MSVBVM60 ref: 0051C472

Part of subcall function 0051DCB0: #631.MSVBVM60(?,-00000001,0000000A,00000000), ref: 0051DF9D
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DFA8
Part of subcall function 0051DCB0: __vbaStrCat.MSVBVM60(00000000), ref: 0051DFAF
Part of subcall function 0051DCB0: __vbaStrMove.MSVBVM60 ref: 0051DFBA
Part of subcall function 0051DCB0: __vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0051DFCE
Part of subcall function 0051DCB0: __vbaFreeVar.MSVBVM60 ref: 0051DFDA
Part of subcall function 0051DCB0: __vbaInStr.MSVBVM60(00000000,00414B28,?,00000000), ref: 0051DFF6
Part of subcall function 0051DCB0: __vbaStrCopy.MSVBVM60 ref: 0051E011
Part of subcall function 0051DCB0: __vbaFreeStr.MSVBVM60(0051E05C), ref: 0051E055

__vbaStrMove.MSVBVM60(?), ref: 0051C486
__vbaLsetFixstr.MSVBVM60(00000008,0051BEA6,?), ref: 0051C499
__vbaLsetFixstr.MSVBVM60(00000008,0051BEA6,?), ref: 0051C4AC
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C4BC
__vbaStrFixstr.MSVBVM60(00000004,0051BE96), ref: 0051C4D5
__vbaStrMove.MSVBVM60 ref: 0051C4E0
__vbaStrMove.MSVBVM60(?), ref: 0051C4F4
__vbaLsetFixstr.MSVBVM60(00000004,0051BE96,?), ref: 0051C507
__vbaLsetFixstr.MSVBVM60(00000004,0051BE96,?), ref: 0051C51A
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C52A
__vbaStrFixstr.MSVBVM60(00000032,0051BE8E), ref: 0051C543
__vbaStrMove.MSVBVM60 ref: 0051C54E
__vbaStrMove.MSVBVM60(?), ref: 0051C562
__vbaLsetFixstr.MSVBVM60(00000032,0051BE8E,?), ref: 0051C575
__vbaLsetFixstr.MSVBVM60(00000032,0051BE8E,?), ref: 0051C588
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C598
__vbaStrFixstr.MSVBVM60(00000008,0051BE2A), ref: 0051C5B4
__vbaStrMove.MSVBVM60 ref: 0051C5BF
__vbaStrMove.MSVBVM60(?), ref: 0051C5D3
__vbaLsetFixstr.MSVBVM60(00000008,0051BE2A,?), ref: 0051C5E9
__vbaLsetFixstr.MSVBVM60(00000008,0051BE2A,?), ref: 0051C5FE
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C60E
__vbaStrFixstr.MSVBVM60(00000003,0051BE1A), ref: 0051C629
__vbaStrMove.MSVBVM60 ref: 0051C634
__vbaStrMove.MSVBVM60(?), ref: 0051C648
__vbaLsetFixstr.MSVBVM60(00000003,0051BE1A,?), ref: 0051C65D
__vbaLsetFixstr.MSVBVM60(00000003,0051BE1A,?), ref: 0051C673
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C683
__vbaStrFixstr.MSVBVM60(0000000A,0051BE14), ref: 0051C69F
__vbaStrMove.MSVBVM60 ref: 0051C6AA
__vbaStrMove.MSVBVM60(?), ref: 0051C6BE
__vbaLsetFixstr.MSVBVM60(0000000A,0051BE14,?), ref: 0051C6D4
__vbaLsetFixstr.MSVBVM60(0000000A,0051BE14,?), ref: 0051C6EA
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C6FA
__vbaStrFixstr.MSVBVM60(00000096,0051BE00), ref: 0051C719
__vbaStrMove.MSVBVM60 ref: 0051C724
__vbaStrMove.MSVBVM60(?), ref: 0051C738
__vbaLsetFixstr.MSVBVM60(00000096,0051BE00,?), ref: 0051C751
__vbaLsetFixstr.MSVBVM60(00000096,0051BE00,?), ref: 0051C769
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C779
__vbaStrFixstr.MSVBVM60(00000014,0051BCD4), ref: 0051C794
__vbaStrMove.MSVBVM60 ref: 0051C79F
__vbaStrMove.MSVBVM60(?), ref: 0051C7B3
__vbaLsetFixstr.MSVBVM60(00000014,0051BCD4,?), ref: 0051C7C8
__vbaLsetFixstr.MSVBVM60(00000014,0051BCD4,?), ref: 0051C7DE
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C7EE
__vbaStrFixstr.MSVBVM60(0000000A,0051BCAC), ref: 0051C80A
__vbaStrMove.MSVBVM60 ref: 0051C815
__vbaStrMove.MSVBVM60(?), ref: 0051C829
__vbaLsetFixstr.MSVBVM60(0000000A,0051BCAC,?), ref: 0051C83F
__vbaLsetFixstr.MSVBVM60(0000000A,0051BCAC,?), ref: 0051C855
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C865
__vbaStrFixstr.MSVBVM60(0000000F,0051BC98), ref: 0051C881
__vbaStrMove.MSVBVM60 ref: 0051C88C
__vbaStrMove.MSVBVM60(?), ref: 0051C8A0
__vbaLsetFixstr.MSVBVM60(0000000F,0051BC98,?), ref: 0051C8B6
__vbaLsetFixstr.MSVBVM60(0000000F,0051BC98,?), ref: 0051C8CB
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C8DB
__vbaStrFixstr.MSVBVM60(00000007,0051BC7A), ref: 0051C8F6
__vbaStrMove.MSVBVM60 ref: 0051C901
__vbaStrMove.MSVBVM60(?), ref: 0051C915
__vbaLsetFixstr.MSVBVM60(00000007,0051BC7A,?), ref: 0051C92A
__vbaLsetFixstr.MSVBVM60(00000007,0051BC7A,?), ref: 0051C940
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C950
__vbaStrFixstr.MSVBVM60(00000008,0051BC6C), ref: 0051C96C
__vbaStrMove.MSVBVM60 ref: 0051C977
__vbaStrMove.MSVBVM60(?), ref: 0051C98B
__vbaLsetFixstr.MSVBVM60(00000008,0051BC6C,?), ref: 0051C9A1
__vbaLsetFixstr.MSVBVM60(00000008,0051BC6C,?), ref: 0051C9B7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C9C7
__vbaStrFixstr.MSVBVM60(00000096,0051BC5C), ref: 0051C9E6
__vbaStrMove.MSVBVM60 ref: 0051C9F1
__vbaStrMove.MSVBVM60(?), ref: 0051CA05
__vbaLsetFixstr.MSVBVM60(00000096,0051BC5C,?), ref: 0051CA1E
__vbaLsetFixstr.MSVBVM60(00000096,0051BC5C,?), ref: 0051CA36
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CA46
__vbaStrFixstr.MSVBVM60(0000000F,0051BB30), ref: 0051CA61
__vbaStrMove.MSVBVM60 ref: 0051CA6C
__vbaStrMove.MSVBVM60(?), ref: 0051CA80
__vbaLsetFixstr.MSVBVM60(0000000F,0051BB30,?), ref: 0051CA95
__vbaLsetFixstr.MSVBVM60(0000000F,0051BB30,?), ref: 0051CAAB
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CABB
__vbaStrFixstr.MSVBVM60(0000000F,0051BB12), ref: 0051CAD7
__vbaStrMove.MSVBVM60 ref: 0051CAE2
__vbaStrMove.MSVBVM60(?), ref: 0051CAF6
__vbaLsetFixstr.MSVBVM60(0000000F,0051BB12,?), ref: 0051CB0C
__vbaLsetFixstr.MSVBVM60(0000000F,0051BB12,?), ref: 0051CB22
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CB32
__vbaStrFixstr.MSVBVM60(00000003,0051BAF4), ref: 0051CB4E
__vbaStrMove.MSVBVM60 ref: 0051CB59
__vbaStrMove.MSVBVM60(?), ref: 0051CB6D
__vbaLsetFixstr.MSVBVM60(00000003,0051BAF4,?), ref: 0051CB83
__vbaLsetFixstr.MSVBVM60(00000003,0051BAF4,?), ref: 0051CB98
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CBA8
__vbaStrFixstr.MSVBVM60(0000000F,0051BAEE), ref: 0051CBC3
__vbaStrMove.MSVBVM60 ref: 0051CBCE
__vbaStrMove.MSVBVM60(?), ref: 0051CBE2
__vbaLsetFixstr.MSVBVM60(0000000F,0051BAEE,?), ref: 0051CBF7
__vbaLsetFixstr.MSVBVM60(0000000F,0051BAEE,?), ref: 0051CC0D
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CC1D
__vbaStrFixstr.MSVBVM60(0000000F,0051BAD0), ref: 0051CC39
__vbaStrMove.MSVBVM60 ref: 0051CC44
__vbaStrMove.MSVBVM60(?), ref: 0051CC58
__vbaLsetFixstr.MSVBVM60(0000000F,0051BAD0,?), ref: 0051CC6E
__vbaLsetFixstr.MSVBVM60(0000000F,0051BAD0,?), ref: 0051CC84
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CC94
__vbaStrFixstr.MSVBVM60(00000003,0051BAB2), ref: 0051CCB0
__vbaStrMove.MSVBVM60 ref: 0051CCBB
__vbaStrMove.MSVBVM60(?), ref: 0051CCCF
__vbaLsetFixstr.MSVBVM60(00000003,0051BAB2,?), ref: 0051CCE5
__vbaLsetFixstr.MSVBVM60(00000003,0051BAB2,?), ref: 0051CCFA
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CD0A
__vbaStrFixstr.MSVBVM60(000001F4,0051BAAC), ref: 0051CD28
__vbaStrMove.MSVBVM60 ref: 0051CD33
__vbaStrMove.MSVBVM60(?), ref: 0051CD47
__vbaLsetFixstr.MSVBVM60(000001F4,0051BAAC,?), ref: 0051CD5F
__vbaLsetFixstr.MSVBVM60(000001F4,0051BAAC,?), ref: 0051CD78
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051CD88
__vbaStrFixstr.MSVBVM60(00000003,0051BEB2), ref: 0051CD9E
__vbaStrMove.MSVBVM60 ref: 0051CDA9
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CDB5
__vbaStrMove.MSVBVM60 ref: 0051CDC0
__vbaStrFixstr.MSVBVM60(00000003,0051BEAC,00000000), ref: 0051CDD0
__vbaStrMove.MSVBVM60 ref: 0051CDDB
__vbaStrCat.MSVBVM60(00000000), ref: 0051CDE2
__vbaStrMove.MSVBVM60 ref: 0051CDED
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CDF9
__vbaStrMove.MSVBVM60 ref: 0051CE04
__vbaStrFixstr.MSVBVM60(00000008,0051BEA6,00000000), ref: 0051CE14
__vbaStrMove.MSVBVM60 ref: 0051CE1F
__vbaStrCat.MSVBVM60(00000000), ref: 0051CE26
__vbaStrMove.MSVBVM60 ref: 0051CE31
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CE3D
__vbaStrMove.MSVBVM60 ref: 0051CE48
__vbaStrFixstr.MSVBVM60(00000004,0051BE96,00000000), ref: 0051CE58
__vbaStrMove.MSVBVM60 ref: 0051CE63
__vbaStrCat.MSVBVM60(00000000), ref: 0051CE6A
__vbaStrMove.MSVBVM60 ref: 0051CE75
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CE81
__vbaStrMove.MSVBVM60 ref: 0051CE8C
__vbaStrFixstr.MSVBVM60(00000032,0051BE8E,00000000), ref: 0051CE9C
__vbaStrMove.MSVBVM60 ref: 0051CEA7
__vbaStrCat.MSVBVM60(00000000), ref: 0051CEAE
__vbaStrMove.MSVBVM60 ref: 0051CEB9
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CEC5
__vbaStrMove.MSVBVM60 ref: 0051CED0
__vbaStrFixstr.MSVBVM60(00000008,0051BE2A,00000000), ref: 0051CEE3
__vbaStrMove.MSVBVM60 ref: 0051CEEE
__vbaStrCat.MSVBVM60(00000000), ref: 0051CEF5
__vbaStrMove.MSVBVM60 ref: 0051CF00
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CF0C
__vbaStrMove.MSVBVM60 ref: 0051CF17
__vbaStrFixstr.MSVBVM60(00000003,0051BE1A,00000000), ref: 0051CF2A
__vbaStrMove.MSVBVM60 ref: 0051CF35
__vbaStrCat.MSVBVM60(00000000), ref: 0051CF3C
__vbaStrMove.MSVBVM60 ref: 0051CF47
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CF53
__vbaStrMove.MSVBVM60 ref: 0051CF5E
__vbaStrFixstr.MSVBVM60(0000000A,0051BE14,00000000), ref: 0051CF70
__vbaStrMove.MSVBVM60 ref: 0051CF7B
__vbaStrCat.MSVBVM60(00000000), ref: 0051CF82
__vbaStrMove.MSVBVM60 ref: 0051CF8D
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CF99
__vbaStrMove.MSVBVM60 ref: 0051CFA4
__vbaStrFixstr.MSVBVM60(00000096,0051BE00,00000000), ref: 0051CFBA
__vbaStrMove.MSVBVM60 ref: 0051CFC8
__vbaStrCat.MSVBVM60(00000000), ref: 0051CFCF
__vbaStrMove.MSVBVM60 ref: 0051CFDD
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051CFE9
__vbaStrMove.MSVBVM60 ref: 0051CFF7
__vbaStrFixstr.MSVBVM60(00000014,0051BCD4,00000000), ref: 0051D00A
__vbaStrMove.MSVBVM60 ref: 0051D018
__vbaStrCat.MSVBVM60(00000000), ref: 0051D01F
__vbaStrMove.MSVBVM60 ref: 0051D02D
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D039
__vbaStrMove.MSVBVM60 ref: 0051D047
__vbaStrFixstr.MSVBVM60(0000000A,0051BCAC,00000000), ref: 0051D059
__vbaStrMove.MSVBVM60 ref: 0051D067
__vbaStrCat.MSVBVM60(00000000), ref: 0051D06E
__vbaStrMove.MSVBVM60 ref: 0051D07C
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D088
__vbaStrMove.MSVBVM60 ref: 0051D096
__vbaStrFixstr.MSVBVM60(0000000F,0051BC98,00000000), ref: 0051D0A9
__vbaStrMove.MSVBVM60 ref: 0051D0B7
__vbaStrCat.MSVBVM60(00000000), ref: 0051D0BE
__vbaStrMove.MSVBVM60 ref: 0051D0CC
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D0D8
__vbaStrMove.MSVBVM60 ref: 0051D0E6
__vbaStrFixstr.MSVBVM60(00000007,0051BC7A,00000000), ref: 0051D0F9
__vbaStrMove.MSVBVM60 ref: 0051D107
__vbaStrCat.MSVBVM60(00000000), ref: 0051D10E
__vbaStrMove.MSVBVM60 ref: 0051D11C
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D128
__vbaStrMove.MSVBVM60 ref: 0051D136
__vbaStrFixstr.MSVBVM60(00000008,0051BC6C,00000000), ref: 0051D148
__vbaStrMove.MSVBVM60 ref: 0051D156
__vbaStrCat.MSVBVM60(00000000), ref: 0051D15D
__vbaStrMove.MSVBVM60 ref: 0051D16B
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D177
__vbaStrMove.MSVBVM60 ref: 0051D185
__vbaStrFixstr.MSVBVM60(00000096,0051BC5C,00000000), ref: 0051D19B
__vbaStrMove.MSVBVM60 ref: 0051D1A9
__vbaStrCat.MSVBVM60(00000000), ref: 0051D1B0
__vbaStrMove.MSVBVM60 ref: 0051D1BE
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D1CA
__vbaStrMove.MSVBVM60 ref: 0051D1D8
__vbaStrFixstr.MSVBVM60(0000000F,0051BB30,00000000), ref: 0051D1EB
__vbaStrMove.MSVBVM60 ref: 0051D1F9
__vbaStrCat.MSVBVM60(00000000), ref: 0051D200
__vbaStrMove.MSVBVM60 ref: 0051D20E
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D21A
__vbaStrMove.MSVBVM60 ref: 0051D228
__vbaStrFixstr.MSVBVM60(0000000F,0051BB12,00000000), ref: 0051D23A
__vbaStrMove.MSVBVM60 ref: 0051D248
__vbaStrCat.MSVBVM60(00000000), ref: 0051D24F
__vbaStrMove.MSVBVM60 ref: 0051D25D
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D269
__vbaStrMove.MSVBVM60 ref: 0051D277
__vbaStrFixstr.MSVBVM60(00000003,0051BAF4,00000000), ref: 0051D28A
__vbaStrMove.MSVBVM60 ref: 0051D298
__vbaStrCat.MSVBVM60(00000000), ref: 0051D29F
__vbaStrMove.MSVBVM60 ref: 0051D2AD
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D2B9
__vbaStrMove.MSVBVM60 ref: 0051D2C7
__vbaStrFixstr.MSVBVM60(0000000F,0051BAEE,00000000), ref: 0051D2DA
__vbaStrMove.MSVBVM60 ref: 0051D2E8
__vbaStrCat.MSVBVM60(00000000), ref: 0051D2EF
__vbaStrMove.MSVBVM60 ref: 0051D2FD
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D309
__vbaStrMove.MSVBVM60 ref: 0051D317
__vbaStrFixstr.MSVBVM60(0000000F,0051BAD0,00000000), ref: 0051D329
__vbaStrMove.MSVBVM60 ref: 0051D337
__vbaStrCat.MSVBVM60(00000000), ref: 0051D33E
__vbaStrMove.MSVBVM60 ref: 0051D34C
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D358
__vbaStrMove.MSVBVM60 ref: 0051D366
__vbaStrFixstr.MSVBVM60(00000003,0051BAB2,00000000), ref: 0051D379
__vbaStrMove.MSVBVM60 ref: 0051D387
__vbaStrCat.MSVBVM60(00000000), ref: 0051D38E
__vbaStrMove.MSVBVM60 ref: 0051D39C
__vbaStrCat.MSVBVM60(004147A0,00000000), ref: 0051D3A8
__vbaStrMove.MSVBVM60 ref: 0051D3B6
__vbaStrFixstr.MSVBVM60(000001F4,0051BAAC,00000000), ref: 0051D3CC
__vbaStrMove.MSVBVM60 ref: 0051D3DA
__vbaStrCat.MSVBVM60(00000000), ref: 0051D3E1
__vbaStrMove.MSVBVM60 ref: 0051D3EF
#523.MSVBVM60(00000000), ref: 0051D3F6
__vbaStrMove.MSVBVM60 ref: 0051D401
__vbaFreeStrList.MSVBVM60(00000040,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0051D584

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Fixstr$Lset$Free$List$#616#631$ChkstkCopyError$#523
String ID:
API String ID: 945525799-0
Opcode ID: 0775550fd8e18b0db15a14226309c3da796b439ec366699a3365a6fbfa4f8926
Instruction ID: 952567683e5ed3075df98644d4b89ce4e139df2490f71c3b8917473ad62d5538
Opcode Fuzzy Hash: 0775550fd8e18b0db15a14226309c3da796b439ec366699a3365a6fbfa4f8926
Instruction Fuzzy Hash: 22C24E72900108AFEB04DFA4DD59FEE7B79FF48705F108165FA06B66A0DE349A84CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0052B680 Relevance: 114.1, APIs: 58, Strings: 7, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaOnError.MSVBVM60(?), ref: 0052B6EC
#520.MSVBVM60(?,00004008), ref: 0052B707
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 0052B723
__vbaFreeVar.MSVBVM60 ref: 0052B735
__vbaStrMove.MSVBVM60 ref: 0052B74B
__vbaStrCmp.MSVBVM60(0040BC48), ref: 0052B755
__vbaStrCat.MSVBVM60(00414914), ref: 0052B767
__vbaStrMove.MSVBVM60 ref: 0052B771
__vbaStrCat.MSVBVM60(DISK.DAT,00000000), ref: 0052B783
__vbaStrMove.MSVBVM60 ref: 0052B78E
__vbaFreeStr.MSVBVM60(?), ref: 0052B7A3
#648.MSVBVM60(0000000A), ref: 0052B7C9
__vbaFreeVar.MSVBVM60 ref: 0052B7D5
__vbaStrCat.MSVBVM60(DISK.DAT,00000000), ref: 0052B7F0
__vbaStrMove.MSVBVM60 ref: 0052B7FB
__vbaFreeStr.MSVBVM60(?,00000002,?,00000000), ref: 0052B818
__vbaUbound.MSVBVM60(?,0055102C), ref: 0052B82D
#571.MSVBVM60(?), ref: 0052B83E
__vbaGenerateBoundsError.MSVBVM60(?,?,?), ref: 0052B85A
__vbaLineInputStr.MSVBVM60(?,?), ref: 0052B86A
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 0052B875
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 0052B87C
#519.MSVBVM60(?,?,?), ref: 0052B887
__vbaStrMove.MSVBVM60(?,?,?), ref: 0052B892
__vbaStrCopy.MSVBVM60(?,?,?), ref: 0052B8A2
__vbaFreeStr.MSVBVM60(?,?,?), ref: 0052B8AB
__vbaFileClose.MSVBVM60(?), ref: 0052B8C4

Part of subcall function 00527520: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527565
Part of subcall function 00527520: __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527573
Part of subcall function 00527520: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527587
Part of subcall function 00527520: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527590
Part of subcall function 00527520: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527596

__vbaStrCopy.MSVBVM60 ref: 0052B8E4
__vbaFreeStr.MSVBVM60(?,?), ref: 0052B8FC
__vbaStrCopy.MSVBVM60 ref: 0052B90A
__vbaFreeStr.MSVBVM60(?,?), ref: 0052B922
#524.MSVBVM60(?,00004008), ref: 0052B942
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 0052B95E
__vbaFreeVar.MSVBVM60 ref: 0052B96D
__vbaStrCopy.MSVBVM60 ref: 0052B9A4
__vbaStrCat.MSVBVM60(00414B08,The software cannot run because it is not properly configured.), ref: 0052B9B6
__vbaStrMove.MSVBVM60 ref: 0052B9BD
__vbaStrCat.MSVBVM60(Line 1 of DISK.DAT is blank.,00000000), ref: 0052B9C5
__vbaStrMove.MSVBVM60 ref: 0052B9CC
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,?,FFFFFFFF,0000000A,00000000), ref: 0052B9F8
__vbaFreeVar.MSVBVM60 ref: 0052BA04
__vbaExitProc.MSVBVM60(FFFFFFFF,?), ref: 0052BA22
#524.MSVBVM60(?,00004008), ref: 0052BA4C
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 0052BA68
__vbaFreeVar.MSVBVM60 ref: 0052BA77
__vbaStrCopy.MSVBVM60 ref: 0052BAAE
__vbaStrCat.MSVBVM60(00414B08,The software cannot run because it is not properly configured.), ref: 0052BAC0
__vbaStrMove.MSVBVM60 ref: 0052BAC7
__vbaStrCat.MSVBVM60(Line 15 of DISK.DAT is blank.,00000000), ref: 0052BACF
__vbaStrMove.MSVBVM60 ref: 0052BAD6

Part of subcall function 00526160: __vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000), ref: 005261DB
Part of subcall function 00526160: __vbaObjIs.MSVBVM60(?,00000000), ref: 005261E8
Part of subcall function 00526160: __vbaVargVar.MSVBVM60(?), ref: 00526285

__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,?,FFFFFFFF,0000000A,00000000), ref: 0052BB02
__vbaFreeVar.MSVBVM60 ref: 0052BB0E

Part of subcall function 005266D0: __vbaChkstk.MSVBVM60(FFFFFFFF,004047D6), ref: 005266EE
Part of subcall function 005266D0: __vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000,FFFFFFFF,004047D6), ref: 0052671E
Part of subcall function 005266D0: __vbaExitProc.MSVBVM60 ref: 00527049

__vbaExitProc.MSVBVM60(FFFFFFFF,?), ref: 0052BB2C
__vbaExitProc.MSVBVM60 ref: 0052BB9D
__vbaFreeStr.MSVBVM60(0052BBEF), ref: 0052BBDB
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0052BBE3
__vbaFreeStr.MSVBVM60 ref: 0052BBEC

Strings

Line 15 of DISK.DAT is blank., xrefs: 0052BACA
ImcDataPath, xrefs: 0052B8D6
Error, xrefs: 0052B99C, 0052BAA6
The software cannot run because it is not properly configured., xrefs: 0052B9A6, 0052BAB0
ImcAgencyPath, xrefs: 0052B902
Line 1 of DISK.DAT is blank., xrefs: 0052B9C0
DISK.DAT, xrefs: 0052B77E, 0052B7EB

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$Error$Copy$ExitProc$BoundsGenerate$#524List$#519#520#571#648ChkstkCloseDestructFileInputLineUboundVarg
String ID: DISK.DAT$Error$ImcAgencyPath$ImcDataPath$Line 1 of DISK.DAT is blank.$Line 15 of DISK.DAT is blank.$The software cannot run because it is not properly configured.
API String ID: 1931142790-584961937
Opcode ID: bc266fcd97daf7db9fa72d138fce7cf20aaf038e5b3ccdf8e00205c06f55f07c
Instruction ID: 424e3a63cb12809c885bcc2db0434ef8553c2a9a335b14036732a0c6a3590d83
Opcode Fuzzy Hash: bc266fcd97daf7db9fa72d138fce7cf20aaf038e5b3ccdf8e00205c06f55f07c
Instruction Fuzzy Hash: C3E16B75D00218AFDB14DFA4ED94ADDBBB9FF48300F10822AE516B72A0EB745A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 005266D0 Relevance: 102.0, APIs: 49, Strings: 9, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(FFFFFFFF,004047D6), ref: 005266EE
__vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000,FFFFFFFF,004047D6), ref: 0052671E
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00526782
__vbaHresultCheckObj.MSVBVM60(00000000,?,00414108,00000018), ref: 005267E8
__vbaI2I4.MSVBVM60 ref: 0052680E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,0000007C), ref: 0052684D
__vbaFreeObj.MSVBVM60 ref: 00526868
__vbaObjIs.MSVBVM60(?,00000000), ref: 005268A1
__vbaOnError.MSVBVM60(000000FF), ref: 005268C4
__vbaLateMemCall.MSVBVM60(?,UnregisterExe,00000000), ref: 005268DE
__vbaOnError.MSVBVM60(?), ref: 005268F0
__vbaObjSetAddref.MSVBVM60(0055302C,00000000), ref: 00526911
__vbaExitProc.MSVBVM60 ref: 00527049

Strings

hqU, xrefs: 00526BD4
hqU, xrefs: 00526977
count, xrefs: 005269F6, 00526B16
/, xrefs: 00526F1F
hqU, xrefs: 00526B91
hqU, xrefs: 00526AAB
hqU, xrefs: 0052679E
UnregisterExe, xrefs: 005268D3
hqU, xrefs: 00526D7B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$CheckHresult$AddrefCallChkstkExitFreeLateNew2Proc
String ID: /$UnregisterExe$count$hqU$hqU$hqU$hqU$hqU$hqU
API String ID: 1111643370-4003900328
Opcode ID: c9a1e5eb75760abe89e80682ee4968e1d8542df1afde03c50c2ce52e6f161d12
Instruction ID: c3a582cc0b207b32cb2dac279b9046b08637189422afed3f46ae4553b1f48438
Opcode Fuzzy Hash: c9a1e5eb75760abe89e80682ee4968e1d8542df1afde03c50c2ce52e6f161d12
Instruction Fuzzy Hash: E53205B4900328DFDB24DFA0DD48B9DBBB0BF49305F108199E509BB2A1DBB45A88DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0051BBF0 Relevance: 78.9, APIs: 24, Strings: 21, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0051BC0E
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051BC3E
__vbaLsetFixstr.MSVBVM60(00000003,?,TYP), ref: 0051BC59
__vbaLsetFixstr.MSVBVM60(00000003,?,SYS), ref: 0051BC74
__vbaLsetFixstr.MSVBVM60(00000008,?,DATE), ref: 0051BC8F
__vbaLsetFixstr.MSVBVM60(00000004,?,TIME), ref: 0051BCAA
__vbaLsetFixstr.MSVBVM60(00000032,?,CODE-SOURCE), ref: 0051BCC5
__vbaLsetFixstr.MSVBVM60(00000008,?,DATABASE), ref: 0051BCE0
__vbaLsetFixstr.MSVBVM60(00000003,?,00414988), ref: 0051BCFB
__vbaLsetFixstr.MSVBVM60(0000000A,?,ERR-CODE), ref: 0051BD16
__vbaLsetFixstr.MSVBVM60(00000096,?,ERR-DESC), ref: 0051BD34
__vbaLsetFixstr.MSVBVM60(00000014,?,EXE), ref: 0051BD4F
__vbaLsetFixstr.MSVBVM60(0000000A,?,VER), ref: 0051BD6A
__vbaLsetFixstr.MSVBVM60(0000000F,?,COMP-NAME), ref: 0051BD85
__vbaLsetFixstr.MSVBVM60(00000007,?,OFFICER), ref: 0051BDA0
__vbaLsetFixstr.MSVBVM60(00000008,?,AGENCY), ref: 0051BDBB
__vbaLsetFixstr.MSVBVM60(00000096,?,ERR-SOURCE), ref: 0051BDD9
__vbaLsetFixstr.MSVBVM60(0000000F,?,M-ACTIVE-FORM), ref: 0051BDF4
__vbaLsetFixstr.MSVBVM60(0000000F,?,M-ACTIVE-CTRL), ref: 0051BE0F
__vbaLsetFixstr.MSVBVM60(00000003,?,MIX), ref: 0051BE2A
__vbaLsetFixstr.MSVBVM60(0000000F,?,S-ACTIVE-FORM), ref: 0051BE45
__vbaLsetFixstr.MSVBVM60(0000000F,?,S-ACTIVE-CTRL), ref: 0051BE60
__vbaLsetFixstr.MSVBVM60(00000003,?,SIX), ref: 0051BE7B
__vbaLsetFixstr.MSVBVM60(000001F4,?,SPECIAL-MSG), ref: 0051BE99

Part of subcall function 0051C330: __vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,0051BEB2,?), ref: 0051C34E
Part of subcall function 0051C330: __vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051C37E
Part of subcall function 0051C330: __vbaStrFixstr.MSVBVM60(00000003,0051BEB2), ref: 0051C391
Part of subcall function 0051C330: __vbaStrMove.MSVBVM60 ref: 0051C39C
Part of subcall function 0051C330: __vbaStrMove.MSVBVM60(?), ref: 0051C3B0
Part of subcall function 0051C330: __vbaLsetFixstr.MSVBVM60(00000003,0051BEB2,?), ref: 0051C3C0
Part of subcall function 0051C330: __vbaLsetFixstr.MSVBVM60(00000003,0051BEB2,?), ref: 0051C3D0
Part of subcall function 0051C330: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C3E0
Part of subcall function 0051C330: __vbaStrFixstr.MSVBVM60(00000003,0051BEAC), ref: 0051C3F9
Part of subcall function 0051C330: __vbaStrMove.MSVBVM60 ref: 0051C404
Part of subcall function 0051C330: __vbaStrMove.MSVBVM60(?), ref: 0051C418
Part of subcall function 0051C330: __vbaLsetFixstr.MSVBVM60(00000003,0051BEAC,?), ref: 0051C42B
Part of subcall function 0051C330: __vbaLsetFixstr.MSVBVM60(00000003,0051BEAC,?), ref: 0051C43E
Part of subcall function 0051C330: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C44E
Part of subcall function 0051C330: __vbaStrFixstr.MSVBVM60(00000008,0051BEA6), ref: 0051C467
Part of subcall function 0051C330: __vbaStrMove.MSVBVM60 ref: 0051C472

Strings

SYS, xrefs: 0051BC66
ERR-DESC, xrefs: 0051BD23
M-ACTIVE-CTRL, xrefs: 0051BE01
TYP, xrefs: 0051BC4B
EXE, xrefs: 0051BD41
OFFICER, xrefs: 0051BD92
CODE-SOURCE, xrefs: 0051BCB7
ERR-SOURCE, xrefs: 0051BDC8
S-ACTIVE-FORM, xrefs: 0051BE37
DATABASE, xrefs: 0051BCD2
M-ACTIVE-FORM, xrefs: 0051BDE6
S-ACTIVE-CTRL, xrefs: 0051BE52
COMP-NAME, xrefs: 0051BD77
TIME, xrefs: 0051BC9C
VER, xrefs: 0051BD5C
MIX, xrefs: 0051BE1C
AGENCY, xrefs: 0051BDAD
SPECIAL-MSG, xrefs: 0051BE88
DATE, xrefs: 0051BC81
ERR-CODE, xrefs: 0051BD08
SIX, xrefs: 0051BE6D

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Fixstr$Lset$Move$ChkstkErrorFreeList
String ID: AGENCY$CODE-SOURCE$COMP-NAME$DATABASE$DATE$ERR-CODE$ERR-DESC$ERR-SOURCE$EXE$M-ACTIVE-CTRL$M-ACTIVE-FORM$MIX$OFFICER$S-ACTIVE-CTRL$S-ACTIVE-FORM$SIX$SPECIAL-MSG$SYS$TIME$TYP$VER
API String ID: 3570210076-827831168
Opcode ID: 1ae7e4b967f86855b1d7521471294b36ced41a113192c819176fb0f3dc5ee04d
Instruction ID: 95e96914b928a768fea75ce9f4f7d5189b5a2e7fc32464ba6c61f8be80de4ec5
Opcode Fuzzy Hash: 1ae7e4b967f86855b1d7521471294b36ced41a113192c819176fb0f3dc5ee04d
Instruction Fuzzy Hash: 52613FB4940248EFE710CF90CE09BEEB7B8EF48701F51809AB544761D0D7B81B889F69

Uniqueness

Uniqueness Score: -1.00%

Function 00524730 Relevance: 73.8, APIs: 39, Strings: 3, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,0051FF91,?,?), ref: 0052474E
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000000,00000000,00000000,004047D6), ref: 0052477E
__vbaGenerateBoundsError.MSVBVM60 ref: 005247B7
__vbaStrCat.MSVBVM60(ImcSys.log,00000000), ref: 005247D2
__vbaStrMove.MSVBVM60 ref: 005247DD
__vbaFreeStr.MSVBVM60(?), ref: 005247F3
__vbaStrCat.MSVBVM60(ImcSys.log), ref: 0052483D
__vbaStrMove.MSVBVM60 ref: 00524848
#578.MSVBVM60(00000000), ref: 0052484F
__vbaFreeStr.MSVBVM60 ref: 0052485B
__vbaStrCat.MSVBVM60(ImcSys.log), ref: 005248CC
__vbaStrMove.MSVBVM60 ref: 005248D7
__vbaFreeStr.MSVBVM60(?), ref: 005248ED
__vbaStrCat.MSVBVM60(ImcSys.log), ref: 0052493C
__vbaStrMove.MSVBVM60 ref: 00524947
#578.MSVBVM60(00000000), ref: 0052494E
__vbaFreeStr.MSVBVM60 ref: 0052495A
__vbaStrI4.MSVBVM60(00100000), ref: 0052496C
__vbaStrMove.MSVBVM60 ref: 00524977
#581.MSVBVM60(00000000), ref: 0052497E
__vbaFpR8.MSVBVM60 ref: 005249A3
__vbaFreeStr.MSVBVM60 ref: 005249DB
__vbaStrCat.MSVBVM60(ImcSys.log,00000000), ref: 00524A33
__vbaStrMove.MSVBVM60 ref: 00524A3E

Strings

3, xrefs: 00524AB0
3, xrefs: 00524813
ImcSys.log, xrefs: 00523539, 0052394C, 00524297, 005244B7, 005246AC, 005247CD, 00524838, 005248C7, 00524937, 00524A2E, 00524ADB

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$#578Error$#581BoundsChkstkGenerate
String ID: 3$3$ImcSys.log
API String ID: 3561748374-19894349
Opcode ID: c551493747740c53413eee971eb3fde01eed50a980374c1edcebd3ad87de7a6b
Instruction ID: 7503f2a848ce70b3bd41c2c7d6b8ad2cd4aef9ac8596d57ed3f5009b732dd965
Opcode Fuzzy Hash: c551493747740c53413eee971eb3fde01eed50a980374c1edcebd3ad87de7a6b
Instruction Fuzzy Hash: FDC12374D00258DFEB10DFE4E958BEEBBB0BF09705F10816AE806B62A5DB744989CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00526160 Relevance: 56.4, APIs: 31, Strings: 1, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000), ref: 005261DB
__vbaObjIs.MSVBVM60(?,00000000), ref: 005261E8
__vbaVargVar.MSVBVM60(?), ref: 00526285
__vbaLateMemCallLd.MSVBVM60(?,?,DisplayNonModalText,00000005), ref: 005262D9
__vbaVarTstEq.MSVBVM60(0000800B,00000000), ref: 005262EA
__vbaFreeVar.MSVBVM60 ref: 005262F6
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 0052631F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018), ref: 0052634E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000068), ref: 00526376
__vbaObjIs.MSVBVM60(?,00000000), ref: 0052637E
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00526393
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 005263B8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018), ref: 005263D9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000068), ref: 005263F9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415318,00000058), ref: 0052641C
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00526434
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00526450
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000014), ref: 00526471
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F7B8,00000100), ref: 0052649A
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 005264AF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000014), ref: 005264D0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F7B8,00000128), ref: 005264F9
__vbaSetSystemError.MSVBVM60(00000005,00525F50,?,?), ref: 00526517
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0052652D
#595.MSVBVM60(?,00000030,?,?,?), ref: 0052658A
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052659A
__vbaExitProc.MSVBVM60 ref: 005265A3
#595.MSVBVM60(?,00000000,?,?,?), ref: 005265DC
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 005265EC
__vbaExitProc.MSVBVM60 ref: 005265F5
__vbaExitProc.MSVBVM60 ref: 0052666C

Strings

DisplayNonModalText, xrefs: 005262C9

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$Free$List$New2$ExitProc$#595Error$CallLateSystemVarg
String ID: DisplayNonModalText
API String ID: 3676850473-196655094
Opcode ID: f8906d164898a74c9cd91a98c9111da23f3b7f1882c52543d5e80ac6deccdcb1
Instruction ID: 8b748aa15138b4d79b8c6b5120d593ea8414c838bab9bb92f5c150547a61c10e
Opcode Fuzzy Hash: f8906d164898a74c9cd91a98c9111da23f3b7f1882c52543d5e80ac6deccdcb1
Instruction Fuzzy Hash: DBE16FB1E00318AFDB14DFA9DC48EDEBBB8FF59700F10805AE549A72A0D6709945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00527640 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527685
#519.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527691
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005276A2
#618.MSVBVM60(?,?), ref: 005276AA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005276B5
__vbaStrCmp.MSVBVM60(00414914,00000000), ref: 005276BD
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005276CF
__vbaLenBstr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005276DE
#616.MSVBVM60(?,-00000001), ref: 005276F2
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005276FD
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527707
__vbaFreeStr.MSVBVM60(?,?), ref: 0052771D
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527723
__vbaFreeStr.MSVBVM60(005277B0,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005277A9
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005277C3

Strings

ImcExeRunningPath, xrefs: 005276FF

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FreeMove$Error$#519#616#618BstrCopyExitOverflowProc
String ID: ImcExeRunningPath
API String ID: 3659068610-4023986263
Opcode ID: f53951afdff4e4215ae3abcc291396371cc263d0d7f52d0c77b43ac0c1b39ea2
Instruction ID: 447a8292dfee5e1e2218b8cf786c4147d31d3fc7c16260688dea31052d4259a6
Opcode Fuzzy Hash: f53951afdff4e4215ae3abcc291396371cc263d0d7f52d0c77b43ac0c1b39ea2
Instruction Fuzzy Hash: 10310675D002189FDB04EFA5DE889DEBBB4FB4C700B504169E902B26A0DB745940CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0051B6C0 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#525.MSVBVM60(00000090,?,?,?,?,?,?,?,004047D6), ref: 0051B6F9
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,004047D6), ref: 0051B70A
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B714
__vbaSetSystemError.MSVBVM60(00000090,00000000,?,?,?,?,?,?,?,004047D6), ref: 0051B725
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B733
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,004047D6), ref: 0051B742
#537.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B74B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,004047D6), ref: 0051B756
__vbaInStr.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,004047D6), ref: 0051B75A
#616.MSVBVM60(?,-00000001,?,?,?,?,?,?,?,004047D6), ref: 0051B76A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,004047D6), ref: 0051B775
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,004047D6), ref: 0051B77A
__vbaFreeStr.MSVBVM60(0051B7A6,?,?,?,?,?,?,?,004047D6), ref: 0051B79F
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,004047D6), ref: 0051B7BA

Strings

Error getting computer name., xrefs: 0051BAC3

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FreeMove$Error$#525#537#616AnsiOverflowSystemUnicode
String ID: Error getting computer name.
API String ID: 4276083408-1192257712
Opcode ID: 30da17a24e79aa410f8fa079616cd84a0099588f089608498b8fe20079cd4244
Instruction ID: 7167d61fb25f2953b7f2ff4ce946e62940f8b60c9d5db4a262fd546710a6428b
Opcode Fuzzy Hash: 30da17a24e79aa410f8fa079616cd84a0099588f089608498b8fe20079cd4244
Instruction Fuzzy Hash: 6521EAB5D00209AFDB04AFA5DD89DEFBB78FB48701F104169E902B22B0DB785945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00525E40 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#648.MSVBVM60(?,6D02D8B1,00000000,00000000), ref: 00525E83
__vbaFreeVar.MSVBVM60 ref: 00525E8E
__vbaStrCat.MSVBVM60(ImcSys.log,?), ref: 00525EA3
__vbaStrMove.MSVBVM60 ref: 00525EB4
__vbaFileOpen.MSVBVM60(00002002,000000FF,00000000,00000000), ref: 00525EBF
__vbaFreeStr.MSVBVM60 ref: 00525EC8

Part of subcall function 0051BBF0: __vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0051BC0E
Part of subcall function 0051BBF0: __vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051BC3E
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000003,?,TYP), ref: 0051BC59
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000003,?,SYS), ref: 0051BC74
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000008,?,DATE), ref: 0051BC8F
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000004,?,TIME), ref: 0051BCAA
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000032,?,CODE-SOURCE), ref: 0051BCC5
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000008,?,DATABASE), ref: 0051BCE0
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000003,?,00414988), ref: 0051BCFB
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(0000000A,?,ERR-CODE), ref: 0051BD16
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000096,?,ERR-DESC), ref: 0051BD34
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000014,?,EXE), ref: 0051BD4F
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(0000000A,?,VER), ref: 0051BD6A
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(0000000F,?,COMP-NAME), ref: 0051BD85
Part of subcall function 0051BBF0: __vbaLsetFixstr.MSVBVM60(00000007,?,OFFICER), ref: 0051BDA0

__vbaStrMove.MSVBVM60 ref: 00525ED8
__vbaStrMove.MSVBVM60 ref: 00525EE3
__vbaPrintFile.MSVBVM60(0041AC28,00000000,00000000), ref: 00525EEC
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00525EFC
__vbaFileClose.MSVBVM60(00000000), ref: 00525F06

Strings

ImcSys.log, xrefs: 00525E9E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FixstrLset$FileFreeMove$#648ChkstkCloseErrorListOpenPrint
String ID: ImcSys.log
API String ID: 1152521978-3265059153
Opcode ID: 552bd2eca14882f38e650c914fa32863fab47e5ba07d7092491b43d71728342c
Instruction ID: 895f45a5272b9dfb5936edd5ee02752f48eb9813fd3e1a14cfa569f808620e44
Opcode Fuzzy Hash: 552bd2eca14882f38e650c914fa32863fab47e5ba07d7092491b43d71728342c
Instruction Fuzzy Hash: 5D214274D0024AAFDB00EFA5DD89AEFBB78FF54701F108129E905B22A1DB741946CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0054FA10 Relevance: 16.6, APIs: 11, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054FA2E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054FA75
__vbaNew.MSVBVM60(00426080,?,?,?,?,004047D6), ref: 0054FA87
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,004047D6), ref: 0054FA92
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,0000005C), ref: 0054FABF
__vbaFreeObj.MSVBVM60 ref: 0054FAD4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054FB0B
__vbaObjSet.MSVBVM60(?,?), ref: 0054FB32
__vbaFreeObj.MSVBVM60(?), ref: 0054FB44
#594.MSVBVM60(0000000A), ref: 0054FB63
__vbaFreeVar.MSVBVM60 ref: 0054FB6C

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CheckHresult$#594ChkstkError
String ID:
API String ID: 2240823095-0
Opcode ID: 20a55fc976f9417160834bbad8f3fafdaeda544b9dbfc36dad6e363c83ad7eaf
Instruction ID: 560b2d56109d3da7dd099a4cf72cce05a3ec767925e1512acffde23902d55ae4
Opcode Fuzzy Hash: 20a55fc976f9417160834bbad8f3fafdaeda544b9dbfc36dad6e363c83ad7eaf
Instruction Fuzzy Hash: BE41C4B5900208EFDB04DF94D999BDEBBB4FB48345F108519F616AB2A0C7789A44CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0052CD70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaNew.MSVBVM60(00405474,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CDB2
__vbaObjSet.MSVBVM60(?,00000000), ref: 0052CDBD
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CDD9
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F5EC,0000001C), ref: 0052CE21
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CE2A
__vbaFreeObj.MSVBVM60(0052CE55), ref: 0052CE4E

Strings

INV, xrefs: 0052CDC6

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CheckCopyHresult
String ID: INV
API String ID: 4185434182-1828256023
Opcode ID: 3a89fad3c893467546c932d8b73bfc7b3eefe0d82b56d62b0679611975e771f1
Instruction ID: 1475ba36c587c30c372f9fa4fc0856bc2e0d86bc348cc63fb027c3cdb3c26f50
Opcode Fuzzy Hash: 3a89fad3c893467546c932d8b73bfc7b3eefe0d82b56d62b0679611975e771f1
Instruction Fuzzy Hash: 82211DB5D10259ABCB00DF98DA899DEFFB9FB48B00F20421AF501B7291C7745A45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00405623 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaOnError.MSVBVM60(?), ref: 00535379
__vbaNew.MSVBVM60(00406E50), ref: 00535386
__vbaObjSet.MSVBVM60(?,00000000), ref: 00535391
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F5EC,00000034), ref: 005353AB
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005353B4
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00535411

Strings

3, xrefs: 00405623

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckErrorExitFreeHresultProc
String ID: 3
API String ID: 2741090734-1842515611
Opcode ID: 9092c98f16b7777dd2cd549f57e404ca0bd54f8c6dc022dce59273f3fb6ff5c6
Instruction ID: fb209d8a6f48e7821a78a22f79796a2dcadd4ddf98a18dc45ff24c100bce6fae
Opcode Fuzzy Hash: 9092c98f16b7777dd2cd549f57e404ca0bd54f8c6dc022dce59273f3fb6ff5c6
Instruction Fuzzy Hash: B4115975901614ABCB009F99CE49ADEFFB8FF58701F10851AF941B62A1D3B45580CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00544490 Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005444E9
__vbaNew.MSVBVM60(00407954,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005444F4
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005444FF
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054450A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544513
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544570

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AddrefErrorExitFreeProc
String ID:
API String ID: 252618299-0
Opcode ID: a1fc1e4dd0da39eca35c57ae8029b530904458c4875be2abd22b0ba8aa22c6ea
Instruction ID: 16bebf3fb1a5aa3ac89ca21eeb676fcab145131f0cafdab34ae7a8ab6a077bf8
Opcode Fuzzy Hash: a1fc1e4dd0da39eca35c57ae8029b530904458c4875be2abd22b0ba8aa22c6ea
Instruction Fuzzy Hash: BF112EB5C40218ABCB009F99CD49ACEFFB8FF58711F10811AF941B6260D7B455418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0054BCA0 Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BCF9
__vbaNew.MSVBVM60(00406410,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BD04
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BD0F
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BD1A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BD23
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BD80

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AddrefErrorExitFreeProc
String ID:
API String ID: 252618299-0
Opcode ID: 945342ff78015d871e93a8bae896d8c82bda9352a9459146320da2b9bcfe8c83
Instruction ID: 29a6a0d4f80e702d17446d1d7f6cad855e2984d2e891c009483c1fe1d27d34c5
Opcode Fuzzy Hash: 945342ff78015d871e93a8bae896d8c82bda9352a9459146320da2b9bcfe8c83
Instruction Fuzzy Hash: 58112EB5C40218ABCB009F99CD49ACEFFB8FF98715F14815AF911B6260C7B455418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0052ACA0 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
__vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
__vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
__vbaFreeStr.MSVBVM60 ref: 0052ACFC

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: 44bf7bcdb13d802bb979e39abe8fbfb7f632b3d9eea12435b44bef7614ec8d66
Instruction ID: 31b0686e1e25281a8a776d13cd85141e31c2fc7071c362763e2cc1acae738801
Opcode Fuzzy Hash: 44bf7bcdb13d802bb979e39abe8fbfb7f632b3d9eea12435b44bef7614ec8d66
Instruction Fuzzy Hash: 050181B5800209EFCB00AFA4CD49AAFBBB8FF04711F104529F802A35E0E73899458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00404DB8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00404DBD

Strings

VB5!6&*, xrefs: 00404DB8

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: a531ee9169f3db11fbc456b06d2c33264ef72c517d43612c1214aebbab3467bb
Instruction ID: 46bc6dac491277d79a626957c295bdc4d4b684d336b170fdd6c536ae5222f74e
Opcode Fuzzy Hash: a531ee9169f3db11fbc456b06d2c33264ef72c517d43612c1214aebbab3467bb
Instruction Fuzzy Hash: 8D010C9244E7C18FD703AB3098266413FB54E63214B2A44DBC080CF0E3D26D481AC767

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00537C30 Relevance: 637.8, APIs: 324, Strings: 39, Instructions: 2586COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00537C78
#618.MSVBVM60(00000000,00000003), ref: 00537C86
__vbaStrMove.MSVBVM60 ref: 00537C97
#527.MSVBVM60(00000000), ref: 00537C9A
__vbaStrMove.MSVBVM60 ref: 00537CA5
__vbaStrCmp.MSVBVM60(EXE,00000000), ref: 00537CAD
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00537CC6
__vbaStrCat.MSVBVM60 ref: 00537CE1
__vbaFreeStr.MSVBVM60(?), ref: 00537D06
__vbaStrCat.MSVBVM60(00000000), ref: 00537D24
__vbaStrMove.MSVBVM60 ref: 00537D2B
__vbaStrCat.MSVBVM60( /unregserver,00000000), ref: 00537D33
#600.MSVBVM60(00000008,00000002), ref: 00537D45
__vbaFreeStr.MSVBVM60 ref: 00537D50
__vbaFreeVar.MSVBVM60 ref: 00537D59
#598.MSVBVM60 ref: 00537D75
__vbaSetSystemError.MSVBVM60(0000000A), ref: 00537D82
__vbaStrMove.MSVBVM60 ref: 00537DB5
__vbaFreeStr.MSVBVM60 ref: 00537DD4
__vbaExitProc.MSVBVM60(?,00000000), ref: 00537E32
__vbaStrMove.MSVBVM60 ref: 00537CEC

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaStrCat.MSVBVM60(?,00000000), ref: 00537E4C
__vbaStrMove.MSVBVM60(?,00000000), ref: 00537E57
__vbaFreeStr.MSVBVM60(?,?,00000000), ref: 00537E71
__vbaStrMove.MSVBVM60(?,00000000), ref: 00537EB3
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00537ED2
__vbaErrorOverflow.MSVBVM60 ref: 00537F86
__vbaOnError.MSVBVM60(?), ref: 00537FEA
__vbaStrCopy.MSVBVM60 ref: 00538010
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,000000DC), ref: 00538035
__vbaStrCat.MSVBVM60(?,Remove ActiveX Library||), ref: 0053804F
__vbaStrMove.MSVBVM60(?,Remove ActiveX Library||), ref: 0053805C
__vbaStrCat.MSVBVM60(00414AE0,00000000,?,Remove ActiveX Library||), ref: 00538064
__vbaStrMove.MSVBVM60(?,Remove ActiveX Library||), ref: 0053806B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00421E50,00000714,?,Remove ActiveX Library||), ref: 00538090
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,Remove ActiveX Library||), ref: 005380A3
__vbaFreeObj.MSVBVM60 ref: 005380AF

Strings

EXE, xrefs: 00537CA8
/unregserver, xrefs: 00537D2E
?|?, xrefs: 00539782
The client on this workstation is currently being updated by another process. Please wait until the client is done updating and t, xrefs: 00539BEB
AutoUpdate: Old VB6 General Service detected via TCP/IP, xrefs: 00539C5D
Failed, xrefs: 00538184
AutoUpdate: Old VB6 General Service detected via DDE, xrefs: 00539D46
Direct Update, xrefs: 00538DA2
Imc General Service 4.6, xrefs: 00539CE0
AutoUpdate: Unable to send message to service to remove , xrefs: 0053824C
AutoUpdate: Failed sending message via TCP/IP to General Service, xrefs: 0053992E
Remove ActiveX Library||, xrefs: 0053803E
\0\Win32, xrefs: 005386CB
AutoUpdate: General Service reported invalid protocol version: , xrefs: 00539890
for , xrefs: 00538973
CcwAssemblies\, xrefs: 0053906B, 005390FB, 005391D8
AutoUpdate: Old VB6 General Service not available via DDE, xrefs: 00539D61
AutoUpdate: Old VB6 General Service not available on TCP/IP port , xrefs: 00539B61
AutoUpdate: New .NET general service must be installed to remove , xrefs: 00538279
Service Update, xrefs: 00538D9B
AutoUpdate: Timed-out waiting for response from service while removing , xrefs: 00538151
AutoUpdate: Unable to remove , xrefs: 00538919
Removing auto-updating client, xrefs: 00538C7F
\IMC\CcwAssemblies, xrefs: 00538E3F
DllUnregisterServer, xrefs: 00539E8A
while trying to unregister , xrefs: 00539F4F
AutoUpdate: New .NET General Service detected using protocol version , xrefs: 00539852
Succeeded, xrefs: 0053811E
. Service responded with message: , xrefs: 005381F0
- , xrefs: 00538994
HKEY_CLASSES_ROOT\TypeLib\, xrefs: 00538502, 005386A6, 0053884E, 0053891E
HKEY_CLASSES_ROOT\TypeLib, xrefs: 0053845B
. See the windows application event log for details., xrefs: 005381AD, 0053820C
Updating Client, xrefs: 00539BDB
Dll Error , xrefs: 00539F22
AutoUpdate: New .NET General Service not available on TCP/IP port , xrefs: 00539991
&, xrefs: 00538E21
@.@, xrefs: 005392AA, 005393D9, 005392AD, 005393DC
AutoUpdate: Service Failed to remove , xrefs: 00538196

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$Error$CheckHresultListSystem$#527#598#600#618AnsiCopyExitOverflowProcUnicode
String ID: - $ /unregserver$ for $ while trying to unregister $&$. See the windows application event log for details.$. Service responded with message: $?|?$@.@$AutoUpdate: Failed sending message via TCP/IP to General Service$AutoUpdate: General Service reported invalid protocol version: $AutoUpdate: New .NET General Service detected using protocol version $AutoUpdate: New .NET General Service not available on TCP/IP port $AutoUpdate: New .NET general service must be installed to remove $AutoUpdate: Old VB6 General Service detected via DDE$AutoUpdate: Old VB6 General Service detected via TCP/IP$AutoUpdate: Old VB6 General Service not available on TCP/IP port $AutoUpdate: Old VB6 General Service not available via DDE$AutoUpdate: Service Failed to remove $AutoUpdate: Timed-out waiting for response from service while removing $AutoUpdate: Unable to remove $AutoUpdate: Unable to send message to service to remove $CcwAssemblies\$Direct Update$Dll Error $DllUnregisterServer$EXE$Failed$HKEY_CLASSES_ROOT\TypeLib$HKEY_CLASSES_ROOT\TypeLib\$Imc General Service 4.6$Remove ActiveX Library||$Removing auto-updating client$Service Update$Succeeded$The client on this workstation is currently being updated by another process. Please wait until the client is done updating and t$Updating Client$\0\Win32$\IMC\CcwAssemblies
API String ID: 3791633879-1781512421
Opcode ID: 4f6394bea90bc49d1d2e694fa58b2f0ea9679e112289213955c795a9258df10c
Instruction ID: 991e94e06109d9c88ec84c298575ca90243ec90324f5cc223ff79b84daedee8e
Opcode Fuzzy Hash: 4f6394bea90bc49d1d2e694fa58b2f0ea9679e112289213955c795a9258df10c
Instruction Fuzzy Hash: 6D231BB1900219AFDB14DFA4DD88EEEBBB8FF48700F10856AE506B7290DB745A45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00522670 Relevance: 386.0, APIs: 215, Strings: 5, Instructions: 1005COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6,?,?,?,?,?), ref: 0052268E
__vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000,?,004047D6), ref: 00522741
__vbaStrCat.MSVBVM60(.exe), ref: 00522758
__vbaStrMove.MSVBVM60 ref: 00522768

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStr.MSVBVM60(?), ref: 00522787
__vbaStrCopy.MSVBVM60 ref: 005227C7

Part of subcall function 00526160: __vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000), ref: 005261DB
Part of subcall function 00526160: __vbaObjIs.MSVBVM60(?,00000000), ref: 005261E8
Part of subcall function 00526160: __vbaVargVar.MSVBVM60(?), ref: 00526285

__vbaFreeStr.MSVBVM60(?,?,FFFFFFFF,0000000A,?), ref: 005227F8
__vbaFreeVar.MSVBVM60 ref: 00522804
__vbaExitProc.MSVBVM60 ref: 0052280A
__vbaLenBstr.MSVBVM60(00000000), ref: 00522824
__vbaI2I4.MSVBVM60 ref: 0052282C
#631.MSVBVM60(00000002,?,00000002,0041AAE4,00000001), ref: 0052286A
__vbaStrMove.MSVBVM60(?,00000002,0041AAE4,00000001), ref: 00522878
__vbaInStr.MSVBVM60(00000000,00000000,?,00000002,0041AAE4,00000001), ref: 0052287D
__vbaFreeStr.MSVBVM60(?,00000002,0041AAE4,00000001), ref: 00522893
__vbaFreeVar.MSVBVM60(?,00000002,0041AAE4,00000001), ref: 0052289F
#616.MSVBVM60(?,?), ref: 005228DB
__vbaStrMove.MSVBVM60(?,?), ref: 005228E6
__vbaStrCopy.MSVBVM60(?,?), ref: 005228F9
__vbaStrCopy.MSVBVM60(?,?), ref: 00522903
__vbaInStr.MSVBVM60(00000000,0041AAF0,?,?,?,?), ref: 00522918
__vbaInStr.MSVBVM60(00000000,0041AAF0,?,?,?,?), ref: 0052292F
#616.MSVBVM60(?,00000000,?,?), ref: 00522936
__vbaStrMove.MSVBVM60(?,?), ref: 00522944
#523.MSVBVM60(00000000,?,?), ref: 00522947
__vbaStrMove.MSVBVM60(?,?), ref: 00522955
__vbaFreeStr.MSVBVM60(?,?), ref: 0052295D
__vbaFreeStr.MSVBVM60(005233ED), ref: 005233D0
__vbaFreeStr.MSVBVM60 ref: 005233D5
__vbaFreeStr.MSVBVM60 ref: 005233DA
__vbaFreeStr.MSVBVM60 ref: 005233E2
__vbaFreeStr.MSVBVM60 ref: 005233EA

Strings

Module not available., xrefs: 005227BC
.exe, xrefs: 0052274D
.EXE X, xrefs: 00523175
3, xrefs: 005234DE
ImcSys.log, xrefs: 00523539

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$CopyError$#616$#523#631AnsiBstrChkstkExitProcSystemUnicodeVarg
String ID: .EXE X$.exe$3$ImcSys.log$Module not available.
API String ID: 2408642460-2117509847
Opcode ID: 9aab2e6e52f5de1f6641a3e7d912c6603e425230add08e18486e8519dedf1354
Instruction ID: ccab2978b6a9e8c791b6aecf0a19e01247faa355ff44912277c875d041e25cb9
Opcode Fuzzy Hash: 9aab2e6e52f5de1f6641a3e7d912c6603e425230add08e18486e8519dedf1354
Instruction Fuzzy Hash: F8922E75D00628DFDB24DB65DD98ADEBBB4BF88301F0041EAE50BA61A0EF705A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00547B90 Relevance: 96.8, APIs: 54, Strings: 1, Instructions: 557COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00547C25
__vbaNew.MSVBVM60(00421AB8), ref: 00547C30
__vbaObjSet.MSVBVM60(?,00000000), ref: 00547C3B
#525.MSVBVM60(000000FF), ref: 00547CC3
__vbaStrMove.MSVBVM60 ref: 00547CCE
__vbaLenBstr.MSVBVM60(?), ref: 00547CE0
__vbaStrToAnsi.MSVBVM60(?,?,?,00000000,?,00000000,?), ref: 00547D0B
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 00547D21
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00547D2F
__vbaFreeStr.MSVBVM60 ref: 00547D44
#519.MSVBVM60(?), ref: 00547D57
__vbaStrMove.MSVBVM60 ref: 00547D62
__vbaLenBstr.MSVBVM60(?), ref: 00547D68
#616.MSVBVM60(?,-00000001), ref: 00547D7C
__vbaStrMove.MSVBVM60 ref: 00547D87
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,00000020), ref: 00547DE3
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 00547DF7
__vbaObjSetAddref.MSVBVM60(?,?), ref: 00547E29
__vbaExitProc.MSVBVM60 ref: 00547E98
__vbaFreeObj.MSVBVM60(00547EFB), ref: 00547EDF
__vbaFreeStr.MSVBVM60 ref: 00547EEE
__vbaFreeStr.MSVBVM60 ref: 00547EF3
__vbaFreeStr.MSVBVM60 ref: 00547EF8
__vbaErrorOverflow.MSVBVM60 ref: 00547F22
__vbaOnError.MSVBVM60(?), ref: 00547FB9
__vbaNew.MSVBVM60(00421AB8), ref: 00547FC4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00547FCF
#525.MSVBVM60(000000FF), ref: 0054805D

Strings

0?@, xrefs: 00547C1E, 00547FB2

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Error$Move$#525Bstr$#519#616AddrefAnsiCheckExitHresultListOverflowProcSystemUnicode
String ID: 0?@
API String ID: 478128388-4113061678
Opcode ID: 3dbf46d50345ef703a2ad2f363a33b174b35b25a43e488475e0395d7ff14257c
Instruction ID: 91bb374fbd10d0a9703e10c3e4308e914e6eba1f29ce0b944c79d0eef3d970f4
Opcode Fuzzy Hash: 3dbf46d50345ef703a2ad2f363a33b174b35b25a43e488475e0395d7ff14257c
Instruction Fuzzy Hash: 1432D5B1D00218AFDB14DF95DD84ADEFBB9FF98700F10865AE506A7260DB705A44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00545930 Relevance: 96.5, APIs: 64, Instructions: 507COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054599F
__vbaObjSet.MSVBVM60(?,00000000), ref: 005459CD
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 005459D4
__vbaI2Var.MSVBVM60(00000000), ref: 005459DE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545A01
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545A08
__vbaI2Var.MSVBVM60(00000000), ref: 00545A12
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00545A2C
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00545A3C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545A83
__vbaLateIdSt.MSVBVM60(00000000), ref: 00545A86
__vbaFreeObj.MSVBVM60 ref: 00545A95
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545AC4
__vbaLateIdSt.MSVBVM60(00000000), ref: 00545AC7
__vbaFreeObj.MSVBVM60 ref: 00545AD0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545B28
__vbaLateIdCall.MSVBVM60(00000000), ref: 00545B2B
__vbaFreeObj.MSVBVM60 ref: 00545B37
#598.MSVBVM60 ref: 00545B4B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545B63
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545B6A
__vbaI2Var.MSVBVM60(00000000), ref: 00545B74
__vbaFreeObj.MSVBVM60 ref: 00545B8E
__vbaFreeVar.MSVBVM60 ref: 00545B93
__vbaSetSystemError.MSVBVM60(?), ref: 00545BAA
#598.MSVBVM60 ref: 00545BE9
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545C01
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545C08
__vbaI2Var.MSVBVM60(00000000), ref: 00545C12
__vbaFreeObj.MSVBVM60 ref: 00545C30
__vbaFreeVar.MSVBVM60 ref: 00545C35
__vbaSetSystemError.MSVBVM60(?), ref: 00545C4C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545C7B
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545C82
__vbaI2Var.MSVBVM60(00000000), ref: 00545C8C
__vbaFreeObj.MSVBVM60 ref: 00545CAA
__vbaFreeVar.MSVBVM60 ref: 00545CAF
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545CE2
__vbaLateIdCall.MSVBVM60(00000000), ref: 00545CE5
__vbaFreeObj.MSVBVM60 ref: 00545CF1
__vbaExitProc.MSVBVM60 ref: 00545D96
__vbaErrorOverflow.MSVBVM60 ref: 00545DFF
__vbaOnError.MSVBVM60(?), ref: 00545E6D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545E9D
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545EA4
__vbaI2Var.MSVBVM60(00000000), ref: 00545EAE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545ED1
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545ED8
__vbaI2Var.MSVBVM60(00000000), ref: 00545EE2
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00545EFC

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Late$Call$Error$List$#598System$ExitOverflowProc
String ID:
API String ID: 2131994827-0
Opcode ID: 3d86218dbecbd360f291fd1d99eb816198088fa10f245a677039a879bb231986
Instruction ID: 73e5537ac7fc7ea72844a567217e710dca763a5fb65c937de64b1a2ea8d66c5e
Opcode Fuzzy Hash: 3d86218dbecbd360f291fd1d99eb816198088fa10f245a677039a879bb231986
Instruction Fuzzy Hash: 1B126CB1D00208ABDB14EFA4CD49AEEFBB8FF48300F10856AE546AB291DB745A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02AE005C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2096727147.0000000002AE0000.00000004.00000020.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2ae0000_INSIGNON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373933d78bf1ca64cb37823b19ef61f64ac1737fa36c9d6c7faf45986042c851
Instruction ID: 33dfe0e4c817cb2172213cbf279abc57d4188eef106876a21020407f35e796ba
Opcode Fuzzy Hash: 373933d78bf1ca64cb37823b19ef61f64ac1737fa36c9d6c7faf45986042c851
Instruction Fuzzy Hash: AD21393100475CDFCB5AAFB4C18918ABBB5AF07B50B5516E8DA515E80ADA306A15EF02

Uniqueness

Uniqueness Score: -1.00%

Function 02AE0000 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2096727147.0000000002AE0000.00000004.00000020.00020000.00000000.sdmp, Offset: 02AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2ae0000_INSIGNON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f828262235e16e43e2958a3c595511836b3414a62829d4bb09b586d3c0034e8e
Instruction ID: 1999ecafaf9195102c5f984ca01e14b9b453e8ca0d05c5ada2c6d33001d86e8d
Opcode Fuzzy Hash: f828262235e16e43e2958a3c595511836b3414a62829d4bb09b586d3c0034e8e
Instruction Fuzzy Hash: E8119D31005BACCFCF6B5FB4C08528ABBE5AE07B50B4516F8CA925E81BD6311A05DF02

Uniqueness

Uniqueness Score: -1.00%

Function 0052BE90 Relevance: 203.4, APIs: 83, Strings: 33, Instructions: 386COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BED5
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052BF05
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BF12
__vbaStrCat.MSVBVM60(ImcDcomSecurity\,00000000), ref: 0052BF1A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BF21
__vbaStrCat.MSVBVM60(ImcDcomSecurity.exe,00000000), ref: 0052BF29
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BF30
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052BF4C
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BF59
__vbaStrCat.MSVBVM60(IMC_3270_Client\,00000000), ref: 0052BF61
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BF68
__vbaStrCat.MSVBVM60(DotNet\,?,?,?), ref: 0052BF89
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BF96
__vbaStrCat.MSVBVM60(RemoteConnectionManager\,00000000), ref: 0052BF9E
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BFA5
__vbaStrCat.MSVBVM60(DotNet\,?,?,?), ref: 0052BFC7
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BFD4
__vbaStrCat.MSVBVM60(IMCAVL\Server\,00000000), ref: 0052BFDC
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BFE3
__vbaStrCat.MSVBVM60(AVLServer.exe,00000000), ref: 0052BFEB
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052BFF2
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052C00E
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C01B
__vbaStrCat.MSVBVM60(IMCAVL\Client\,00000000), ref: 0052C023
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C02A
__vbaStrCat.MSVBVM60(DotNet\,?,AVLClient.exe,00000000), ref: 0052C04B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C058
__vbaStrCat.MSVBVM60(Paging\Client\,00000000), ref: 0052C060
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C067
__vbaStrCat.MSVBVM60(DotNet\,?,Paging.exe,00000000), ref: 0052C089
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C096
__vbaStrCat.MSVBVM60(Calendar\,00000000), ref: 0052C09E
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C0A5
__vbaStrCat.MSVBVM60(Calendar.exe,00000000), ref: 0052C0AD
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C0B4
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052C0D0
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C0DD
__vbaStrCat.MSVBVM60(Paging\Server\,00000000), ref: 0052C0E5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C0EC
__vbaStrCat.MSVBVM60(DotNet\,?,PageServer.exe,00000000), ref: 0052C10D
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C11A
__vbaStrCat.MSVBVM60(ESignature\,00000000), ref: 0052C122
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C129
__vbaStrCat.MSVBVM60(DotNet\,?,ESignature.exe,00000000), ref: 0052C14B
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C158
__vbaStrCat.MSVBVM60(ImcCHSBInterface\,00000000), ref: 0052C160
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C167
__vbaStrCat.MSVBVM60(ImcCHSBInterface.exe,00000000), ref: 0052C16F
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C176
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052C192
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C19F
__vbaStrCat.MSVBVM60(Deployment\AutoRegAsm\,00000000), ref: 0052C1A7
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C1AE
__vbaStrCat.MSVBVM60(DotNet\,?,TriTech.Imc.Deployment.AutoRegAsm.exe,00000000), ref: 0052C1CF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C1DC
__vbaStrCat.MSVBVM60(Mail\Server\,00000000), ref: 0052C1E4
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C1EB
__vbaStrCat.MSVBVM60(DotNet\,?,TriTech.Imc.ServiceHosts.Console.Messaging.exe,00000000), ref: 0052C20D
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C21A
__vbaStrCat.MSVBVM60(Mail\Client\,00000000), ref: 0052C222
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C229
__vbaStrCat.MSVBVM60(TriTech.Imc.Mail.UI.exe,00000000), ref: 0052C231
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C238
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052C254
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C261
__vbaStrCat.MSVBVM60(Mail\MobileClient\,00000000), ref: 0052C269
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C270
__vbaStrCat.MSVBVM60(DotNet\,?,TriTech.Imc.Mail.MobileUI.exe,00000000), ref: 0052C291
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C29E
__vbaStrCat.MSVBVM60(Mail\SwitchInterface\,00000000), ref: 0052C2A6
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C2AD
__vbaStrCat.MSVBVM60(DotNet\,?,IMsgMail.exe,00000000), ref: 0052C2CF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C2DC
__vbaStrCat.MSVBVM60(ShellManager\,00000000), ref: 0052C2E4
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C2EB
__vbaStrCat.MSVBVM60(ShellManager.exe,00000000), ref: 0052C2F3
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C2FA
__vbaStrCat.MSVBVM60(IMC_3270_Client.exe,00000000), ref: 0052C4BE
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C4C5
__vbaStrCat.MSVBVM60(RemoteConnectionManager.exe,00000000), ref: 0052C50C
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C513
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0052C56B
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C574

Strings

IMsgMail.exe, xrefs: 0052C2B0
ImcDcomSecurity.exe, xrefs: 0052BF24
Deployment\AutoRegAsm\, xrefs: 0052C1A2
AVLServer.exe, xrefs: 0052BFE6
DotNet\, xrefs: 0052BEFA, 0052BF41, 0052BF7E, 0052BFBC, 0052C003, 0052C040, 0052C07E, 0052C0C5, 0052C102, 0052C140, 0052C187, 0052C1C4, 0052C202, 0052C249, 0052C286, 0052C2C4
RemoteConnectionManager\, xrefs: 0052BF99
PageServer.exe, xrefs: 0052C0EF
ShellManager\, xrefs: 0052C2DF
Paging.exe, xrefs: 0052C06A
TriTech.Imc.ServiceHosts.Console.Messaging.exe, xrefs: 0052C1EE
Mail\Client\, xrefs: 0052C21D
ShellManager.exe, xrefs: 0052C2EE
IMC_3270_Client\, xrefs: 0052BF5C
IMCAVL\Client\, xrefs: 0052C01E
AVLClient.exe, xrefs: 0052C02D
Mail\SwitchInterface\, xrefs: 0052C2A1
Mail\MobileClient\, xrefs: 0052C264
ESignature.exe, xrefs: 0052C12C
IMC_3270_Client.exe, xrefs: 0052BF6B
Mail\Server\, xrefs: 0052C1DF
ImcDcomSecurity\, xrefs: 0052BF15
Calendar.exe, xrefs: 0052C0A8
ESignature\, xrefs: 0052C11D
ImcCHSBInterface\, xrefs: 0052C15B
TriTech.Imc.Mail.UI.exe, xrefs: 0052C22C
RemoteConnectionManager.exe, xrefs: 0052BFA8
IMCAVL\Server\, xrefs: 0052BFD7
Calendar\, xrefs: 0052C099
TriTech.Imc.Deployment.AutoRegAsm.exe, xrefs: 0052C1B1
TriTech.Imc.Mail.MobileUI.exe, xrefs: 0052C273
ImcCHSBInterface.exe, xrefs: 0052C16A
Paging\Server\, xrefs: 0052C0E0
Paging\Client\, xrefs: 0052C05B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$ErrorExitFreeListProc
String ID: AVLClient.exe$AVLServer.exe$Calendar.exe$Calendar\$Deployment\AutoRegAsm\$DotNet\$ESignature.exe$ESignature\$IMCAVL\Client\$IMCAVL\Server\$IMC_3270_Client.exe$IMC_3270_Client\$IMsgMail.exe$ImcCHSBInterface.exe$ImcCHSBInterface\$ImcDcomSecurity.exe$ImcDcomSecurity\$Mail\Client\$Mail\MobileClient\$Mail\Server\$Mail\SwitchInterface\$PageServer.exe$Paging.exe$Paging\Client\$Paging\Server\$RemoteConnectionManager.exe$RemoteConnectionManager\$ShellManager.exe$ShellManager\$TriTech.Imc.Deployment.AutoRegAsm.exe$TriTech.Imc.Mail.MobileUI.exe$TriTech.Imc.Mail.UI.exe$TriTech.Imc.ServiceHosts.Console.Messaging.exe
API String ID: 2565209375-3182624273
Opcode ID: 7570272b4653db53429d461bbcc5e95f5866254adde60ddadf747ce6d6b0f174
Instruction ID: 05fa8a275c22fa56c280d5a7a05c9a981907a438bea1d86f387fae8dc552db90
Opcode Fuzzy Hash: 7570272b4653db53429d461bbcc5e95f5866254adde60ddadf747ce6d6b0f174
Instruction Fuzzy Hash: E5D12B72E10258AFD704EB64DD51DBE7BB9EB887007254177E801B32A0EE74AD45CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00407303 Relevance: 145.7, APIs: 72, Strings: 11, Instructions: 488COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0053CD5E
__vbaOnError.MSVBVM60(?), ref: 0053CD9A
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0053CDAF
__vbaChkstk.MSVBVM60 ref: 0053CDCD
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 0053CDFF
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 0053CE0B
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 0053CE20
__vbaChkstk.MSVBVM60 ref: 0053CE3E
__vbaRaiseEvent.MSVBVM60(?,00000003,?), ref: 0053CE70
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0053CE7C
__vbaChkstk.MSVBVM60 ref: 0053CEAD
__vbaRaiseEvent.MSVBVM60(?,00000002,?), ref: 0053CEDF
__vbaStrCopy.MSVBVM60 ref: 0053CF09
__vbaChkstk.MSVBVM60 ref: 0053CF27
__vbaRaiseEvent.MSVBVM60(?,00000004,?), ref: 0053CF59
__vbaFreeStr.MSVBVM60 ref: 0053CF65
__vbaStrCopy.MSVBVM60 ref: 0053CFC8
__vbaChkstk.MSVBVM60 ref: 0053CFE6
__vbaRaiseEvent.MSVBVM60(?,00000004,?), ref: 0053D018
__vbaFreeStr.MSVBVM60 ref: 0053D024
__vbaStrCopy.MSVBVM60 ref: 0053D0AC
__vbaStrMove.MSVBVM60 ref: 0053D0C3
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053D0CF
__vbaStrMove.MSVBVM60 ref: 0053D0DA
__vbaFreeStr.MSVBVM60 ref: 0053D0E3
__vbaStrMove.MSVBVM60 ref: 0053D0FA
#618.MSVBVM60(?,?), ref: 0053D10D
__vbaStrMove.MSVBVM60 ref: 0053D118
__vbaStrCmp.MSVBVM60(00414914,00000000), ref: 0053D124
__vbaFreeStr.MSVBVM60 ref: 0053D13C
__vbaStrCat.MSVBVM60(00414914,?), ref: 0053D15D
__vbaStrMove.MSVBVM60 ref: 0053D168
__vbaStrMove.MSVBVM60(00000026), ref: 0053D190
__vbaStrCat.MSVBVM60(\IMC,00000000), ref: 0053D19C
__vbaStrMove.MSVBVM60 ref: 0053D1A7
__vbaFreeStr.MSVBVM60 ref: 0053D1B0
__vbaStrMove.MSVBVM60 ref: 0053D1E6
__vbaStrCat.MSVBVM60(\CcwAssemblies\,?), ref: 0053D1FC
__vbaStrMove.MSVBVM60 ref: 0053D207
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053D212
__vbaStrMove.MSVBVM60 ref: 0053D21D
__vbaFreeStr.MSVBVM60 ref: 0053D226

Part of subcall function 0052CC00: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC45
Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052CC70
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC7D
Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(CcwAssemblies,00000000), ref: 0052CC85
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC8C
Part of subcall function 0052CC00: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC91
Part of subcall function 0052CC00: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC97

__vbaStrMove.MSVBVM60(00000000), ref: 0053D24E
__vbaStrMove.MSVBVM60(00000001), ref: 0053D2BB
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053D2C7
__vbaStrMove.MSVBVM60 ref: 0053D2D2
__vbaStrCat.MSVBVM60(TriTech.Imc.Deployment.GeneralService.exe,00000000), ref: 0053D2DE
__vbaStrMove.MSVBVM60 ref: 0053D2E9

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStrList.MSVBVM60(00000003,00000000,?,?,?), ref: 0053D316
__vbaStrI2.MSVBVM60(00000005,AutoUpdate: Current service's protocol version is ,0040BC48,AutoUpdate: Upgrading General Service.,0040BC48), ref: 0053D373
__vbaStrMove.MSVBVM60 ref: 0053D37E
__vbaStrCat.MSVBVM60(00000000), ref: 0053D385
__vbaStrMove.MSVBVM60 ref: 0053D390
__vbaStrCat.MSVBVM60(, latest is ,00000000), ref: 0053D39C
__vbaStrMove.MSVBVM60 ref: 0053D3A7
__vbaStrI2.MSVBVM60(00000005,00000000), ref: 0053D3B0
__vbaStrMove.MSVBVM60 ref: 0053D3BB
__vbaStrCat.MSVBVM60(00000000), ref: 0053D3C2
__vbaStrMove.MSVBVM60 ref: 0053D3CD

Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524D84
Part of subcall function 00524BC0: __vbaStrCat.MSVBVM60( | Full Message: ,?), ref: 00524DA9
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524DB7
Part of subcall function 00524BC0: __vbaStrCat.MSVBVM60(?,00000000), ref: 00524DC5
Part of subcall function 00524BC0: #520.MSVBVM60(?,00000008), ref: 00524DE9
Part of subcall function 00524BC0: __vbaStrVarMove.MSVBVM60(?), ref: 00524DF6
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524E01
Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524E0D
Part of subcall function 00524BC0: __vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 00524E23
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000096,?,?), ref: 00524E46
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000003,?,?), ref: 00524E62
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524E7C
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000008,?,00000000), ref: 00524E8C
Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524E98
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60(0000000B), ref: 00524ECD
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000004,?,00000000), ref: 00524EDD
Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524EE9
Part of subcall function 00524BC0: __vbaFreeVar.MSVBVM60 ref: 00524EF5
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000032,?,?), ref: 00524F0F
Part of subcall function 00524BC0: __vbaNew2.MSVBVM60(004105F0,00557168), ref: 00524F2F

__vbaFreeStrList.MSVBVM60(00000005,00000000,?,?,?,?,00000000), ref: 0053D3EF
__vbaStrCopy.MSVBVM60(AutoUpdate: Upgrading General Service.,0040BC48), ref: 0053D407
__vbaChkstk.MSVBVM60 ref: 0053D425
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 0053D457
__vbaFreeStr.MSVBVM60 ref: 0053D463
__vbaStrMove.MSVBVM60(00000001), ref: 0053D48B
__vbaStrMove.MSVBVM60 ref: 0053D4AA
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053D4B6
__vbaStrMove.MSVBVM60 ref: 0053D4C1
__vbaStrCopy.MSVBVM60 ref: 0053D4CF
__vbaHresultCheckObj.MSVBVM60(?,?,004205B4,0000004C), ref: 0053D515
__vbaFreeStrList.MSVBVM60(00000004,00000000,?,?,00000000), ref: 0053D53F
__vbaSetSystemError.MSVBVM60(000003E8), ref: 0053D5A0
__vbaStrMove.MSVBVM60(00000001,AutoUpdate: New version of general service does not exist (,0040BC48), ref: 0053D78E
__vbaStrCat.MSVBVM60(00000000), ref: 0053D795
__vbaStrMove.MSVBVM60 ref: 0053D7A0
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053D7AC
__vbaStrMove.MSVBVM60 ref: 0053D7B7
__vbaStrCat.MSVBVM60(TriTech.Imc.Deployment.GeneralService.exe,00000000), ref: 0053D7C3
__vbaStrMove.MSVBVM60 ref: 0053D7CE
__vbaStrCat.MSVBVM60(00415210,00000000), ref: 0053D7DA
__vbaStrMove.MSVBVM60 ref: 0053D7E5
__vbaFreeStrList.MSVBVM60(00000005,00000000,?,?,?,?,00000000), ref: 0053D807
__vbaNew.MSVBVM60(0041CEB4), ref: 0053D82F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053D83A
__vbaHresultCheckObj.MSVBVM60(?,?,0041CEC4,00000048), ref: 0053D881
__vbaOnError.MSVBVM60(000000FF), ref: 0053D8B1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000074), ref: 0053D8F8
__vbaFreeObj.MSVBVM60 ref: 0053D916
#685.MSVBVM60 ref: 0053D923
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053D931
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 0053D97C
__vbaFreeObj.MSVBVM60 ref: 0053D9AF
#685.MSVBVM60 ref: 0053D9D8
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053D9E6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 0053DA31
#685.MSVBVM60 ref: 0053DA49
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053DA57
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000002C), ref: 0053DA9F
__vbaStrCat.MSVBVM60(?,AutoUpdate: Failed creating ,0040BC48), ref: 0053DAC5
__vbaStrMove.MSVBVM60 ref: 0053DAD0
__vbaStrCat.MSVBVM60(00423C2C,00000000), ref: 0053DADC
__vbaStrMove.MSVBVM60 ref: 0053DAE7
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 0053DAF5
__vbaStrMove.MSVBVM60 ref: 0053DB00
__vbaStrCat.MSVBVM60(00000000), ref: 0053DB07
__vbaStrMove.MSVBVM60 ref: 0053DB12
__vbaStrCat.MSVBVM60(0041BEBC,00000000), ref: 0053DB1E
__vbaStrMove.MSVBVM60 ref: 0053DB29
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053DB34
__vbaStrMove.MSVBVM60 ref: 0053DB3F
__vbaStrCat.MSVBVM60(00411AE0,00000000), ref: 0053DB4B
__vbaStrMove.MSVBVM60 ref: 0053DB56
__vbaFreeStrList.MSVBVM60(00000008,00000000,?,?,?,?,?,?,?,00000000), ref: 0053DB84
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0053DB9D
__vbaOnError.MSVBVM60(?), ref: 0053DBAF
__vbaStrCat.MSVBVM60(\CcwAssemblies,?,?), ref: 0053DBDF
__vbaStrMove.MSVBVM60 ref: 0053DBEA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000048), ref: 0053DC20
__vbaFreeStr.MSVBVM60 ref: 0053DC4C
__vbaOnError.MSVBVM60(000000FF), ref: 0053DC6A
__vbaStrCat.MSVBVM60(\CcwAssemblies,?,?), ref: 0053DC87
__vbaStrMove.MSVBVM60 ref: 0053DC92
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000074), ref: 0053DCC8
__vbaFreeStr.MSVBVM60 ref: 0053DCE3
__vbaFreeObj.MSVBVM60 ref: 0053DCEF
#685.MSVBVM60 ref: 0053DCFC
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053DD0A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 0053DD55
__vbaFreeObj.MSVBVM60 ref: 0053DD88
#685.MSVBVM60 ref: 0053DDB1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053DDBF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 0053DE0A
#685.MSVBVM60 ref: 0053DE22
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053DE30

Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052CCBB
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CCC8

__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000002C), ref: 0053DE78
__vbaStrCat.MSVBVM60(?,AutoUpdate: Failed creating ,0040BC48), ref: 0053DE9E
__vbaStrMove.MSVBVM60 ref: 0053DEA9
__vbaStrCat.MSVBVM60(\CcwAssemblies,00000000), ref: 0053DEB5
__vbaStrMove.MSVBVM60 ref: 0053DEC0
__vbaStrCat.MSVBVM60(00423C2C,00000000), ref: 0053DECC
__vbaStrMove.MSVBVM60 ref: 0053DED7
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 0053DEE5
__vbaStrMove.MSVBVM60 ref: 0053DEF0
__vbaStrCat.MSVBVM60(00000000), ref: 0053DEF7
__vbaStrMove.MSVBVM60 ref: 0053DF02
__vbaStrCat.MSVBVM60(0041BEBC,00000000), ref: 0053DF0E

Part of subcall function 00524BC0: __vbaChkstk.MSVBVM60(00000000,004047D6), ref: 00524BDE
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60(6D02D8B1,00000001,00000000,00000000,004047D6), ref: 00524C0E
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60 ref: 00524C1A
Part of subcall function 00524BC0: __vbaOnError.MSVBVM60(000000FF), ref: 00524C29
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(000007D0,?), ref: 00524C42
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C50
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524C57
Part of subcall function 00524BC0: #525.MSVBVM60(00000000), ref: 00524C5E
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C6C
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(000007D0,?,00000000), ref: 00524C7F
Part of subcall function 00524BC0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00524C95
Part of subcall function 00524BC0: __vbaCopyBytes.MSVBVM60(000007EE,?,?), ref: 00524CB8
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000003,?,MSG), ref: 00524CD3
Part of subcall function 00524BC0: #520.MSVBVM60(?,00004008), ref: 00524D04
Part of subcall function 00524BC0: __vbaStrVarMove.MSVBVM60(?), ref: 00524D11
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D1F
Part of subcall function 00524BC0: __vbaFreeVar.MSVBVM60 ref: 00524D2B
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(?), ref: 00524D3F
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(00000096,?), ref: 00524D53
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D61
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524D68

Strings

\IMC, xrefs: 0053D197
&, xrefs: 0053D175
Checking client version, xrefs: 0053CDA7
\CcwAssemblies\, xrefs: 0053D1F7
TriTech.Imc.Deployment.GeneralService.exe, xrefs: 0053D2D9, 0053D4C7
AutoUpdate: Current service's protocol version is , xrefs: 0053D366
Direct Update, xrefs: 0053CF01
', xrefs: 0053D66B
, latest is , xrefs: 0053D397
Upgrading General Service, xrefs: 0053D3FF
AutoUpdate: Upgrading General Service., xrefs: 0053D33A

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$CheckHresult$Copy$Fixstr$ChkstkErrorList$Lset$#685EventRaise$Bstr$#520System$#525#618AnsiBytesExitNew2ProcUnicode
String ID: &$'$, latest is $AutoUpdate: Current service's protocol version is $AutoUpdate: Upgrading General Service.$Checking client version$Direct Update$TriTech.Imc.Deployment.GeneralService.exe$Upgrading General Service$\CcwAssemblies\$\IMC
API String ID: 3611312645-859987801
Opcode ID: 4db891bd63548164a7f551f6018151349d1616251970c3d75f273f3157cea7cb
Instruction ID: 109bd7cb8721b230342dfd958b02edaf3fe94f72103773a1c80f6db936203f1e
Opcode Fuzzy Hash: 4db891bd63548164a7f551f6018151349d1616251970c3d75f273f3157cea7cb
Instruction Fuzzy Hash: 37321874900218DFEB14DF90DD58BDEBBB5FF48705F1081A9E90AAB2A0DB749A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00407310 Relevance: 145.7, APIs: 72, Strings: 11, Instructions: 488COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0053F53E
__vbaOnError.MSVBVM60(?), ref: 0053F57A
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0053F58F
__vbaChkstk.MSVBVM60 ref: 0053F5AD
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 0053F5DF
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 0053F5EB
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 0053F600
__vbaChkstk.MSVBVM60 ref: 0053F61E
__vbaRaiseEvent.MSVBVM60(?,00000003,?), ref: 0053F650
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0053F65C
__vbaChkstk.MSVBVM60 ref: 0053F68D
__vbaRaiseEvent.MSVBVM60(?,00000002,?), ref: 0053F6BF
__vbaStrCopy.MSVBVM60 ref: 0053F6E9
__vbaChkstk.MSVBVM60 ref: 0053F707
__vbaRaiseEvent.MSVBVM60(?,00000004,?), ref: 0053F739
__vbaFreeStr.MSVBVM60 ref: 0053F745
__vbaStrCopy.MSVBVM60 ref: 0053F7A8
__vbaChkstk.MSVBVM60 ref: 0053F7C6
__vbaRaiseEvent.MSVBVM60(?,00000004,?), ref: 0053F7F8
__vbaFreeStr.MSVBVM60 ref: 0053F804
__vbaStrCopy.MSVBVM60 ref: 0053F88C
__vbaStrMove.MSVBVM60 ref: 0053F8A3
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053F8AF
__vbaStrMove.MSVBVM60 ref: 0053F8BA
__vbaFreeStr.MSVBVM60 ref: 0053F8C3
__vbaStrMove.MSVBVM60 ref: 0053F8DA
#618.MSVBVM60(?,?), ref: 0053F8ED
__vbaStrMove.MSVBVM60 ref: 0053F8F8
__vbaStrCmp.MSVBVM60(00414914,00000000), ref: 0053F904
__vbaFreeStr.MSVBVM60 ref: 0053F91C
__vbaStrCat.MSVBVM60(00414914,?), ref: 0053F93D
__vbaStrMove.MSVBVM60 ref: 0053F948
__vbaStrMove.MSVBVM60(00000026), ref: 0053F970
__vbaStrCat.MSVBVM60(\IMC,00000000), ref: 0053F97C
__vbaStrMove.MSVBVM60 ref: 0053F987
__vbaFreeStr.MSVBVM60 ref: 0053F990
__vbaStrMove.MSVBVM60 ref: 0053F9C6
__vbaStrCat.MSVBVM60(\CcwAssemblies\,?), ref: 0053F9DC
__vbaStrMove.MSVBVM60 ref: 0053F9E7
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053F9F2
__vbaStrMove.MSVBVM60 ref: 0053F9FD
__vbaFreeStr.MSVBVM60 ref: 0053FA06

Part of subcall function 0052CC00: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC45
Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052CC70
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC7D
Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(CcwAssemblies,00000000), ref: 0052CC85
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC8C
Part of subcall function 0052CC00: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC91
Part of subcall function 0052CC00: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC97

__vbaStrMove.MSVBVM60(00000000), ref: 0053FA2E
__vbaStrMove.MSVBVM60(00000001), ref: 0053FA9B
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053FAA7
__vbaStrMove.MSVBVM60 ref: 0053FAB2
__vbaStrCat.MSVBVM60(TriTech.Imc.Deployment.GeneralService.exe,00000000), ref: 0053FABE
__vbaStrMove.MSVBVM60 ref: 0053FAC9

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStrList.MSVBVM60(00000003,00000000,?,?,?), ref: 0053FAF6
__vbaStrI2.MSVBVM60(00000005,AutoUpdate: Current service's protocol version is ,0040BC48,AutoUpdate: Upgrading General Service.,0040BC48), ref: 0053FB53
__vbaStrMove.MSVBVM60 ref: 0053FB5E
__vbaStrCat.MSVBVM60(00000000), ref: 0053FB65
__vbaStrMove.MSVBVM60 ref: 0053FB70
__vbaStrCat.MSVBVM60(, latest is ,00000000), ref: 0053FB7C
__vbaStrMove.MSVBVM60 ref: 0053FB87
__vbaStrI2.MSVBVM60(00000005,00000000), ref: 0053FB90
__vbaStrMove.MSVBVM60 ref: 0053FB9B
__vbaStrCat.MSVBVM60(00000000), ref: 0053FBA2
__vbaStrMove.MSVBVM60 ref: 0053FBAD

Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524D84
Part of subcall function 00524BC0: __vbaStrCat.MSVBVM60( | Full Message: ,?), ref: 00524DA9
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524DB7
Part of subcall function 00524BC0: __vbaStrCat.MSVBVM60(?,00000000), ref: 00524DC5
Part of subcall function 00524BC0: #520.MSVBVM60(?,00000008), ref: 00524DE9
Part of subcall function 00524BC0: __vbaStrVarMove.MSVBVM60(?), ref: 00524DF6
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524E01
Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524E0D
Part of subcall function 00524BC0: __vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 00524E23
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000096,?,?), ref: 00524E46
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000003,?,?), ref: 00524E62
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524E7C
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000008,?,00000000), ref: 00524E8C
Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524E98
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60(0000000B), ref: 00524ECD
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000004,?,00000000), ref: 00524EDD
Part of subcall function 00524BC0: __vbaFreeStr.MSVBVM60 ref: 00524EE9
Part of subcall function 00524BC0: __vbaFreeVar.MSVBVM60 ref: 00524EF5
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000032,?,?), ref: 00524F0F
Part of subcall function 00524BC0: __vbaNew2.MSVBVM60(004105F0,00557168), ref: 00524F2F

__vbaFreeStrList.MSVBVM60(00000005,00000000,?,?,?,?,00000000), ref: 0053FBCF
__vbaStrCopy.MSVBVM60(AutoUpdate: Upgrading General Service.,0040BC48), ref: 0053FBE7
__vbaChkstk.MSVBVM60 ref: 0053FC05
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 0053FC37
__vbaFreeStr.MSVBVM60 ref: 0053FC43
__vbaStrMove.MSVBVM60(00000001), ref: 0053FC6B
__vbaStrMove.MSVBVM60 ref: 0053FC8A
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053FC96
__vbaStrMove.MSVBVM60 ref: 0053FCA1
__vbaStrCopy.MSVBVM60 ref: 0053FCAF
__vbaHresultCheckObj.MSVBVM60(?,?,004205B4,0000004C), ref: 0053FCF5
__vbaFreeStrList.MSVBVM60(00000004,00000000,?,?,00000000), ref: 0053FD1F
__vbaSetSystemError.MSVBVM60(000003E8), ref: 0053FD80
__vbaStrMove.MSVBVM60(00000001,AutoUpdate: New version of general service does not exist (,0040BC48), ref: 0053FF6E
__vbaStrCat.MSVBVM60(00000000), ref: 0053FF75
__vbaStrMove.MSVBVM60 ref: 0053FF80
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053FF8C
__vbaStrMove.MSVBVM60 ref: 0053FF97
__vbaStrCat.MSVBVM60(TriTech.Imc.Deployment.GeneralService.exe,00000000), ref: 0053FFA3
__vbaStrMove.MSVBVM60 ref: 0053FFAE
__vbaStrCat.MSVBVM60(00415210,00000000), ref: 0053FFBA
__vbaStrMove.MSVBVM60 ref: 0053FFC5
__vbaFreeStrList.MSVBVM60(00000005,00000000,?,?,?,?,00000000), ref: 0053FFE7
__vbaNew.MSVBVM60(0041CEB4), ref: 0054000F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054001A
__vbaHresultCheckObj.MSVBVM60(?,?,0041CEC4,00000048), ref: 00540061
__vbaOnError.MSVBVM60(000000FF), ref: 00540091
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000074), ref: 005400D5
__vbaFreeObj.MSVBVM60 ref: 005400F0
#685.MSVBVM60 ref: 005400FD
__vbaObjSet.MSVBVM60(?,00000000), ref: 00540108
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 00540153
__vbaFreeObj.MSVBVM60 ref: 00540183
#685.MSVBVM60 ref: 005401AC
__vbaObjSet.MSVBVM60(?,00000000), ref: 005401B7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 00540202
#685.MSVBVM60 ref: 0054021A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00540228
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000002C), ref: 00540270
__vbaStrCat.MSVBVM60(?,AutoUpdate: Failed creating ,0040BC48), ref: 00540296
__vbaStrMove.MSVBVM60 ref: 005402A1
__vbaStrCat.MSVBVM60(00423C2C,00000000), ref: 005402AD
__vbaStrMove.MSVBVM60 ref: 005402B8
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 005402C6
__vbaStrMove.MSVBVM60 ref: 005402D1
__vbaStrCat.MSVBVM60(00000000), ref: 005402D8
__vbaStrMove.MSVBVM60 ref: 005402E3
__vbaStrCat.MSVBVM60(0041BEBC,00000000), ref: 005402EF
__vbaStrMove.MSVBVM60 ref: 005402FA
__vbaStrCat.MSVBVM60(?,00000000), ref: 00540305
__vbaStrMove.MSVBVM60 ref: 00540310
__vbaStrCat.MSVBVM60(00411AE0,00000000), ref: 0054031C
__vbaStrMove.MSVBVM60 ref: 00540327
__vbaFreeStrList.MSVBVM60(00000008,00000000,?,?,?,?,?,?,?,00000000), ref: 00540355
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0054036B
__vbaOnError.MSVBVM60(?), ref: 0054037D
__vbaStrCat.MSVBVM60(\CcwAssemblies,?,?), ref: 005403AD
__vbaStrMove.MSVBVM60 ref: 005403B8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000048), ref: 005403EE
__vbaFreeStr.MSVBVM60 ref: 0054041A
__vbaOnError.MSVBVM60(000000FF), ref: 00540438
__vbaStrCat.MSVBVM60(\CcwAssemblies,?,?), ref: 00540452
__vbaStrMove.MSVBVM60 ref: 0054045D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000074), ref: 00540493
__vbaFreeStr.MSVBVM60 ref: 005404AE
__vbaFreeObj.MSVBVM60 ref: 005404B7
#685.MSVBVM60 ref: 005404C4
__vbaObjSet.MSVBVM60(?,00000000), ref: 005404CF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 0054051A
__vbaFreeObj.MSVBVM60 ref: 0054054A
#685.MSVBVM60 ref: 00540573
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054057E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C), ref: 005405C9
#685.MSVBVM60 ref: 005405E1
__vbaObjSet.MSVBVM60(?,00000000), ref: 005405EF

Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052CCBB
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CCC8

__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000002C), ref: 00540637
__vbaStrCat.MSVBVM60(?,AutoUpdate: Failed creating ,0040BC48), ref: 0054065D
__vbaStrMove.MSVBVM60 ref: 00540668
__vbaStrCat.MSVBVM60(\CcwAssemblies,00000000), ref: 00540674
__vbaStrMove.MSVBVM60 ref: 0054067F
__vbaStrCat.MSVBVM60(00423C2C,00000000), ref: 0054068B
__vbaStrMove.MSVBVM60 ref: 00540696
__vbaStrI4.MSVBVM60(00000000,00000000), ref: 005406A4
__vbaStrMove.MSVBVM60 ref: 005406AF
__vbaStrCat.MSVBVM60(00000000), ref: 005406B6
__vbaStrMove.MSVBVM60 ref: 005406C1
__vbaStrCat.MSVBVM60(0041BEBC,00000000), ref: 005406CD

Part of subcall function 00524BC0: __vbaChkstk.MSVBVM60(00000000,004047D6), ref: 00524BDE
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60(6D02D8B1,00000001,00000000,00000000,004047D6), ref: 00524C0E
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60 ref: 00524C1A
Part of subcall function 00524BC0: __vbaOnError.MSVBVM60(000000FF), ref: 00524C29
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(000007D0,?), ref: 00524C42
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C50
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524C57
Part of subcall function 00524BC0: #525.MSVBVM60(00000000), ref: 00524C5E
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C6C
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(000007D0,?,00000000), ref: 00524C7F
Part of subcall function 00524BC0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00524C95
Part of subcall function 00524BC0: __vbaCopyBytes.MSVBVM60(000007EE,?,?), ref: 00524CB8
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000003,?,MSG), ref: 00524CD3
Part of subcall function 00524BC0: #520.MSVBVM60(?,00004008), ref: 00524D04
Part of subcall function 00524BC0: __vbaStrVarMove.MSVBVM60(?), ref: 00524D11
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D1F
Part of subcall function 00524BC0: __vbaFreeVar.MSVBVM60 ref: 00524D2B
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(?), ref: 00524D3F
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(00000096,?), ref: 00524D53
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D61
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524D68

Strings

\IMC, xrefs: 0053F977
Checking client version, xrefs: 0053F587
\CcwAssemblies\, xrefs: 0053F9D7
TriTech.Imc.Deployment.GeneralService.exe, xrefs: 0053FAB9, 0053FCA7
&, xrefs: 0053F955
AutoUpdate: Current service's protocol version is , xrefs: 0053FB46
Direct Update, xrefs: 0053F6E1
, latest is , xrefs: 0053FB77
Upgrading General Service, xrefs: 0053FBDF
AutoUpdate: Upgrading General Service., xrefs: 0053FB1A
', xrefs: 0053FE4B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$CheckHresult$Copy$Fixstr$ChkstkErrorList$Lset$#685EventRaise$Bstr$#520System$#525#618AnsiBytesExitNew2ProcUnicode
String ID: &$'$, latest is $AutoUpdate: Current service's protocol version is $AutoUpdate: Upgrading General Service.$Checking client version$Direct Update$TriTech.Imc.Deployment.GeneralService.exe$Upgrading General Service$\CcwAssemblies\$\IMC
API String ID: 3611312645-859987801
Opcode ID: d04c451dca037a2c1179741736bef573d65f64f5d89efadbba6afa5438eff315
Instruction ID: d4d44eea9cf6376c943c2ad1ebd42ba6bc78b2a123ea1586f9050ec198bf558c
Opcode Fuzzy Hash: d04c451dca037a2c1179741736bef573d65f64f5d89efadbba6afa5438eff315
Instruction Fuzzy Hash: D1324974D00208DFDB04DF90D958BDEBBB5FF48705F1080AAE90AAB2A4DB749A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0052A890 Relevance: 131.5, APIs: 54, Strings: 21, Instructions: 291COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60(JAILCTRL.ZUR,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052A8D5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,00000000,004047D6), ref: 0052A8E2

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052A8F9
__vbaStrCopy.MSVBVM60 ref: 0052A910
__vbaStrCopy.MSVBVM60 ref: 0052A91C
__vbaStrCat.MSVBVM60(ARREST.ZUR,?), ref: 0052A936
__vbaStrMove.MSVBVM60 ref: 0052A93D
__vbaFreeStr.MSVBVM60(?), ref: 0052A94E
__vbaStrCopy.MSVBVM60 ref: 0052A965
__vbaStrCopy.MSVBVM60 ref: 0052A971

Strings

QST, xrefs: 0052AAB1, 0052AABB
JAILCTRL.ZUR, xrefs: 0052A8D0
DISPATCH.ZUR, xrefs: 0052A986
MPS, xrefs: 0052A9B2, 0052A9BC
PAYLOG.ZUR, xrefs: 0052AC1D
REP, xrefs: 0052ABA2, 0052ABAC
INVCTRL.ZUR, xrefs: 0052AA30
FMS, xrefs: 0052AA07, 0052AA11
JMS, xrefs: 0052A908, 0052A912
AMS, xrefs: 0052AC46, 0052AC50
QSTABLES.ZUR, xrefs: 0052AA85
FCTRL.ZUR, xrefs: 0052A9DB
CIV, xrefs: 0052AB06, 0052AB10
Issue.ZUR, xrefs: 0052AB2F
PCRCTRL.ZUR, xrefs: 0052ABCB
RDEPART.ZUR, xrefs: 0052AB76
RMS, xrefs: 0052A95D, 0052A967
ARREST.ZUR, xrefs: 0052A931
INV, xrefs: 0052AA5C, 0052AA66
CIVCTRL.ZUR, xrefs: 0052AADA
EMS, xrefs: 0052ABF7, 0052AC01

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Copy$Free$Move$AnsiErrorSystemUnicode
String ID: AMS$ARREST.ZUR$CIV$CIVCTRL.ZUR$DISPATCH.ZUR$EMS$FCTRL.ZUR$FMS$INV$INVCTRL.ZUR$Issue.ZUR$JAILCTRL.ZUR$JMS$MPS$PAYLOG.ZUR$PCRCTRL.ZUR$QST$QSTABLES.ZUR$RDEPART.ZUR$REP$RMS
API String ID: 3538081698-1924503452
Opcode ID: bb740b308f87ebebe64e9b93bfb562f705803de7740f0a75f15bc4d182960dc6
Instruction ID: 97e808745655742c8d008f556998f2e49a4b4f74f1b80f156a3e978fda5f5a0b
Opcode Fuzzy Hash: bb740b308f87ebebe64e9b93bfb562f705803de7740f0a75f15bc4d182960dc6
Instruction Fuzzy Hash: ABB16E74D102198BCB04EBA4DD559EE7FB5EF88300B10816BE502772E4DB786D89CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00519830 Relevance: 126.3, APIs: 67, Strings: 5, Instructions: 269COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 00519875

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

__vbaCopyBytes.MSVBVM60(000004B0,00553E4E,00551090,?,6D02D8E2), ref: 0051988F
#648.MSVBVM60(0000000A,?,6D02D8E2), ref: 005198A7
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 005198B6
__vbaStrCat.MSVBVM60(JDEPART.ZUR,?,?,6D02D8E2), ref: 005198CB
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005198DC
__vbaFileOpen.MSVBVM60(00004304,00000258,?,00000000,?,6D02D8E2), ref: 005198F0
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005198FF
__vbaRecDestruct.MSVBVM60(0040DFBC,00553E4E,?,?,?,6D02D8E2), ref: 00519915
__vbaGetOwner4.MSVBVM60(00412F80,00000000,?,6D02D8E2), ref: 00519921
__vbaStrFixstr.MSVBVM60(?,00553FDC,?,6D02D8E2), ref: 00519934
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051993B
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519943
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519959
__vbaStrFixstr.MSVBVM60(?,00553FDE,?,6D02D8E2), ref: 00519962
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519969
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519971
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519987
__vbaStrFixstr.MSVBVM60(?,00554174,?,6D02D8E2), ref: 00519990
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519997
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051999F
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005199B5
__vbaStrFixstr.MSVBVM60(?,00553FE0,?,6D02D8E2), ref: 005199BE
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005199C5
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 005199CD
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005199E3
__vbaStrFixstr.MSVBVM60(?,00553FD8,?,6D02D8E2), ref: 005199EC
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005199F3
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 005199FB
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519A11
__vbaStrFixstr.MSVBVM60(?,00553FDA,?,6D02D8E2), ref: 00519A1A
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519A21
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519A29
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519A3F
__vbaStrFixstr.MSVBVM60(00000003,00554028,?,6D02D8E2), ref: 00519A48
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519A4F
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00519A52
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519A5D
__vbaLsetFixstr.MSVBVM60(00000003,00554028,?,?,6D02D8E2), ref: 00519A6A
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519A7F
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519A84
__vbaStrFixstr.MSVBVM60(00000003,0055401C,?,6D02D8E2), ref: 00519A8D
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519A94
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00519A97
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519AA2
__vbaLsetFixstr.MSVBVM60(00000003,0055401C,?,?,6D02D8E2), ref: 00519AAF
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519AC4
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519AC9
__vbaStrFixstr.MSVBVM60(00000003,00554022,?,6D02D8E2), ref: 00519AD2
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519AD9
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00519ADC
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519AE7
__vbaLsetFixstr.MSVBVM60(00000003,00554022,?,?,6D02D8E2), ref: 00519AF4
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519B09
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519B0E
__vbaStrFixstr.MSVBVM60(?,005540BE,?,6D02D8E2), ref: 00519B17
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519B1E
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519B26
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519B3C
__vbaStrFixstr.MSVBVM60(0000003C,00553E4E,?,6D02D8E2), ref: 00519B45
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519B4C
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00519B4F
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519B5A
__vbaLsetFixstr.MSVBVM60(0000003C,00553E4E,?,?,6D02D8E2), ref: 00519B67
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519B7C
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519B81
__vbaExitProc.MSVBVM60(?,6D02D8E2), ref: 00519B83

Strings

JDEPART.ZUR, xrefs: 005198C6
/U, xrefs: 00519A7A
/U, xrefs: 00519B04
/U, xrefs: 00519B77
/U, xrefs: 00519ABF

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Fixstr$Free$#523Lset$ErrorExitProc$#648BytesCopyDestructFileOpenOwner4
String ID: JDEPART.ZUR$/U$/U$/U$/U
API String ID: 2641145122-2475145446
Opcode ID: c589be18b89662124f7c69196ca5721c488f14fb7060c88519817287c5797291
Instruction ID: 4aa728dc8384d3a6d14721a2d009fadff3c8eedd36db5f279f4a1018d8e657b9
Opcode Fuzzy Hash: c589be18b89662124f7c69196ca5721c488f14fb7060c88519817287c5797291
Instruction Fuzzy Hash: 9F914D71A402089BD705EBA5DD5AEEE7FB4EF58B01F204126E506F61E0DE705D48CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00517F30 Relevance: 124.5, APIs: 67, Strings: 4, Instructions: 287COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,00517E89), ref: 00517F4E
__vbaOnError.MSVBVM60(?,?,6D02D8E2,?,00000000,004047D6), ref: 00517FA6

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

#648.MSVBVM60(0000000A), ref: 00517FCC
__vbaFreeVar.MSVBVM60 ref: 00517FDE
#523.MSVBVM60(?), ref: 00517FF1
__vbaStrMove.MSVBVM60 ref: 00518005
__vbaStrCmp.MSVBVM60(0040BC48,00000000), ref: 0051800D
__vbaFreeStr.MSVBVM60 ref: 00518029
__vbaStrCopy.MSVBVM60 ref: 00518049
__vbaStrCat.MSVBVM60(ACONTROL.ZUR,?), ref: 00518058
__vbaStrMove.MSVBVM60 ref: 00518066
__vbaFileOpen.MSVBVM60(00004304,00000200,?,00000000), ref: 0051807A
__vbaFreeStr.MSVBVM60 ref: 00518086
__vbaRecDestruct.MSVBVM60(0040CFAC,00554300,?,?), ref: 0051809C
__vbaGetOwner4.MSVBVM60(00411B68,00000000), ref: 005180A8
__vbaCopyBytes.MSVBVM60(00000400,?,00554300), ref: 005180BF
__vbaStrFixstr.MSVBVM60(000007D0,?,00411AD0,0040BF34,?,000000FF,00000000), ref: 005180E7
__vbaStrMove.MSVBVM60 ref: 005180F1
#712.MSVBVM60(00000000), ref: 005180F4
__vbaStrMove.MSVBVM60 ref: 00518102
__vbaLsetFixstr.MSVBVM60(000007D0,?,?), ref: 00518117
__vbaLsetFixstr.MSVBVM60(000007D0,?,?), ref: 00518130
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00518146
__vbaCopyBytes.MSVBVM60(00000400,00554300,?,?,00000000,004047D6), ref: 00518160
__vbaStrFixstr.MSVBVM60(?,005544CE,?,00000000,004047D6), ref: 0051816D
__vbaStrMove.MSVBVM60(?,00000000,004047D6), ref: 00518177
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,00000000,004047D6), ref: 0051817F
__vbaFreeStr.MSVBVM60(?,00000000,004047D6), ref: 00518198
__vbaStrFixstr.MSVBVM60(?,0055446A,?,00000000,004047D6), ref: 005181A1
__vbaStrMove.MSVBVM60(?,00000000,004047D6), ref: 005181AB
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,00000000,004047D6), ref: 005181B3
__vbaFreeStr.MSVBVM60(?,00000000,004047D6), ref: 005181CC
__vbaStrFixstr.MSVBVM60(00000003,005544BC,?,00000000,004047D6), ref: 005181D5
__vbaStrMove.MSVBVM60(?,00000000,004047D6), ref: 005181DF
#523.MSVBVM60(00000000,?,00000000,004047D6), ref: 005181E2
__vbaStrMove.MSVBVM60(?,00000000,004047D6), ref: 005181F0
__vbaLsetFixstr.MSVBVM60(00000003,005544BC,?,?,00000000,004047D6), ref: 00518200
__vbaStrMove.MSVBVM60 ref: 0051821B
__vbaFreeStr.MSVBVM60 ref: 00518223
__vbaStrFixstr.MSVBVM60(00000003,005544C2), ref: 0051822C
__vbaStrMove.MSVBVM60 ref: 00518236
#523.MSVBVM60(00000000), ref: 00518239
__vbaStrMove.MSVBVM60 ref: 00518247
__vbaLsetFixstr.MSVBVM60(00000003,005544C2,?), ref: 00518257
__vbaStrMove.MSVBVM60 ref: 00518272
__vbaFreeStr.MSVBVM60 ref: 0051827A
__vbaStrFixstr.MSVBVM60(?,00554466), ref: 00518283
__vbaStrMove.MSVBVM60 ref: 0051828D
#581.MSVBVM60(00000000), ref: 00518290
__vbaLsetFixstr.MSVBVM60(?,00554466,?), ref: 005182AA
__vbaVarDup.MSVBVM60 ref: 005182D0
__vbaFpI4.MSVBVM60(?,00411AE0), ref: 005182E8
#606.MSVBVM60(00000000), ref: 005182EF
__vbaStrMove.MSVBVM60 ref: 005182FD
__vbaStrCat.MSVBVM60(00000000), ref: 00518300
__vbaStrMove.MSVBVM60 ref: 0051830D
__vbaFreeStrList.MSVBVM60(00000002,?,00000000), ref: 0051831F
__vbaFreeVar.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 0051832E
__vbaStrFixstr.MSVBVM60(0000003C,00554300,?,?,?,?,00000000,004047D6), ref: 0051833B
__vbaStrMove.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 00518345
#523.MSVBVM60(00000000,?,?,?,?,00000000,004047D6), ref: 00518348
__vbaStrMove.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 00518356
__vbaLsetFixstr.MSVBVM60(0000003C,00554300,?,?,?,?,?,00000000,004047D6), ref: 00518366
__vbaStrMove.MSVBVM60 ref: 00518381
__vbaFreeStr.MSVBVM60 ref: 00518389
__vbaExitProc.MSVBVM60 ref: 0051838B
__vbaFreeStr.MSVBVM60(00518453), ref: 0051844C

Strings

ACONTROL.ZUR, xrefs: 00518053
/U, xrefs: 00518216
/U, xrefs: 0051826D
/U, xrefs: 0051837C

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$FixstrFree$Lset$#523$Copy$BytesErrorExitListProc$#581#606#648#712ChkstkDestructFileOpenOwner4
String ID: ACONTROL.ZUR$/U$/U$/U
API String ID: 3469604415-1436196919
Opcode ID: ea60f5e0664a7b5f9128bd5763a7b2a78e53c170d3887db6926f362ae3ee80ed
Instruction ID: 8c97ac2060ca65b42317353ca44167af93de67b26ebb041a426ec4edeaed0efa
Opcode Fuzzy Hash: ea60f5e0664a7b5f9128bd5763a7b2a78e53c170d3887db6926f362ae3ee80ed
Instruction Fuzzy Hash: C4B18070A4021A9BEB249B60DE5AFF9BB74FF44741F0081B6E50AA25E0DF701E85DF94

Uniqueness

Uniqueness Score: -1.00%

Function 0052C620 Relevance: 122.8, APIs: 48, Strings: 22, Instructions: 314COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C665
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052C695
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C6A2
__vbaStrCat.MSVBVM60(ImcDcomSecurity\,00000000), ref: 0052C6AA
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C6B1
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C6B6
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C6BC
__vbaStrCat.MSVBVM60(DotNet\,?,0052CB7D), ref: 0052C6E0
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C6ED
__vbaStrCat.MSVBVM60(DotNet\,?,IMC_3270_Client\,00000000), ref: 0052C70C
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C719
__vbaStrCat.MSVBVM60(DotNet\,?,RemoteConnectionManager\,00000000), ref: 0052C738
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C745
__vbaStrCat.MSVBVM60(DotNet\,?,IMCAVL\Server\,00000000), ref: 0052C766
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C773
__vbaStrCat.MSVBVM60(DotNet\,?,IMCAVL\Client\,00000000), ref: 0052C795
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C7A2
__vbaStrCat.MSVBVM60(DotNet\,?,Paging\Client\,00000000), ref: 0052C7C4
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C7D1
__vbaStrCat.MSVBVM60(DotNet\,?,Calendar\,00000000), ref: 0052C7F2
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C7FF
__vbaStrCat.MSVBVM60(DotNet\,?,Paging\Server\,00000000), ref: 0052C821
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C82E
__vbaStrCat.MSVBVM60(DotNet\,?,ESignature\,00000000), ref: 0052C850
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C85D
__vbaStrCat.MSVBVM60(DotNet\,?,ImcCHSBInterface\,00000000), ref: 0052C87E
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C88B
__vbaStrCat.MSVBVM60(DotNet\,?,Deployment\AutoRegAsm\,00000000), ref: 0052C8AD
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C8BA
__vbaStrCat.MSVBVM60(DotNet\,?,Mail\Server\,00000000), ref: 0052C8DC
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C8E9
__vbaStrCat.MSVBVM60(DotNet\,?,Mail\Client\,00000000), ref: 0052C90A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C917
__vbaStrCat.MSVBVM60(DotNet\,?,Mail\MobileClient\,00000000), ref: 0052C939
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C946
__vbaStrCat.MSVBVM60(DotNet\,?,Mail\SwitchInterface\,00000000), ref: 0052C968
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C975
__vbaStrCat.MSVBVM60(DotNet\,?,ShellManager\,00000000), ref: 0052C996
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C9A3
__vbaStrCat.MSVBVM60(DotNet\,?,MobileUpdater\UpdateServer\,00000000), ref: 0052C9C5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052C9D2
__vbaStrCat.MSVBVM60(DotNet\,?,MobileUpdater\UpdateClient\,00000000), ref: 0052C9F4
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CA01
__vbaStrCat.MSVBVM60(DotNet\,?,StateGeneric\,00000000), ref: 0052CA22
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CA2F
__vbaStrCat.MSVBVM60(DotNet\,?,CADEXCHANGE\,00000000), ref: 0052CA51
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CA5E
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CB4C

Strings

MobileUpdater\UpdateClient\, xrefs: 0052C9D5
IMCAVL\Client\, xrefs: 0052C776
Deployment\AutoRegAsm\, xrefs: 0052C88E
Mail\SwitchInterface\, xrefs: 0052C949
CADEXCHANGE\, xrefs: 0052CA32
Mail\MobileClient\, xrefs: 0052C91A
MOBILEDEVICEINTERFACE\, xrefs: 0052CA61
DotNet\, xrefs: 0052C68A, 0052C6D5, 0052C701, 0052C72D, 0052C75B, 0052C78A, 0052C7B9, 0052C7E7, 0052C816, 0052C845, 0052C873, 0052C8A2, 0052C8D1, 0052C8FF, 0052C92E, 0052C95D, 0052C98B, 0052C9BA, 0052C9E9, 0052CA17, 0052CA46
Mail\Server\, xrefs: 0052C8BD
RemoteConnectionManager\, xrefs: 0052C71C
MobileUpdater\UpdateServer\, xrefs: 0052C9A6
ImcDcomSecurity\, xrefs: 0052C6A5
ESignature\, xrefs: 0052C831
ShellManager\, xrefs: 0052C978
ImcCHSBInterface\, xrefs: 0052C860
IMCAVL\Server\, xrefs: 0052C748
StateGeneric\, xrefs: 0052CA04
Calendar\, xrefs: 0052C7D4
Mail\Client\, xrefs: 0052C8EC
IMC_3270_Client\, xrefs: 0052C6F0
Paging\Server\, xrefs: 0052C802
Paging\Client\, xrefs: 0052C7A5

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$ExitProc$ErrorFree
String ID: CADEXCHANGE\$Calendar\$Deployment\AutoRegAsm\$DotNet\$ESignature\$IMCAVL\Client\$IMCAVL\Server\$IMC_3270_Client\$ImcCHSBInterface\$ImcDcomSecurity\$MOBILEDEVICEINTERFACE\$Mail\Client\$Mail\MobileClient\$Mail\Server\$Mail\SwitchInterface\$MobileUpdater\UpdateClient\$MobileUpdater\UpdateServer\$Paging\Client\$Paging\Server\$RemoteConnectionManager\$ShellManager\$StateGeneric\
API String ID: 2108537301-2708447835
Opcode ID: 017e1cd4700d8c7d0d8ec6acc582ddc077d028e098b65ddd7ba24eb9e44cba8f
Instruction ID: fe2a9b0dd1b7da18f3077a9aa0a500eecf7e3d30a0b738996003618abc8554c8
Opcode Fuzzy Hash: 017e1cd4700d8c7d0d8ec6acc582ddc077d028e098b65ddd7ba24eb9e44cba8f
Instruction Fuzzy Hash: 45C16A36A10254AFD700DB14ED64DAA3BB5FB8870033181A7E901B77B1DA757D468F98

Uniqueness

Uniqueness Score: -1.00%

Function 00519460 Relevance: 117.5, APIs: 60, Strings: 7, Instructions: 250COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 005194A8

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

__vbaStrCat.MSVBVM60(?,Opening ,?,6D02D8E2), ref: 005194C7
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005194D4
__vbaStrCat.MSVBVM60(FDEPART.ZUR,00000000,?,6D02D8E2), ref: 005194DC
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005194E3
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005194EE
__vbaCopyBytes.MSVBVM60(00000396,00553AB6,00551090,?,6D02D8E2), ref: 005194FF
#648.MSVBVM60(0000000A,?,6D02D8E2), ref: 00519517
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 00519526
__vbaStrCat.MSVBVM60(FDEPART.ZUR,?,?,6D02D8E2), ref: 0051953A
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519541
__vbaFileOpen.MSVBVM60(00004304,000001CB,?,00000000,?,6D02D8E2), ref: 00519556
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051955F
__vbaRecDestruct.MSVBVM60(0040DCD8,00553AB6,?,?,?,6D02D8E2), ref: 00519574
__vbaGetOwner4.MSVBVM60(00412B9C,00000000,?,6D02D8E2), ref: 00519580
__vbaStrCmp.MSVBVM60(FMS,?,?,6D02D8E2), ref: 00519592
__vbaStrFixstr.MSVBVM60(?,00553D02,?,6D02D8E2), ref: 005195AD
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005195B4
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 005195BC
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005195D2
__vbaStrFixstr.MSVBVM60(?,00553D04,?,6D02D8E2), ref: 005195DB
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005195E2
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 005195EA
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519600
__vbaStrFixstr.MSVBVM60(?,00553DCC,?,6D02D8E2), ref: 00519609
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519610
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519618
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051962E
__vbaStrFixstr.MSVBVM60(?,00553D0C,?,6D02D8E2), ref: 00519637
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051963E
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00519641
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051964C
__vbaLsetFixstr.MSVBVM60(?,00553D0C,?,?,6D02D8E2), ref: 00519659
__vbaStrCmp.MSVBVM60(00411AD8,?,?,6D02D8E2), ref: 00519668
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,6D02D8E2), ref: 00519685
__vbaStrFixstr.MSVBVM60(00000003,00553CFC), ref: 00519695
__vbaStrMove.MSVBVM60 ref: 0051969C
#523.MSVBVM60(00000000), ref: 0051969F
__vbaStrMove.MSVBVM60 ref: 005196AA
__vbaLsetFixstr.MSVBVM60(00000003,00553CFC,?), ref: 005196B7
__vbaStrMove.MSVBVM60 ref: 005196CC
__vbaFreeStr.MSVBVM60 ref: 005196D1
__vbaStrFixstr.MSVBVM60(00000003,00553CF0), ref: 005196DA
__vbaStrMove.MSVBVM60 ref: 005196E3
__vbaStrFixstr.MSVBVM60(00000003,00553CF6), ref: 005196EC
__vbaStrMove.MSVBVM60 ref: 005196F5
__vbaStrFixstr.MSVBVM60(?,00553D9C), ref: 005196FE
__vbaStrMove.MSVBVM60 ref: 00519705
__vbaStrCmp.MSVBVM60(00411AD8,00000000), ref: 0051970D
__vbaFreeStr.MSVBVM60 ref: 00519723
__vbaStrFixstr.MSVBVM60(0000003C,00553AB6), ref: 0051972C
__vbaStrMove.MSVBVM60 ref: 00519733
#519.MSVBVM60(00000000), ref: 00519736
__vbaStrMove.MSVBVM60 ref: 00519741
__vbaLsetFixstr.MSVBVM60(0000003C,00553AB6,?), ref: 0051974E
__vbaStrMove.MSVBVM60 ref: 00519763
__vbaFreeStr.MSVBVM60 ref: 00519768
__vbaExitProc.MSVBVM60 ref: 0051976A
__vbaExitProc.MSVBVM60(?,6D02D8E2), ref: 005197DD
__vbaFreeStr.MSVBVM60(00519811,?,6D02D8E2), ref: 0051980A

Strings

Opening , xrefs: 005194B3
/U, xrefs: 0051975E
/U, xrefs: 005196C7
/U, xrefs: 005196F0
FMS, xrefs: 0051958D
FDEPART.ZUR, xrefs: 005194D7, 00519535
/U, xrefs: 005196DE

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$FixstrFree$ExitLsetProc$#523Error$#519#648BytesCopyDestructFileListOpenOwner4
String ID: FDEPART.ZUR$FMS$Opening $/U$/U$/U$/U
API String ID: 929041481-4233049203
Opcode ID: b9de1dea4f8b1c6d21f75ed0293c3495273a5ef98777b8650c0657f66ef58e83
Instruction ID: c280cb39c5b2046e7caf4943f3b74b2edb8649d8796ab73099ada2684b12ece8
Opcode Fuzzy Hash: b9de1dea4f8b1c6d21f75ed0293c3495273a5ef98777b8650c0657f66ef58e83
Instruction Fuzzy Hash: A3915F71E40208AFD704EBB4DD65EEEBFB8EF58B41F104126E506F21A0EEB05949CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00542000 Relevance: 112.4, APIs: 56, Strings: 8, Instructions: 405COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00542063
__vbaStrCopy.MSVBVM60 ref: 00542089
__vbaStrCat.MSVBVM60( /verbose,?), ref: 005420A7
__vbaStrMove.MSVBVM60 ref: 005420B4
__vbaStrCat.MSVBVM60( /noservice,?), ref: 005420D6
__vbaStrMove.MSVBVM60 ref: 005420DD
__vbaNew.MSVBVM60(004051A8), ref: 005420E4
__vbaObjSet.MSVBVM60(?,00000000), ref: 005420EF
__vbaStrCat.MSVBVM60( /cmnpath:,?), ref: 005420FE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CBD0,00000024), ref: 0054212D
__vbaVarCat.MSVBVM60(?,?,00000008), ref: 00542145
__vbaStrVarMove.MSVBVM60(00000000), ref: 00542148
__vbaStrMove.MSVBVM60 ref: 00542153
__vbaFreeVarList.MSVBVM60(00000003,00000008,?,?), ref: 00542169
__vbaStrCat.MSVBVM60( /cmndatapath:,?), ref: 00542177
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CBD0,00000024), ref: 005421AA
__vbaVarCat.MSVBVM60(?,?,00000008), ref: 005421BC
__vbaStrVarMove.MSVBVM60(00000000), ref: 005421BF
__vbaStrMove.MSVBVM60 ref: 005421CA
__vbaFreeVarList.MSVBVM60(00000003,00000008,?,?), ref: 005421DA
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 005421F2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000014), ref: 0054221D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F7B8,00000050), ref: 00542245
__vbaStrMove.MSVBVM60 ref: 00542254
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CBD0,00000024), ref: 00542279
__vbaStrVarMove.MSVBVM60(?), ref: 0054227F
__vbaStrMove.MSVBVM60 ref: 0054228A
__vbaFreeStr.MSVBVM60 ref: 0054228F
__vbaFreeObj.MSVBVM60 ref: 00542298
__vbaFreeVar.MSVBVM60 ref: 005422A1
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 005422B0
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 005422CD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000014), ref: 005422F2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F7B8,00000050), ref: 00542312
__vbaStrMove.MSVBVM60 ref: 00542321
__vbaFreeObj.MSVBVM60 ref: 00542326
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 0054233F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000014), ref: 00542364
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F7B8,00000058), ref: 00542384
__vbaStrCat.MSVBVM60(00414914,?), ref: 00542395
__vbaStrMove.MSVBVM60 ref: 0054239C
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 005423A3
__vbaStrMove.MSVBVM60 ref: 005423AA
__vbaStrCat.MSVBVM60(.exe,00000000), ref: 005423B2
__vbaStrMove.MSVBVM60 ref: 005423B9
__vbaFreeStrList.MSVBVM60(00000003,?,00000000,?), ref: 005423C9
__vbaFreeObj.MSVBVM60 ref: 005423D5
__vbaStrCat.MSVBVM60(?,?), ref: 005423E3
__vbaStrMove.MSVBVM60 ref: 005423EA
__vbaFreeStr.MSVBVM60 ref: 00542417
__vbaExitProc.MSVBVM60(?,?), ref: 00542438
__vbaFreeStr.MSVBVM60(00542501), ref: 005424EB
__vbaFreeStr.MSVBVM60 ref: 005424F0
__vbaFreeObj.MSVBVM60 ref: 005424F5
__vbaFreeStr.MSVBVM60 ref: 005424FE

Strings

7@, xrefs: 005423F9, 005423FC
.exe, xrefs: 005423AD
/force, xrefs: 00542081
/noservice, xrefs: 005420D1
/cmnpath:, xrefs: 005420F9
/verbose, xrefs: 0054209C
/cmndatapath:, xrefs: 00542172
/remove, xrefs: 00542071

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$CheckHresult$ListNew2$CopyErrorExitProc
String ID: /cmndatapath:$ /cmnpath:$ /force$ /noservice$ /remove$ /verbose$.exe$7@
API String ID: 288328557-3825929564
Opcode ID: d5a6a0374294e2e07b0cfa34cdae2b2c08d8a903eff7659bc3664e80f7d5ced3
Instruction ID: e4deeab7fb5596fd870141afc297fee15e7de34211379194d0d1eed59f4ad1e5
Opcode Fuzzy Hash: d5a6a0374294e2e07b0cfa34cdae2b2c08d8a903eff7659bc3664e80f7d5ced3
Instruction Fuzzy Hash: 37E10671E00218ABDB14DFA4DD88DEEBBB9FF48704F508129F505B72A0DA74A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040580A Relevance: 112.4, APIs: 63, Strings: 1, Instructions: 375COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00549450
__vbaStrCopy.MSVBVM60 ref: 00549458
__vbaStrCopy.MSVBVM60 ref: 00549460
__vbaStrCopy.MSVBVM60 ref: 00549468
__vbaOnError.MSVBVM60(?), ref: 0054946C
__vbaStrCat.MSVBVM60(?,My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\), ref: 0054948B
__vbaStrMove.MSVBVM60 ref: 00549498
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 005494A0
__vbaStrMove.MSVBVM60 ref: 005494A7
__vbaStrCat.MSVBVM60(?,00000000), ref: 005494AE
__vbaStrMove.MSVBVM60 ref: 005494B5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004202F0,00000040), ref: 005494D4
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 005494F6
__vbaStrCat.MSVBVM60(?,My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\), ref: 0054950F
__vbaStrMove.MSVBVM60 ref: 00549516
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0054951E
__vbaStrMove.MSVBVM60 ref: 00549525
__vbaStrCat.MSVBVM60(?,00000000), ref: 0054952C
__vbaStrMove.MSVBVM60 ref: 00549533
__vbaHresultCheckObj.MSVBVM60(00000000,?,004202F0,00000020), ref: 00549552
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0054956C
__vbaStrCat.MSVBVM60(?,My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\), ref: 00549589
__vbaStrMove.MSVBVM60 ref: 00549590
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 00549598
__vbaStrMove.MSVBVM60 ref: 0054959F
__vbaStrCat.MSVBVM60(?,00000000), ref: 005495A6
__vbaStrMove.MSVBVM60 ref: 005495AD
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 005495B5
__vbaStrMove.MSVBVM60 ref: 005495BC
__vbaStrCat.MSVBVM60(?,00000000), ref: 005495C3
__vbaStrMove.MSVBVM60 ref: 005495CA
__vbaHresultCheckObj.MSVBVM60(00000000,?,004202F0,00000040), ref: 005495E9
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00549613
__vbaStrCopy.MSVBVM60 ref: 0054962F
__vbaStrCat.MSVBVM60(?,My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\), ref: 0054963E
__vbaStrMove.MSVBVM60 ref: 00549645
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0054964D
__vbaStrMove.MSVBVM60 ref: 00549654
__vbaStrCat.MSVBVM60(?,00000000), ref: 0054965B
__vbaStrMove.MSVBVM60 ref: 00549662
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0054966A
__vbaStrMove.MSVBVM60 ref: 00549671
__vbaStrCat.MSVBVM60(?,00000000), ref: 00549678
__vbaStrMove.MSVBVM60 ref: 0054967F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004202F0,00000024), ref: 005496A2
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 005496C8
__vbaStrCat.MSVBVM60(?,My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\), ref: 005496E5
__vbaStrMove.MSVBVM60 ref: 005496EC
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 005496F4
__vbaStrMove.MSVBVM60 ref: 005496FB
__vbaStrCat.MSVBVM60(?,00000000), ref: 00549702
__vbaStrMove.MSVBVM60 ref: 00549709
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 00549711
__vbaStrMove.MSVBVM60 ref: 00549718
__vbaStrCat.MSVBVM60(?,00000000), ref: 0054971F
__vbaStrMove.MSVBVM60 ref: 00549726
__vbaHresultCheckObj.MSVBVM60(00000000,?,004202F0,0000003C), ref: 00549749
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00549768
__vbaExitProc.MSVBVM60 ref: 005497D4
__vbaFreeStr.MSVBVM60(00549820), ref: 0054980E
__vbaFreeStr.MSVBVM60 ref: 00549813
__vbaFreeStr.MSVBVM60 ref: 00549818
__vbaFreeStr.MSVBVM60 ref: 0054981D

Strings

My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\, xrefs: 0054947C, 00549506, 00549580, 00549635, 005496DC

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$CheckCopyHresultList$ErrorExitProc
String ID: My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\
API String ID: 834454610-2820428052
Opcode ID: f4850990696a7ac4d724101f3a4a9d850fbfefecf45cd0dd584391a1cdeac37b
Instruction ID: 10b4d2b4e5eb101c161e439e64a17d6895fa5383dc1c5a6bbdb050d5e1131299
Opcode Fuzzy Hash: f4850990696a7ac4d724101f3a4a9d850fbfefecf45cd0dd584391a1cdeac37b
Instruction Fuzzy Hash: 6FD1FAB1D1021CABDB05EBA4DC84DEFBBB9FF98700F14412AF102A7194DAB06945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0053C390 Relevance: 108.8, APIs: 50, Strings: 12, Instructions: 338COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0053C3AE
__vbaOnError.MSVBVM60(?,?,?,?,?,004047D6), ref: 0053C3DE
__vbaNew.MSVBVM60(0041CEB4,?,?,?,?,004047D6), ref: 0053C3F0
__vbaObjSet.MSVBVM60(00000000,00000000,?,?,?,?,004047D6), ref: 0053C3FB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000044), ref: 0053C438
__vbaStrCat.MSVBVM60(\Microsoft.NET\Framework\v4.0.30319\regasm.exe,?), ref: 0053C489
__vbaStrMove.MSVBVM60 ref: 0053C494
__vbaFreeStr.MSVBVM60 ref: 0053C49D
__vbaMidStmtBstr.MSVBVM60(00000000,0040920C,?,?,?,?), ref: 0053C4D0
__vbaStrCat.MSVBVM60(\Microsoft.NET\Framework\v4.0.30319\regasm.exe,?), ref: 0053C536
__vbaStrMove.MSVBVM60 ref: 0053C541
__vbaFreeStr.MSVBVM60 ref: 0053C54A
__vbaStrCopy.MSVBVM60(?), ref: 0053C5B0
__vbaStrCat.MSVBVM60(00414B08,Unable to find Regasm.exe, Please have System Administrator install .NET Framework 4.0), ref: 0053C5C0
__vbaStrMove.MSVBVM60 ref: 0053C5CB
__vbaStrCat.MSVBVM60(Once the Framework is installed you will need to reinstall the Pervasive Client,00000000), ref: 0053C5D7
__vbaStrMove.MSVBVM60 ref: 0053C5E2
__vbaStrCat.MSVBVM60(00414B08,00000000), ref: 0053C5EE
__vbaStrMove.MSVBVM60 ref: 0053C5F9
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053C604
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,?,?,00000000,0000000A,00000000), ref: 0053C644
__vbaFreeVar.MSVBVM60 ref: 0053C650
__vbaStrMove.MSVBVM60 ref: 0053C60F

Part of subcall function 00526160: __vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000), ref: 005261DB
Part of subcall function 00526160: __vbaObjIs.MSVBVM60(?,00000000), ref: 005261E8
Part of subcall function 00526160: __vbaVargVar.MSVBVM60(?), ref: 00526285

__vbaOnError.MSVBVM60(000000FF), ref: 0053C836
__vbaExitProc.MSVBVM60 ref: 0053C8B3
__vbaFreeObj.MSVBVM60(0053C8FC), ref: 0053C8EC
__vbaFreeStr.MSVBVM60 ref: 0053C8F5

Strings

\Microsoft.NET\Framework\v4.0.30319\regasm.exe, xrefs: 0053C484, 0053C531
RegAsm Check, xrefs: 0053C5A8
/u ", xrefs: 0053C66D
. See the windows application event log for details., xrefs: 0053C760
UnregisterCcwAssembly, xrefs: 0053C7C1
Once the Framework is installed you will need to reinstall the Pervasive Client, xrefs: 0053C5D2
AutoUpdate: RegAsm /U failed (return value=, xrefs: 0053C704
) to unregister , xrefs: 0053C731
Unable to find , xrefs: 0053C7CF
Unable to find Regasm.exe, Please have System Administrator install .NET Framework 4.0, xrefs: 0053C5B6
#, xrefs: 0053C82D
" /codebase /tlb, xrefs: 0053C69C

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FreeMove$Error$BstrCheckChkstkCopyExitHresultListProcStmtVarg
String ID: /u "$" /codebase /tlb$#$) to unregister $. See the windows application event log for details.$AutoUpdate: RegAsm /U failed (return value=$Once the Framework is installed you will need to reinstall the Pervasive Client$RegAsm Check$Unable to find $Unable to find Regasm.exe, Please have System Administrator install .NET Framework 4.0$UnregisterCcwAssembly$\Microsoft.NET\Framework\v4.0.30319\regasm.exe
API String ID: 344638578-2740393567
Opcode ID: ca9f66909492c8d6abe7fae414619e5cd563d41bcb20d8239936c51fbd754d4c
Instruction ID: 26c79d09ac693ee85e82ea2eaa03a5f796723215bbc07e48c286f327199024b1
Opcode Fuzzy Hash: ca9f66909492c8d6abe7fae414619e5cd563d41bcb20d8239936c51fbd754d4c
Instruction Fuzzy Hash: CDE1E875D00208EFDB04DFE0DA98AEEBB79BF48705F10816AF502A76A0DB745A45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00542520 Relevance: 108.8, APIs: 57, Strings: 5, Instructions: 327COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054257D
__vbaStrCat.MSVBVM60(?), ref: 00542595
__vbaStrMove.MSVBVM60 ref: 005425A2

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStr.MSVBVM60(?), ref: 005425BC
__vbaStrCat.MSVBVM60(?,00000000,00000080), ref: 005425DC
__vbaStrMove.MSVBVM60(?,00000000,00000080), ref: 005425E3
__vbaStrToAnsi.MSVBVM60(?,00000000,?,00000000,00000080), ref: 005425EA
__vbaSetSystemError.MSVBVM60(00000000,?,00000000,00000080), ref: 005425F9
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000,00000080), ref: 00542619
#685.MSVBVM60 ref: 0054262D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00542638
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 0054265D
__vbaStrI4.MSVBVM60(?,AutoUpdate: Dll error ,0040BC48), ref: 00542671
__vbaStrMove.MSVBVM60 ref: 0054267C
__vbaStrCat.MSVBVM60(00000000), ref: 0054267F
__vbaStrMove.MSVBVM60 ref: 00542686
__vbaStrCat.MSVBVM60( setting attributes of ,00000000), ref: 0054268E
__vbaStrMove.MSVBVM60 ref: 00542695
__vbaStrCat.MSVBVM60(?,00000000), ref: 0054269E
__vbaStrMove.MSVBVM60(?,00000000), ref: 005426A5
__vbaStrCat.MSVBVM60(?,00000000,?,00000000), ref: 005426AB
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 005426B2
__vbaStrCat.MSVBVM60( to normal,00000000,?,00000000,?,00000000), ref: 005426BA
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 005426C1
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 005426E3
__vbaFreeObj.MSVBVM60 ref: 005426EF
__vbaStrCat.MSVBVM60(?,?,00000000), ref: 00542705
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0054270C
__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,00000000), ref: 00542713
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?,00000000), ref: 00542723
__vbaStrMove.MSVBVM60(?,00000000,?,?,00000000), ref: 0054272A
__vbaStrToAnsi.MSVBVM60(?,00000000,?,00000000,?,?,00000000), ref: 00542731
__vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,?,00000000), ref: 00542740
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000,?,?,00000000), ref: 00542768
#685.MSVBVM60 ref: 0054277C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00542787
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 005427AC
__vbaStrI4.MSVBVM60(?,AutoUpdate: Dll error ,0040BC48), ref: 005427C0
__vbaStrMove.MSVBVM60 ref: 005427CB
__vbaStrCat.MSVBVM60(00000000), ref: 005427CE
__vbaStrMove.MSVBVM60 ref: 005427D5
__vbaStrCat.MSVBVM60( copying ,00000000), ref: 005427DD
__vbaStrMove.MSVBVM60 ref: 005427E4
__vbaStrCat.MSVBVM60(?,00000000), ref: 005427ED
__vbaStrMove.MSVBVM60(?,00000000), ref: 005427F4
__vbaStrCat.MSVBVM60(00000000,00000000,?,00000000), ref: 005427FA
__vbaStrMove.MSVBVM60(?,00000000), ref: 00542801
__vbaStrCat.MSVBVM60( to ,00000000,?,00000000), ref: 00542809
__vbaStrMove.MSVBVM60(?,00000000), ref: 00542810
__vbaStrCat.MSVBVM60(?,00000000,?,00000000), ref: 00542819
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 00542820
__vbaStrCat.MSVBVM60(00411AE0,00000000,?,00000000,?,00000000), ref: 00542828
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 0054282F
__vbaFreeStrList.MSVBVM60(00000008,?,?,?,?,?,?,?,?,00000000,?,00000000,?,00000000), ref: 00542859
__vbaFreeObj.MSVBVM60 ref: 00542865
__vbaExitProc.MSVBVM60 ref: 0054286B
__vbaExitProc.MSVBVM60 ref: 00542882

Strings

AutoUpdate: Dll error , xrefs: 00542668, 005427B7
copying , xrefs: 005427D8
setting attributes of , xrefs: 00542689
to normal, xrefs: 005426B5
to , xrefs: 00542804

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$AnsiErrorList$System$#685CheckExitHresultProc$Unicode
String ID: copying $ setting attributes of $ to $ to normal$AutoUpdate: Dll error
API String ID: 2329302616-730553879
Opcode ID: 570c1e3da73cb187e819357fb0f132bd7c9bbeb7ce736cbe255e97ccbb41dbe6
Instruction ID: e0d571ccb07f11c108e31e01e7935cf5558dd89aa5d8a2cacb455b7f0bea3105
Opcode Fuzzy Hash: 570c1e3da73cb187e819357fb0f132bd7c9bbeb7ce736cbe255e97ccbb41dbe6
Instruction Fuzzy Hash: 1EB1EBB1E00218AFCB05EFE4DD84EDEBBB9AF58700F10852AF506E7164EA749945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00406E1C Relevance: 103.6, APIs: 52, Strings: 7, Instructions: 352COMMON

Download Yara Rule

APIs

__vbaVarDup.MSVBVM60 ref: 0053017E
__vbaStrCopy.MSVBVM60 ref: 00530190
__vbaOnError.MSVBVM60(?), ref: 00530194
__vbaStrCmp.MSVBVM60(0040BF34,?), ref: 005301A3
__vbaStrCopy.MSVBVM60 ref: 005301B9
__vbaStrDate.MSVBVM60(?,?), ref: 005301D1
__vbaStrMove.MSVBVM60(?,?), ref: 005301E2
#546.MSVBVM60(?,?,?), ref: 005301EF
#662.MSVBVM60(?,0041532C,00004007,?,?,?,?,?), ref: 00530220
__vbaI4Var.MSVBVM60(?,?,?), ref: 0053022D
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?), ref: 00530245
__vbaVarTstEq.MSVBVM60(0000800B,?), ref: 0053028F
__vbaStrI4.MSVBVM60(?,0040BC48), ref: 005302F0
__vbaStrMove.MSVBVM60(?,0040BC48), ref: 005302FB
__vbaStrCat.MSVBVM60(00000000,?,0040BC48), ref: 005302FE
__vbaStrMove.MSVBVM60(?,0040BC48), ref: 00530309
__vbaStrCat.MSVBVM60( min to save,00000000,?,0040BC48), ref: 00530311
__vbaStrMove.MSVBVM60(?,0040BC48), ref: 0053031C

Strings

IMC, xrefs: 00530377
MINUTES TO SAVE ALL YOUR WORK, OR IT WILL BE LOST., xrefs: 00530431
ALL , xrefs: 00530372
YOU HAVE , xrefs: 005303EB
SOFTWARE WILL BE SHUTDOWN., xrefs: 0053038A
min to save, xrefs: 0053030C
Shutdown in progress..., xrefs: 0053071A

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Copy$#546#662DateErrorFreeList
String ID: MINUTES TO SAVE ALL YOUR WORK, OR IT WILL BE LOST.$ SOFTWARE WILL BE SHUTDOWN.$ min to save$ALL $IMC$Shutdown in progress...$YOU HAVE
API String ID: 3410594522-284726845
Opcode ID: abd373378b9eb804e086b4698d6f884ba7b1242985c40ab1064fa635671ecbe1
Instruction ID: bc86dd9a009f34e2835d81d5822b395fe6ec08ecddbc548d527692af84e24f3a
Opcode Fuzzy Hash: abd373378b9eb804e086b4698d6f884ba7b1242985c40ab1064fa635671ecbe1
Instruction Fuzzy Hash: 0ED11E75D00219AFDB14DFA4CD98EEEBBB8FF48700F10812AE54AA7290EB745945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00535B10 Relevance: 103.6, APIs: 55, Strings: 4, Instructions: 322COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00535BEF
__vbaStrCopy.MSVBVM60 ref: 00535C06
__vbaStrCmp.MSVBVM60(0040BC48), ref: 00535C13
__vbaStrCopy.MSVBVM60 ref: 00535C2C
__vbaStrCopy.MSVBVM60 ref: 00535C36
__vbaStrCopy.MSVBVM60 ref: 00535C40
__vbaStrCopy.MSVBVM60 ref: 00535C4A
__vbaStrCopy.MSVBVM60 ref: 00535C54
#644.MSVBVM60(?), ref: 00535C6D
#644.MSVBVM60(?), ref: 00535C7C
#644.MSVBVM60(?), ref: 00535C84
#644.MSVBVM60(?), ref: 00535C90
#644.MSVBVM60(?), ref: 00535C9C
#644.MSVBVM60(?), ref: 00535CA8
__vbaRecUniToAnsi.MSVBVM60(0040ED08,?,00000044,?), ref: 00535CC0
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,?,04000210,00000000,00000000,00000000), ref: 00535CFE
__vbaRecAnsiToUni.MSVBVM60(0040ED08,00000044,?), ref: 00535D10
__vbaRecDestructAnsi.MSVBVM60(0040ED08,?), ref: 00535D32
__vbaSetSystemError.MSVBVM60(?), ref: 00535D46
__vbaSetSystemError.MSVBVM60(?), ref: 00535D51
__vbaExitProc.MSVBVM60 ref: 00535D5D
__vbaRecDestructAnsi.MSVBVM60(0040ED08,?,00536123), ref: 005360E3
__vbaFreeStr.MSVBVM60 ref: 005360F2
__vbaFreeStr.MSVBVM60 ref: 005360F7
__vbaFreeStr.MSVBVM60 ref: 005360FC
__vbaRecDestruct.MSVBVM60(0040ED08,00000044), ref: 00536107
__vbaFreeStr.MSVBVM60 ref: 00536110
__vbaFreeStr.MSVBVM60 ref: 00536118
__vbaFreeStr.MSVBVM60 ref: 00536120

Strings

" Err , xrefs: 00535E29
D, xrefs: 00535C56
Fail run ", xrefs: 00535DE0
" as ", xrefs: 00535E04

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$#644CopyFree$AnsiError$DestructSystem$ExitProc
String ID: " Err $" as "$D$Fail run "
API String ID: 3710953071-4169759940
Opcode ID: 613c1a6b9fbb10908c4b5a8191cf40990d90fbbf6838716e24004802d3d63e2b
Instruction ID: a07551c601b196af5ce1458aa516c3091e69f3e3a04a6bf040441dec8ce00072
Opcode Fuzzy Hash: 613c1a6b9fbb10908c4b5a8191cf40990d90fbbf6838716e24004802d3d63e2b
Instruction Fuzzy Hash: 5FD1B6B1D002299FDB24DFA5CD85FDEBBB9BF48300F5085AAE509A3250DB705A84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00407267 Relevance: 102.0, APIs: 53, Strings: 5, Instructions: 483COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00538C79
__vbaStrCopy.MSVBVM60 ref: 00538C87
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 00538CC8
__vbaFreeStr.MSVBVM60 ref: 00538CD0
__vbaStrCopy.MSVBVM60 ref: 00538CDE
__vbaRaiseEvent.MSVBVM60(?,00000003,?), ref: 00538D19
__vbaFreeStr.MSVBVM60 ref: 00538D21
__vbaRaiseEvent.MSVBVM60(?,00000002,?), ref: 00538D65
__vbaStrCopy.MSVBVM60 ref: 00538DAA
__vbaRaiseEvent.MSVBVM60(?,00000004,?), ref: 00538DE5
__vbaFreeStr.MSVBVM60 ref: 00538DED
__vbaStrMove.MSVBVM60 ref: 00538E03
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 00538E0B
__vbaStrMove.MSVBVM60 ref: 00538E16
__vbaFreeStr.MSVBVM60 ref: 00538E1B
__vbaStrMove.MSVBVM60(00000026), ref: 00538E3C
__vbaStrCat.MSVBVM60(\IMC\CcwAssemblies,00000000), ref: 00538E44
__vbaStrMove.MSVBVM60 ref: 00538E4F
__vbaFreeStr.MSVBVM60 ref: 00538E54
__vbaStrMove.MSVBVM60 ref: 00538E6D
__vbaStrCat.MSVBVM60(00414914,?), ref: 00538E8E
__vbaStrMove.MSVBVM60 ref: 00538E99
__vbaStrCat.MSVBVM60(?,00000000), ref: 00538EA0
__vbaStrMove.MSVBVM60 ref: 00538EAB
__vbaStrCat.MSVBVM60(00414914,?), ref: 00538EB6
__vbaStrMove.MSVBVM60 ref: 00538EC1
__vbaStrCat.MSVBVM60(?,00000000), ref: 00538EC8
__vbaStrMove.MSVBVM60 ref: 00538ED3
__vbaObjSet.MSVBVM60(?,?), ref: 00538F0F
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 00538F27
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,00000024), ref: 00538F52
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,0000001C), ref: 00538FB1
__vbaStrVarMove.MSVBVM60(?), ref: 00538FC1
__vbaStrMove.MSVBVM60 ref: 00538FC8
__vbaRaiseEvent.MSVBVM60(?,00000003,?), ref: 00538FF3
__vbaFreeStr.MSVBVM60 ref: 00538FFF
__vbaFreeVar.MSVBVM60 ref: 00539008
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,0000001C), ref: 00539047
__vbaStrVarMove.MSVBVM60(?), ref: 0053905B
__vbaStrMove.MSVBVM60 ref: 00539062
__vbaFreeStr.MSVBVM60(?,CcwAssemblies\,FFFFFFFF), ref: 00539082
__vbaFreeVar.MSVBVM60 ref: 0053908B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,0000001C), ref: 005390E3
__vbaLenBstr.MSVBVM60(CcwAssemblies\,0000000A), ref: 00539100
#632.MSVBVM60(?,?,-00000001), ref: 0053911B
__vbaStrVarMove.MSVBVM60(?), ref: 00539128
__vbaStrMove.MSVBVM60 ref: 0053912F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,00000048), ref: 00539153
__vbaFreeStr.MSVBVM60 ref: 00539162
__vbaFreeVarList.MSVBVM60(00000003,?,0000000A,?), ref: 00539179
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,00000024), ref: 0053941C
__vbaFpI2.MSVBVM60(?,?), ref: 0053946F
__vbaRaiseEvent.MSVBVM60(?,00000002,?), ref: 005394B3

Strings

Removing auto-updating client, xrefs: 00538C7F
\IMC\CcwAssemblies, xrefs: 00538E3F
CcwAssemblies\, xrefs: 0053906B, 005390FB
&, xrefs: 00538E21
Service Update, xrefs: 00538D9B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$CheckEventHresultRaise$Copy$List$#632BstrError
String ID: &$CcwAssemblies\$Removing auto-updating client$Service Update$\IMC\CcwAssemblies
API String ID: 1969531904-1066214602
Opcode ID: 05d26aceca8d5cfb6a9e62a12d529f557183282b82550f0be3524119433074e7
Instruction ID: 7e0af907650e0cad8caa73a3e8998241cfa867fb03fed2079d6b24324b9f34ab
Opcode Fuzzy Hash: 05d26aceca8d5cfb6a9e62a12d529f557183282b82550f0be3524119433074e7
Instruction Fuzzy Hash: 5522F5B1D002199FDB14DFA4CD89BEEBBB5FF48300F1081A9E549A7291DB706A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00519FA0 Relevance: 101.7, APIs: 53, Strings: 5, Instructions: 220COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 00519FE5

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

#648.MSVBVM60(0000000A,?,6D02D8E2), ref: 0051A002
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 0051A011
__vbaStrCat.MSVBVM60(IDEPART.ZUR,?,?,6D02D8E2), ref: 0051A026
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A037
__vbaFileOpen.MSVBVM60(00004304,000001E1,?,00000000,?,6D02D8E2), ref: 0051A04B
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A05A
__vbaRecDestruct.MSVBVM60(0040E5C4,00554BB4,?,?,?,6D02D8E2), ref: 0051A070
__vbaGetOwner4.MSVBVM60(0041396C,00000000,?,6D02D8E2), ref: 0051A07C
__vbaStrFixstr.MSVBVM60(?,00554D16,?,6D02D8E2), ref: 0051A08F
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A096
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A09E
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A0B4
__vbaStrFixstr.MSVBVM60(?,00554D18,?,6D02D8E2), ref: 0051A0BD
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A0C4
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A0CC
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A0E2
__vbaStrFixstr.MSVBVM60(?,00554DDA,?,6D02D8E2), ref: 0051A0EB
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A0F2
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A0FA
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A110
__vbaStrFixstr.MSVBVM60(?,00554D36,?,6D02D8E2), ref: 0051A119
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A120
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A128
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A13E
__vbaStrFixstr.MSVBVM60(?,00554DB2,?,6D02D8E2), ref: 0051A147
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A14E
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A156
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A16C
__vbaStrFixstr.MSVBVM60(00000003,00554D26,?,6D02D8E2), ref: 0051A175
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A17C
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 0051A17F
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A18A
__vbaLsetFixstr.MSVBVM60(00000003,00554D26,?,?,6D02D8E2), ref: 0051A197
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A1AC
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A1B1
__vbaStrFixstr.MSVBVM60(0000003C,00554BB4,?,6D02D8E2), ref: 0051A1BA
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A1C1
#519.MSVBVM60(00000000,?,6D02D8E2), ref: 0051A1C4
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A1CF
__vbaLsetFixstr.MSVBVM60(0000003C,00554BB4,?,?,6D02D8E2), ref: 0051A1DC
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A1F1
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A1F6
__vbaStrFixstr.MSVBVM60(00000003,00554D1A,?,6D02D8E2), ref: 0051A1FF
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A208
__vbaStrFixstr.MSVBVM60(00000003,00554D20,?,6D02D8E2), ref: 0051A211
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A21A
__vbaStrFixstr.MSVBVM60(?,00554DE6,?,6D02D8E2), ref: 0051A223
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A22A
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A232
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A248
__vbaFileClose.MSVBVM60(?,?,6D02D8E2), ref: 0051A252
__vbaExitProc.MSVBVM60(?,6D02D8E2), ref: 0051A258

Strings

/U, xrefs: 0051A1EC
/U, xrefs: 0051A215
IDEPART.ZUR, xrefs: 0051A021
/U, xrefs: 0051A203
/U, xrefs: 0051A1A7

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Fixstr$Free$ErrorExitFileLsetProc$#519#523#648CloseDestructOpenOwner4
String ID: IDEPART.ZUR$/U$/U$/U$/U
API String ID: 96549105-408192767
Opcode ID: 274a7b6d58b975c3158ab4a84479643e0e0bd5458f81a0a72dde64a7c653c1c5
Instruction ID: dddb6fce3045769b17657ff8fc39e8c9f526a33dbeb0686afa0ad65bcc26b4e9
Opcode Fuzzy Hash: 274a7b6d58b975c3158ab4a84479643e0e0bd5458f81a0a72dde64a7c653c1c5
Instruction Fuzzy Hash: DE714C71A40208AFDB00EBB4DD56EEEBBB4EF58B05F104166E506F22A0DAB14D44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00519C30 Relevance: 98.2, APIs: 53, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 00519C75

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

__vbaCopyBytes.MSVBVM60(000004B0,00554702,00551090,?,6D02D8E2), ref: 00519C8F
#648.MSVBVM60(0000000A,?,6D02D8E2), ref: 00519CA7
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 00519CB6
__vbaStrCat.MSVBVM60(CDEPART.ZUR,?,?,6D02D8E2), ref: 00519CCB
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519CDC
__vbaFileOpen.MSVBVM60(00004304,00000258,?,00000000,?,6D02D8E2), ref: 00519CF0
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519CFF
__vbaRecDestruct.MSVBVM60(0040E310,00554702,?,?,?,6D02D8E2), ref: 00519D15
__vbaGetOwner4.MSVBVM60(004135C4,00000000,?,6D02D8E2), ref: 00519D21
__vbaStrFixstr.MSVBVM60(?,00554890,?,6D02D8E2), ref: 00519D34
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519D3B
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519D43
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519D59
__vbaStrFixstr.MSVBVM60(?,00554892,?,6D02D8E2), ref: 00519D62
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519D69
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519D71
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519D87
__vbaStrFixstr.MSVBVM60(?,00554B22,?,6D02D8E2), ref: 00519D90
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519D97
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519D9F
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519DB5
__vbaStrFixstr.MSVBVM60(?,00554894,?,6D02D8E2), ref: 00519DBE
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519DC5
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519DCD
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519DE3
__vbaStrFixstr.MSVBVM60(?,0055488C,?,6D02D8E2), ref: 00519DEC
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519DF3
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519DFB
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519E11
__vbaStrFixstr.MSVBVM60(?,0055488E,?,6D02D8E2), ref: 00519E1A
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519E21
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519E29
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519E3F
__vbaStrFixstr.MSVBVM60(00000003,005548DC,?,6D02D8E2), ref: 00519E48
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519E4F
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00519E52
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519E5D
__vbaLsetFixstr.MSVBVM60(00000003,005548DC,?,?,6D02D8E2), ref: 00519E6A
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519E7F
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519E84
__vbaStrFixstr.MSVBVM60(?,0055498E,?,6D02D8E2), ref: 00519E8D
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519E94
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519E9C
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519EB2
__vbaStrFixstr.MSVBVM60(0000003C,00554702,?,6D02D8E2), ref: 00519EBB
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519EC2
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00519EC5
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519ED0
__vbaLsetFixstr.MSVBVM60(0000003C,00554702,?,?,6D02D8E2), ref: 00519EDD
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519EF2
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519EF7
__vbaExitProc.MSVBVM60(?,6D02D8E2), ref: 00519EF9

Strings

/U, xrefs: 00519EED
CDEPART.ZUR, xrefs: 00519CC6
/U, xrefs: 00519E7A

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Fixstr$#523ErrorExitLsetProc$#648BytesCopyDestructFileOpenOwner4
String ID: CDEPART.ZUR$/U$/U
API String ID: 1595933093-2455959897
Opcode ID: 05c5fae4e1cda81225d8d4bd507c882959a6e453482c4c0b42725f016db85de7
Instruction ID: 27e60a5a4c44292c9407790134dde04bc742239a5961429876b21d501ad7d796
Opcode Fuzzy Hash: 05c5fae4e1cda81225d8d4bd507c882959a6e453482c4c0b42725f016db85de7
Instruction Fuzzy Hash: 17715C71A40248ABDB04EBB4DD5AEEE7EB4EF58B01F104166E506F21A0EAB05D44CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004072B5 Relevance: 96.6, APIs: 51, Strings: 4, Instructions: 332COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D02D8B1,6D01A323,?), ref: 0053B37A
__vbaStrCat.MSVBVM60 ref: 0053B392
__vbaStrMove.MSVBVM60 ref: 0053B39F
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053B3A7
__vbaStrMove.MSVBVM60 ref: 0053B3AE
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0053B3B4
__vbaStrMove.MSVBVM60 ref: 0053B3BB

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?), ref: 0053B3E1
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053B3FA
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B401
__vbaStrCat.MSVBVM60(00414914,00000000,?,00000000), ref: 0053B409
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B410
__vbaStrCat.MSVBVM60(?,00000000,?,00000000), ref: 0053B416
__vbaStrMove.MSVBVM60(?,00000000,?,00000000), ref: 0053B41D
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,?,00000000,?,00000000), ref: 0053B44A
__vbaStrCat.MSVBVM60 ref: 0053B495
__vbaStrMove.MSVBVM60 ref: 0053B49C
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053B4A4
__vbaStrMove.MSVBVM60 ref: 0053B4AB
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0053B4B1
__vbaStrMove.MSVBVM60 ref: 0053B4B8
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0053B4E5
__vbaStrCat.MSVBVM60 ref: 0053B510
__vbaStrMove.MSVBVM60 ref: 0053B517
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0053B51F
__vbaStrMove.MSVBVM60 ref: 0053B526
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0053B52C
__vbaStrMove.MSVBVM60 ref: 0053B533
__vbaStrMove.MSVBVM60 ref: 0053B553
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0053B563
__vbaStrToAnsi.MSVBVM60(?,?,?), ref: 0053B586
__vbaSetSystemError.MSVBVM60(00000000), ref: 0053B595
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0053B5A3
__vbaFreeStr.MSVBVM60 ref: 0053B5B8
#685.MSVBVM60 ref: 0053B5C7
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053B5D2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 0053B5F3
__vbaStrI4.MSVBVM60(?,AutoUpdate: Dll Error ,0040BC48), ref: 0053B607
__vbaStrMove.MSVBVM60 ref: 0053B612
__vbaStrCat.MSVBVM60(00000000), ref: 0053B615
__vbaStrMove.MSVBVM60 ref: 0053B61C
__vbaStrCat.MSVBVM60( while trying to delete ,00000000), ref: 0053B624
__vbaStrMove.MSVBVM60 ref: 0053B62B
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053B632
__vbaStrMove.MSVBVM60 ref: 0053B639
__vbaStrCat.MSVBVM60( (because update failed),00000000), ref: 0053B641
__vbaStrMove.MSVBVM60 ref: 0053B648
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,00000000,?,00000000), ref: 0053B666
__vbaFreeObj.MSVBVM60 ref: 0053B672
__vbaExitProc.MSVBVM60(?), ref: 0053B680
__vbaFreeStr.MSVBVM60(0053B725), ref: 0053B71E

Strings

while trying to delete , xrefs: 0053B61F
AutoUpdate: Dll Error , xrefs: 0053B5FE
(because update failed), xrefs: 0053B63C
/@, xrefs: 0053B479, 0053B47C

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$List$Error$AnsiSystemUnicode$#685CheckExitHresultProc
String ID: (because update failed)$ while trying to delete $AutoUpdate: Dll Error $/@
API String ID: 3322552272-2840300580
Opcode ID: f743c73396a47cef1e2a755f3fee7628d5242895d2ba1f08a041efdc15824ace
Instruction ID: 4d68ef571086f9fbbfc453d7fa16a65200827ade89cccf2262fcf05d0c638805
Opcode Fuzzy Hash: f743c73396a47cef1e2a755f3fee7628d5242895d2ba1f08a041efdc15824ace
Instruction Fuzzy Hash: D3C1DB71D10218AFDB05EBA8DD84EEEBBB9FF98700F10812AF506E7154EB749905CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0051A5F0 Relevance: 96.5, APIs: 49, Strings: 6, Instructions: 213COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 0051A638

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

__vbaCopyBytes.MSVBVM60(0000051C,0055528C,00551090,?,6D02D8E2), ref: 0051A652
#648.MSVBVM60(0000000A,?,6D02D8E2), ref: 0051A66A
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 0051A679
__vbaStrCat.MSVBVM60(EDEPART.ZUR,?,?,6D02D8E2), ref: 0051A68E
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A69F
__vbaFileOpen.MSVBVM60(00004304,0000028E,?,00000000,?,6D02D8E2), ref: 0051A6B3
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A6C2
__vbaRecDestruct.MSVBVM60(0040E984,0055528C,?,?,?,6D02D8E2), ref: 0051A6D8
__vbaGetOwner4.MSVBVM60(00413DB4,00000000,?,6D02D8E2), ref: 0051A6E4
__vbaStrCmp.MSVBVM60(EMS,?,?,6D02D8E2), ref: 0051A6F6
__vbaStrFixstr.MSVBVM60(?,0055539A,?,6D02D8E2), ref: 0051A711
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A718
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A720
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A736
__vbaStrFixstr.MSVBVM60(?,0055539C,?,6D02D8E2), ref: 0051A73F
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A746
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A74E
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A764
__vbaStrFixstr.MSVBVM60(0000003C,0055528C,?,6D02D8E2), ref: 0051A76D
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A774
#524.MSVBVM60(0000000A,00004008,?,6D02D8E2), ref: 0051A78B
__vbaLsetFixstr.MSVBVM60(0000003C,0055528C,?,?,6D02D8E2), ref: 0051A79C
__vbaStrVarMove.MSVBVM60(0000000A,?,6D02D8E2), ref: 0051A7A6
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A7B3
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A7B8
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 0051A7BD
__vbaStrFixstr.MSVBVM60(?,0055537E,?,6D02D8E2), ref: 0051A7CA
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A7D1
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A7D9
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A7EF
__vbaStrFixstr.MSVBVM60(00000003,005553A6,?,6D02D8E2), ref: 0051A7F8
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A7FF
#524.MSVBVM60(0000000A,00004008,?,6D02D8E2), ref: 0051A816
__vbaLsetFixstr.MSVBVM60(00000003,005553A6,?,?,6D02D8E2), ref: 0051A827
__vbaStrVarMove.MSVBVM60(0000000A,?,6D02D8E2), ref: 0051A831
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A83E
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A843
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 0051A848
__vbaStrFixstr.MSVBVM60(00000003,005553AC,?,6D02D8E2), ref: 0051A855
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A85E
__vbaStrFixstr.MSVBVM60(00000003,005553B2,?,6D02D8E2), ref: 0051A867
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A870
__vbaStrFixstr.MSVBVM60(?,00555384,?,6D02D8E2), ref: 0051A879
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A880
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051A888
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A89E
__vbaExitProc.MSVBVM60(?,6D02D8E2), ref: 0051A8A0
__vbaExitProc.MSVBVM60(?,6D02D8E2), ref: 0051A902

Strings

/U, xrefs: 0051A7AE
/U, xrefs: 0051A839
/U, xrefs: 0051A86B
EMS, xrefs: 0051A6F1
/U, xrefs: 0051A859
EDEPART.ZUR, xrefs: 0051A689

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Fixstr$ExitProc$#524ErrorLset$#648BytesCopyDestructFileOpenOwner4
String ID: EDEPART.ZUR$EMS$/U$/U$/U$/U
API String ID: 3325305779-3894079703
Opcode ID: 967d19f3ba89229a8d76770649eab21f324c67f7c977571c297a98bc8e10e28d
Instruction ID: 0614a32dd30b4fec171fabe4ff2108ca91a9f27762766b00b3b20aa4aa4fb846
Opcode Fuzzy Hash: 967d19f3ba89229a8d76770649eab21f324c67f7c977571c297a98bc8e10e28d
Instruction Fuzzy Hash: 6C714D71A40208AFDB04EFA4DE65EED7FB8FF58741F104126F506F21A0EAB05949CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00543D60 Relevance: 94.9, APIs: 51, Strings: 3, Instructions: 439COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 00543D7E
__vbaOnError.MSVBVM60(?,?,?,?,?,004047D6), ref: 00543DAE
__vbaNew.MSVBVM60(0041CEB4,?,?,?,?,004047D6), ref: 00543DC0
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,004047D6), ref: 00543DCB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000048), ref: 00543E15
__vbaOnError.MSVBVM60(000000FF), ref: 00543E4D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000060,?,000000FF), ref: 00543E88
#685.MSVBVM60(?,000000FF), ref: 00543EA7
__vbaObjSet.MSVBVM60(?,00000000,?,000000FF), ref: 00543EB2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C,?,000000FF), ref: 00543EE5
__vbaFreeObj.MSVBVM60(?,000000FF), ref: 00543F0F
__vbaSetSystemError.MSVBVM60(000003E8,?,000000FF), ref: 00543F2E
__vbaOnError.MSVBVM60(?,?,000000FF), ref: 00543F3D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000048,?,?), ref: 00543F98
__vbaOnError.MSVBVM60(000000FF,?,?), ref: 00543FC5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000060,?,000000FF,?,?), ref: 00544000
#685.MSVBVM60(?,000000FF,?,?), ref: 0054401F
__vbaObjSet.MSVBVM60(?,00000000,?,000000FF,?,?), ref: 0054402A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C,?,000000FF,?,?), ref: 0054405D
__vbaFreeObj.MSVBVM60(?,000000FF,?,?), ref: 00544087
#685.MSVBVM60(?,000000FF,?,?), ref: 005440A0
__vbaObjSet.MSVBVM60(?,00000000,?,000000FF,?,?), ref: 005440AB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000001C,?,000000FF,?,?), ref: 005440DE
#685.MSVBVM60(?,?,?,000000FF,?,?), ref: 005440F6
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,000000FF,?,?), ref: 00544101
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000002C,?,?,?,000000FF,?,?), ref: 00544134
__vbaStrI4.MSVBVM60(00000000,AutoUpdate: Runtime error ,0040BC48,?,?,?,000000FF,?,?), ref: 0054415A
__vbaStrMove.MSVBVM60(?,?,?,000000FF,?,?), ref: 00544165
__vbaStrCat.MSVBVM60(00000000,?,?,?,000000FF,?,?), ref: 0054416C
__vbaStrMove.MSVBVM60(?,?,?,000000FF,?,?), ref: 00544177
__vbaStrCat.MSVBVM60(0041BEBC,00000000,?,?,?,000000FF,?,?), ref: 00544183
__vbaStrMove.MSVBVM60(?,?,?,000000FF,?,?), ref: 0054418E
__vbaStrCat.MSVBVM60(?,00000000,?,?,?,000000FF,?,?), ref: 00544199
__vbaStrMove.MSVBVM60(?,?,?,000000FF,?,?), ref: 005441A4
__vbaStrCat.MSVBVM60( deleting folder ,00000000,?,?,?,000000FF,?,?), ref: 005441B0
__vbaStrMove.MSVBVM60(?,?,?,000000FF,?,?), ref: 005441BB
__vbaStrCat.MSVBVM60(00000000,00000000,?,?,?,000000FF,?,?), ref: 005441C8
__vbaStrMove.MSVBVM60(?,?,?,000000FF,?,?), ref: 005441D3
__vbaFreeStrList.MSVBVM60(00000007,?,?,?,?,?,?,?,00000000,?,?,?,000000FF,?,?), ref: 005441FD
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00544210
__vbaOnError.MSVBVM60(?,?,000000FF,?,?), ref: 00544231
__vbaExitProc.MSVBVM60(?,?), ref: 005442A9
__vbaFreeObj.MSVBVM60(005442FB,?,?), ref: 005442F4

Strings

deleting folder , xrefs: 005441AB
AutoUpdate: Runtime error , xrefs: 00544151
(:@, xrefs: 005443B1, 005443B4

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorMove$Free$#685$List$ChkstkExitProcSystem
String ID: deleting folder $(:@$AutoUpdate: Runtime error
API String ID: 2089345552-2866511483
Opcode ID: f0d2a65a8b78499084cd526eddaaa826e5be17c8d0409ebf7b1580aaaddffc06
Instruction ID: 0cdafb66dd93211420386f16a614fda9f17c9090484c3bcbdca6fd83e30ac81e
Opcode Fuzzy Hash: f0d2a65a8b78499084cd526eddaaa826e5be17c8d0409ebf7b1580aaaddffc06
Instruction Fuzzy Hash: EC121675D00208EFDB04DFA4C988BDEBBB8BF48705F208569E506BB2A0DB745A44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0054C2F0 Relevance: 89.6, APIs: 50, Strings: 1, Instructions: 318COMMON

Download Yara Rule

APIs

__vbaFixstrConstruct.MSVBVM60(000000FF,?), ref: 0054C392
__vbaAryConstruct2.MSVBVM60(?,004258B4,00000011), ref: 0054C3A3
__vbaOnError.MSVBVM60(?), ref: 0054C3AB
__vbaStrMove.MSVBVM60 ref: 0054C3D0
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 0054C3DB
__vbaStrCopy.MSVBVM60 ref: 0054C3EB
__vbaExitProc.MSVBVM60 ref: 0054C3F1
#608.MSVBVM60(?,00000000), ref: 0054C406
#607.MSVBVM60(?,00000064,?), ref: 0054C419
__vbaStrVarMove.MSVBVM60(?), ref: 0054C426
__vbaStrMove.MSVBVM60 ref: 0054C431
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0054C440
__vbaStrToAnsi.MSVBVM60(?,?,00000064), ref: 0054C468
__vbaSetSystemError.MSVBVM60(00000000), ref: 0054C470
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0054C484
__vbaFreeStr.MSVBVM60 ref: 0054C489
#608.MSVBVM60(?,00000000), ref: 0054C4A8
__vbaInStrVar.MSVBVM60(?,00000000,?,00000008,?), ref: 0054C4EB
__vbaVarSub.MSVBVM60(?,00000002,00000000), ref: 0054C500
__vbaI4Var.MSVBVM60(00000000), ref: 0054C507
#617.MSVBVM60(?,00004008,00000000), ref: 0054C51C
__vbaStrVarMove.MSVBVM60(?), ref: 0054C529
__vbaStrMove.MSVBVM60 ref: 0054C534
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0054C54A
__vbaStrCopy.MSVBVM60 ref: 0054C569
__vbaFreeStr.MSVBVM60(0054C7F0), ref: 0054C7CB
__vbaAryDestruct.MSVBVM60(00000000,00000064), ref: 0054C7DF
__vbaFreeStr.MSVBVM60 ref: 0054C7E8
__vbaFreeStr.MSVBVM60 ref: 0054C7ED

Strings

d, xrefs: 0054C449

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$#608CopyErrorList$#607#617AnsiConstructConstruct2DestructExitFixstrProcSystemUnicode
String ID: d
API String ID: 1035478686-2564639436
Opcode ID: 21f8a00e708b22907e5ea6b572831608ff202aa9451f59b3ccadcb0ca92f7c52
Instruction ID: 0985b8785dc7c50c49d83ab8168b3461f39569bae0f170522931436ba7189234
Opcode Fuzzy Hash: 21f8a00e708b22907e5ea6b572831608ff202aa9451f59b3ccadcb0ca92f7c52
Instruction Fuzzy Hash: 08D1D6B6D002189BDB14DFD4CE88FDEBBB8BB48700F10859AE606B7154DB746A45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00546BD0 Relevance: 86.1, APIs: 47, Strings: 2, Instructions: 335COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00546C47
__vbaObjSet.MSVBVM60(?,00000000), ref: 00546C89
__vbaLateIdCall.MSVBVM60(00000000), ref: 00546C90
__vbaFreeObj.MSVBVM60 ref: 00546C9C
__vbaStrCat.MSVBVM60(?,?), ref: 00546CAD
__vbaStrMove.MSVBVM60 ref: 00546CBE
__vbaStrCopy.MSVBVM60 ref: 00546CC8
__vbaFreeStr.MSVBVM60 ref: 00546CD1
__vbaInStr.MSVBVM60(00000000,<End of Message>,?,?), ref: 00546CEA
__vbaInStr.MSVBVM60(00000000,<Start of Message>,?,?), ref: 00546D0A
__vbaLenBstr.MSVBVM60(<Start of Message>), ref: 00546D28
#632.MSVBVM60(?,00004008,?,00000003), ref: 00546D68
__vbaStrVarMove.MSVBVM60(?), ref: 00546D72
__vbaStrMove.MSVBVM60 ref: 00546D7D
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 00546DA2
__vbaFreeStr.MSVBVM60 ref: 00546DAE
__vbaFreeVarList.MSVBVM60(00000002,00000003,?), ref: 00546DBE
__vbaLenBstr.MSVBVM60(<End of Message>,0000000A), ref: 00546DEE
#632.MSVBVM60(?,00004008,00000000), ref: 00546E05
__vbaStrVarMove.MSVBVM60(?), ref: 00546E0F
__vbaStrMove.MSVBVM60 ref: 00546E1A
__vbaStrCopy.MSVBVM60 ref: 00546E24
__vbaFreeStr.MSVBVM60 ref: 00546E2D
#632.MSVBVM60(?,00004008,00000000,0000000A), ref: 00546E6B
__vbaStrVarMove.MSVBVM60(?), ref: 00546E75
__vbaStrMove.MSVBVM60 ref: 00546E80
__vbaStrCopy.MSVBVM60 ref: 00546E8A
__vbaFreeStr.MSVBVM60 ref: 00546E93
__vbaLenBstr.MSVBVM60(<End of Message>,0000000A), ref: 00546ECA
#632.MSVBVM60(?,00004008,00000000), ref: 00546EE1
__vbaStrVarMove.MSVBVM60(?), ref: 00546EEB
__vbaStrMove.MSVBVM60 ref: 00546EF6
__vbaStrCopy.MSVBVM60 ref: 00546F00
__vbaFreeStr.MSVBVM60 ref: 00546F09
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 00546F19
__vbaExitProc.MSVBVM60 ref: 00546F93
__vbaFreeStr.MSVBVM60(00546FDA), ref: 00546FD3
__vbaErrorOverflow.MSVBVM60 ref: 00546FF9
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00547069
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00547071
__vbaOnError.MSVBVM60(?), ref: 00547075
__vbaObjSet.MSVBVM60(?,00000000), ref: 00547092
__vbaLateIdCall.MSVBVM60(00000000), ref: 00547099
__vbaFreeObj.MSVBVM60 ref: 005470A5
__vbaExitProc.MSVBVM60 ref: 00547102
__vbaFreeStr.MSVBVM60(0054713D), ref: 00547135
__vbaFreeStr.MSVBVM60 ref: 0054713A

Strings

<Start of Message>, xrefs: 00546D03, 00546D23
<End of Message>, xrefs: 00546CE4, 00546DE9, 00546EC5

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$Copy$#632$BstrError$CallExitLateListProc$EventOverflowRaise
String ID: <End of Message>$<Start of Message>
API String ID: 62674241-2792829184
Opcode ID: 0fab614c544ac0364a80d7648b69296b922623914907c99209ca57b36a89337e
Instruction ID: c84f1ad0f351f791eadc4f7d58c0882df37bb8b964eeea98658bbcd2c124d6c4
Opcode Fuzzy Hash: 0fab614c544ac0364a80d7648b69296b922623914907c99209ca57b36a89337e
Instruction Fuzzy Hash: 43D11DB1D002099FDB04DFA4DA88ADEFBB9FF48704F10812AE506B7264DB74A949CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040729B Relevance: 86.1, APIs: 44, Strings: 5, Instructions: 333COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0053A8F0
#618.MSVBVM60(00000000,00000003), ref: 0053A8FE
__vbaStrMove.MSVBVM60 ref: 0053A90F
#527.MSVBVM60(00000000), ref: 0053A912
__vbaStrMove.MSVBVM60 ref: 0053A91D
__vbaStrCmp.MSVBVM60(EXE,00000000), ref: 0053A925
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0053A93E
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053A983
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053A98A
__vbaStrCat.MSVBVM60( /regserver,00000000,?,00000000), ref: 0053A992
#600.MSVBVM60(00000008,00000002,?,00000000), ref: 0053A9A4
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0053A9AF
__vbaFreeVar.MSVBVM60(?,00000000), ref: 0053A9B8
__vbaStrCat.MSVBVM60(?,?,?,00000000), ref: 0053A9D6
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000), ref: 0053A9FF
__vbaStrMove.MSVBVM60 ref: 0053AA2A
__vbaFreeStr.MSVBVM60 ref: 0053AA48
__vbaStrCat.MSVBVM60(?,AutoUpdate: ,0040BC48), ref: 0053AA66
__vbaStrMove.MSVBVM60(?,AutoUpdate: ,0040BC48), ref: 0053AA6D
__vbaStrCat.MSVBVM60(?,00000000,?,AutoUpdate: ,0040BC48), ref: 0053AA74
__vbaStrMove.MSVBVM60(?,AutoUpdate: ,0040BC48), ref: 0053AA7B
__vbaStrCat.MSVBVM60( does not exist to copy from,00000000,?,AutoUpdate: ,0040BC48), ref: 0053AA83
__vbaStrMove.MSVBVM60(?,AutoUpdate: ,0040BC48), ref: 0053AA8A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00000000,?,AutoUpdate: ,0040BC48), ref: 0053AAA4
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0053A9DD

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaStrCat.MSVBVM60(00000000), ref: 0053AAD3
__vbaStrMove.MSVBVM60 ref: 0053AADA
__vbaFreeStr.MSVBVM60(?), ref: 0053AAF4
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053AB81
__vbaStrMove.MSVBVM60 ref: 0053AB88
__vbaFreeStrList.MSVBVM60(00000002,?,?,?), ref: 0053ABAA
__vbaStrCat.MSVBVM60(?), ref: 0053AC81
__vbaStrMove.MSVBVM60 ref: 0053AC88
__vbaFreeStrList.MSVBVM60(00000002,?,?,?), ref: 0053ACAA
__vbaStrCat.MSVBVM60(?), ref: 0053ACD6
__vbaStrMove.MSVBVM60 ref: 0053ACDD
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0053ACE4
__vbaSetSystemError.MSVBVM60(00000000), ref: 0053ACF3
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0053AD17
#685.MSVBVM60 ref: 0053AD2B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053AD36
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 0053AD5B
__vbaStrI4.MSVBVM60(?,AutoUpdate: Dll Error ,0040BC48), ref: 0053AD7D
__vbaStrMove.MSVBVM60 ref: 0053AD88
__vbaStrCat.MSVBVM60(00000000), ref: 0053AD8B
__vbaStrMove.MSVBVM60 ref: 0053AD92
__vbaStrCat.MSVBVM60( while trying to delete ,00000000), ref: 0053AD9A
__vbaStrMove.MSVBVM60 ref: 0053ADA1
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053ADAA
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053ADB1
__vbaStrCat.MSVBVM60(?,00000000,?,00000000), ref: 0053ADB8
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053ADBF
__vbaStrCat.MSVBVM60( (because update failed),00000000,?,00000000), ref: 0053ADC7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053ADCE
__vbaFreeStrList.MSVBVM60(00000007,?,?,?,?,?,?,?,00000000,?,00000000), ref: 0053ADF4
__vbaFreeObj.MSVBVM60 ref: 0053AE00
__vbaExitProc.MSVBVM60 ref: 0053AE0E

Strings

while trying to delete , xrefs: 0053AD95
AutoUpdate: Dll Error , xrefs: 0053AD74
(because update failed), xrefs: 0053ADC2
EXE, xrefs: 0053A920
/regserver, xrefs: 0053A98D

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$List$Error$AnsiSystem$#527#600#618#685CheckExitHresultProcUnicode
String ID: (because update failed)$ /regserver$ while trying to delete $AutoUpdate: Dll Error $EXE
API String ID: 1281089859-3685653595
Opcode ID: c2a5bd6c7dbfdcc5d084d02825944fe7c99449fb6daba686ccdd55536cba61fc
Instruction ID: 98d89305c0ce3d5c160e392a387bcb0dc91123c626e8118a6fce96482b82a447
Opcode Fuzzy Hash: c2a5bd6c7dbfdcc5d084d02825944fe7c99449fb6daba686ccdd55536cba61fc
Instruction Fuzzy Hash: 7DC1E9B1910208AFDB14DFA4DD88EEEB7B8FF88700F108629F516E7254EB749905CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0054EC90 Relevance: 84.4, APIs: 56, Instructions: 393COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054ECAE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054ECE7
__vbaLenBstr.MSVBVM60(?,?,?,?,?,004047D6), ref: 0054ECFA
__vbaI2I4.MSVBVM60(?,?,?,?,?,004047D6), ref: 0054ED02
#632.MSVBVM60(?,00004008,00000000,00000002), ref: 0054ED8F
#632.MSVBVM60(?,00004008,00000001,00000002), ref: 0054EDCA
__vbaVarCat.MSVBVM60(?,?,?), ref: 0054EDDF
__vbaStrVarMove.MSVBVM60(00000000), ref: 0054EDE6
__vbaStrMove.MSVBVM60 ref: 0054EDF1
__vbaFreeVarList.MSVBVM60(00000005,00000002,00000002,?,?,?), ref: 0054EE10
__vbaStrCmp.MSVBVM60(0042605C,?), ref: 0054EE29
__vbaStrCat.MSVBVM60(?,00426068), ref: 0054EE5B
__vbaStrMove.MSVBVM60 ref: 0054EE66
#581.MSVBVM60(00000000), ref: 0054EE6D
__vbaFpI4.MSVBVM60 ref: 0054EE73
#608.MSVBVM60(?,00000000), ref: 0054EE7E
__vbaVarCat.MSVBVM60(?,?,00000008), ref: 0054EE93
__vbaStrVarMove.MSVBVM60(00000000), ref: 0054EE9A
__vbaStrMove.MSVBVM60 ref: 0054EEA5
__vbaFreeStr.MSVBVM60 ref: 0054EEAE
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0054EEBE
__vbaStrCopy.MSVBVM60 ref: 0054EEE0
__vbaFreeStr.MSVBVM60(0054EF40), ref: 0054EF30
__vbaFreeStr.MSVBVM60 ref: 0054EF39
__vbaErrorOverflow.MSVBVM60(00000002), ref: 0054EF5D
__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0054EF8E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004047D6), ref: 0054EFC7
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 0054EFDA
__vbaI2I4.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 0054EFE2
#632.MSVBVM60(?,00004008,00000001,00000002), ref: 0054F062
__vbaStrVarVal.MSVBVM60(?,?), ref: 0054F070
#516.MSVBVM60(00000000), ref: 0054F077
#573.MSVBVM60(?,00000002), ref: 0054F090
__vbaVarCat.MSVBVM60(?,?,00000008,00000002), ref: 0054F0BE
#619.MSVBVM60(?,00000000), ref: 0054F0CC
__vbaStrVarMove.MSVBVM60(?), ref: 0054F0D9
__vbaStrMove.MSVBVM60 ref: 0054F0E4

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$#632Error$BstrChkstkList$#516#573#581#608#619CopyOverflow
String ID:
API String ID: 1079464490-0
Opcode ID: 179a1b00f1afa7defb40afbbd93139a89231f4a5a22ff948ad9a4ca5eca286f9
Instruction ID: 8ca4745094aa8135c6551005e08c7252800160f0b75840ff2a010ecf1817179f
Opcode Fuzzy Hash: 179a1b00f1afa7defb40afbbd93139a89231f4a5a22ff948ad9a4ca5eca286f9
Instruction Fuzzy Hash: 5702D8B5800208EBDB14DF94D988BDEBBB8FF48705F10856AE506A7260DB755A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00518470 Relevance: 84.2, APIs: 43, Strings: 5, Instructions: 190COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 005184DC

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

__vbaStrCmp.MSVBVM60(QST,?,?,6D02D8E2), ref: 005184F2
__vbaStrCopy.MSVBVM60(?,6D02D8E2), ref: 00518513
__vbaCopyBytes.MSVBVM60(00000400,00553084,00551090,?,6D02D8E2), ref: 0051852E
#648.MSVBVM60(0000000A,?,6D02D8E2), ref: 0051854B
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 0051855D
__vbaStrCat.MSVBVM60(COMPANY.ZUR,?,?,6D02D8E2), ref: 0051856C
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518580
__vbaFileOpen.MSVBVM60(00004304,00000200,?,00000000,?,6D02D8E2), ref: 00518595
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005185A7
__vbaGetFxStr4.MSVBVM60(00000200,?,?,?,?,6D02D8E2), ref: 005185BE
__vbaCopyBytes.MSVBVM60(00000400,00553084,?,?,6D02D8E2), ref: 005185D5
__vbaStrFixstr.MSVBVM60(?,00553230,?,6D02D8E2), ref: 005185E4
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005185EE
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 005185F6
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051860F
__vbaStrFixstr.MSVBVM60(?,00553232,?,6D02D8E2), ref: 00518618
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518622
__vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 0051862A
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00518643
__vbaStrFixstr.MSVBVM60(00000003,00553234,?,6D02D8E2), ref: 0051864C
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518656
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00518659
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518667
__vbaLsetFixstr.MSVBVM60(00000003,00553234,?,?,6D02D8E2), ref: 00518677
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518692
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051869A
__vbaStrFixstr.MSVBVM60(00000003,0055323A,?,6D02D8E2), ref: 005186A3
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005186AD
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 005186B0
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005186BE
__vbaLsetFixstr.MSVBVM60(00000003,0055323A,?,?,6D02D8E2), ref: 005186CE
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005186E9
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005186F1
__vbaStrFixstr.MSVBVM60(0000003C,00553084,?,6D02D8E2), ref: 005186FA
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518704
#523.MSVBVM60(00000000,?,6D02D8E2), ref: 00518707
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518715
__vbaLsetFixstr.MSVBVM60(0000003C,00553084,?,?,6D02D8E2), ref: 00518725
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00518740
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00518748
__vbaExitProc.MSVBVM60(?,6D02D8E2), ref: 0051874A
__vbaFreeStr.MSVBVM60(00518810,?,6D02D8E2), ref: 00518809

Strings

QST, xrefs: 005184ED
COMPANY.ZUR, xrefs: 00518567
/U, xrefs: 0051873B
/U, xrefs: 0051868D
/U, xrefs: 005186E4

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Fixstr$#523CopyLset$BytesErrorExitProc$#648FileOpenStr4
String ID: COMPANY.ZUR$QST$/U$/U$/U
API String ID: 1209191927-75395495
Opcode ID: 6bab9d80a913610586af5246d52133a0a83b10d3f2bef0226d2a7ffe54812895
Instruction ID: 39479439a064d7c545524656c45af79fd38868bfaaf6dcc1ebe04609a190af88
Opcode Fuzzy Hash: 6bab9d80a913610586af5246d52133a0a83b10d3f2bef0226d2a7ffe54812895
Instruction Fuzzy Hash: FE7175B5B402189BDB14DB60CD59B9DBBB8FF98701F4041AAF609A31A1DF705E84CF58

Uniqueness

Uniqueness Score: -1.00%

Function 005477E0 Relevance: 82.5, APIs: 42, Strings: 5, Instructions: 269COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00547849
__vbaStrCopy.MSVBVM60 ref: 00547859
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 0054789A
__vbaStrToAnsi.MSVBVM60(?,?), ref: 005478B0
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 005478C3
__vbaStrToUnicode.MSVBVM60(?,?), ref: 005478D1
__vbaFreeStr.MSVBVM60 ref: 005478E0
__vbaStrI4.MSVBVM60(?,Error ), ref: 005478FC
__vbaStrMove.MSVBVM60 ref: 0054790D
__vbaStrCat.MSVBVM60(00000000), ref: 00547916
__vbaStrMove.MSVBVM60 ref: 0054791D
__vbaStrCat.MSVBVM60( deleting key (,00000000), ref: 00547925
__vbaStrMove.MSVBVM60 ref: 0054792C
__vbaStrMove.MSVBVM60(?,00000000), ref: 0054793D
__vbaStrCat.MSVBVM60(00000000), ref: 00547940
__vbaStrMove.MSVBVM60 ref: 00547947
__vbaStrCat.MSVBVM60(00415210,00000000), ref: 0054794F
__vbaStrMove.MSVBVM60 ref: 00547956
__vbaStrCopy.MSVBVM60 ref: 0054795C
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 0054797C
__vbaStrToAnsi.MSVBVM60(?,?), ref: 005479B4
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 005479C7
__vbaStrToUnicode.MSVBVM60(?,?), ref: 005479D5
__vbaFreeStr.MSVBVM60 ref: 005479E4
__vbaStrCopy.MSVBVM60 ref: 00547AC2
__vbaExitProc.MSVBVM60 ref: 00547B1F
__vbaFreeStr.MSVBVM60(00547B61), ref: 00547B59
__vbaFreeStr.MSVBVM60 ref: 00547B5E

Strings

deleting key (, xrefs: 00547920
deleting value (, xrefs: 00547A2F
Error , xrefs: 005478F6, 00547A07
Unable to open registry key, xrefs: 00547AAC
Unable to parse registry path, xrefs: 00547ABB

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$CopyError$AnsiSystemUnicode$ExitListProc
String ID: deleting key ($ deleting value ($Error $Unable to open registry key$Unable to parse registry path
API String ID: 1567471748-3593031407
Opcode ID: 360aa05a7d32caa13d608ed075795ab92326ee6b3b70a0050dcd824c1cc091c9
Instruction ID: 38b1684becdc22cd34040e16c1bb3c6e847f884e7042e906639238a4bad4f399
Opcode Fuzzy Hash: 360aa05a7d32caa13d608ed075795ab92326ee6b3b70a0050dcd824c1cc091c9
Instruction Fuzzy Hash: 18A1E971E10218ABCB05DFE4DD888EEBBB9FF88710B10852AF502B7654DB745945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0052AE60 Relevance: 82.5, APIs: 42, Strings: 5, Instructions: 219COMMON

Download Yara Rule

APIs

__vbaVarVargNofree.MSVBVM60(6D02D8B1,00000001,00000000), ref: 0052AEC1
__vbaBoolVarNull.MSVBVM60(00000000), ref: 0052AEC8
#611.MSVBVM60 ref: 0052AEDD
__vbaStrMove.MSVBVM60 ref: 0052AEEA
#611.MSVBVM60 ref: 0052AEEC
__vbaStrMove.MSVBVM60 ref: 0052AEF3
#611.MSVBVM60 ref: 0052AEF5
__vbaStrMove.MSVBVM60 ref: 0052AEFC
__vbaStrMove.MSVBVM60(00000002), ref: 0052AF31
#616.MSVBVM60(00000000), ref: 0052AF34
__vbaStrMove.MSVBVM60 ref: 0052AF3F
__vbaStrMove.MSVBVM60(00000004,?,00000000), ref: 0052AF51
#631.MSVBVM60(00000000), ref: 0052AF5A
__vbaStrMove.MSVBVM60 ref: 0052AF61
__vbaStrCat.MSVBVM60(00000000), ref: 0052AF64
__vbaStrMove.MSVBVM60 ref: 0052AF6F
__vbaStrMove.MSVBVM60(00000007,?,00000000), ref: 0052AF81
#631.MSVBVM60(00000000), ref: 0052AF84
__vbaStrMove.MSVBVM60 ref: 0052AF8B
__vbaStrCat.MSVBVM60(00000000), ref: 0052AF8E
__vbaStrMove.MSVBVM60 ref: 0052AF99
__vbaFreeStrList.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?), ref: 0052AFC5
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052AFD4
__vbaStrCmp.MSVBVM60(240000,?), ref: 0052AFE6
#611.MSVBVM60 ref: 0052AFFE
__vbaStrMove.MSVBVM60 ref: 0052B00B
#611.MSVBVM60 ref: 0052B00D
__vbaStrMove.MSVBVM60 ref: 0052B014
__vbaStrMove.MSVBVM60(00000002), ref: 0052B037
#616.MSVBVM60(00000000), ref: 0052B03A
__vbaStrMove.MSVBVM60 ref: 0052B045
__vbaStrMove.MSVBVM60(00000004,?,00000000), ref: 0052B057
#631.MSVBVM60(00000000), ref: 0052B05A
__vbaStrMove.MSVBVM60 ref: 0052B065
__vbaStrCat.MSVBVM60(00000000), ref: 0052B068
__vbaStrMove.MSVBVM60 ref: 0052B073
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 0052B08F
__vbaFreeVar.MSVBVM60 ref: 0052B09B
__vbaStrCmp.MSVBVM60(2400,?), ref: 0052B0AA
__vbaStrCopy.MSVBVM60 ref: 0052B0BC
__vbaStrCopy.MSVBVM60 ref: 0052B0C8
__vbaFreeStr.MSVBVM60(0052B132), ref: 0052B12B

Strings

%@, xrefs: 0052AE8C
000000, xrefs: 0052AFF4
0000, xrefs: 0052B0B4
2400, xrefs: 0052B0A5
240000, xrefs: 0052AFE1

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$#611Free$#631List$#616Copy$BoolNofreeNullVarg
String ID: 0000$000000$2400$240000$%@
API String ID: 2066988502-3958664734
Opcode ID: 7b20de56adf30c9a37ada79d546f84e842662e3b1baae905b476cea6cf790a01
Instruction ID: 198148d0f51f94156648fd659cee1d0631dccd2df48861d0977df7cd0b296d5e
Opcode Fuzzy Hash: 7b20de56adf30c9a37ada79d546f84e842662e3b1baae905b476cea6cf790a01
Instruction Fuzzy Hash: 1781C7B1D00218ABDB04DFA5DD949EEFBB9FF58700F10812AE506B3264EB746A05CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00543850 Relevance: 80.8, APIs: 43, Strings: 3, Instructions: 332COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 005438AC
__vbaObjSetAddref.MSVBVM60(?), ref: 005438BC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,00000024), ref: 005438E1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,0000001C), ref: 0054393A
#527.MSVBVM60(00000000), ref: 00543946
__vbaStrMove.MSVBVM60 ref: 0054394D
__vbaStrVarVal.MSVBVM60(?,?,00000000), ref: 00543958
#527.MSVBVM60(00000000), ref: 0054395F
__vbaStrMove.MSVBVM60 ref: 00543966
__vbaStrCmp.MSVBVM60(00000000), ref: 00543969
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00543986
__vbaFreeVar.MSVBVM60 ref: 00543992
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,00000028), ref: 005439E1
__vbaObjSetAddref.MSVBVM60(?,?), ref: 005439EF
__vbaExitProc.MSVBVM60 ref: 005439F5
__vbaFreeObj.MSVBVM60(00543AA1), ref: 00543A9A

Strings

09@, xrefs: 00543940, 00543B2A, 00543B72, 00543C33, 00543B35, 00543B7D
AutoUpdate: Dll error , xrefs: 00543C03
deleting , xrefs: 00543C24

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckFreeHresult$#527AddrefMove$ErrorExitListProc
String ID: deleting $09@$AutoUpdate: Dll error
API String ID: 1262379196-3097892929
Opcode ID: 3d04f10d99e8e54eba5d1f4b0b2a25aa733ec5fc763fc7102e2513f96a899147
Instruction ID: 7e39bdab27369048bba7fb26866829ae536a0b56deaef83fa2414eaf9ad738cf
Opcode Fuzzy Hash: 3d04f10d99e8e54eba5d1f4b0b2a25aa733ec5fc763fc7102e2513f96a899147
Instruction Fuzzy Hash: E3C1B4B5D00218AFCB14DFA4DD89ADEBBB8FF48700B10452AE506F7264DB749A05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0052EEA0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 455COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0052EEFF
_adj_fdiv_m64.MSVBVM60 ref: 0052EF60
__vbaFpR8.MSVBVM60 ref: 0052EF7A
_adj_fdiv_m64.MSVBVM60 ref: 0052EFBE
__vbaFpR8.MSVBVM60 ref: 0052EFD8
__vbaObjSet.MSVBVM60(?,00000000), ref: 0052F000
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041FA3C,00000064), ref: 0052F043
__vbaFreeObj.MSVBVM60 ref: 0052F04C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041B37C,0000070C), ref: 0052F079
__vbaExitProc.MSVBVM60 ref: 0052F0F8

Strings

(The software is being updated.), xrefs: 0052F48B
1/1/1990, xrefs: 0052F4A1
IMCSHUT.FLG, xrefs: 0052F3C7
IMCUPDAT.FLG, xrefs: 0052F45B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult_adj_fdiv_m64$ErrorExitFreeProc
String ID: (The software is being updated.)$1/1/1990$IMCSHUT.FLG$IMCUPDAT.FLG
API String ID: 3775489860-4251195850
Opcode ID: 13c0e0fa9971adc6cefb78cf90f36cd56b32425456e27721dec7e0f22af39775
Instruction ID: 8b706170f12b702b68e882752ebacf4d629a86a66390220d09972973589bc348
Opcode Fuzzy Hash: 13c0e0fa9971adc6cefb78cf90f36cd56b32425456e27721dec7e0f22af39775
Instruction Fuzzy Hash: 1F027C70901618EBCB14DFA4EE88A9EBFB4FF4A700F20457EE546A72A0C774A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0054A870 Relevance: 75.6, APIs: 42, Strings: 1, Instructions: 385COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054A8D3
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,0000001C), ref: 0054A90E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,00000700), ref: 0054A943
__vbaStrCopy.MSVBVM60 ref: 0054A95B
__vbaStrCopy.MSVBVM60 ref: 0054A963
__vbaStrCopy.MSVBVM60 ref: 0054A96B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054A98D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004253D8,000000A4), ref: 0054A9B1
__vbaFreeObj.MSVBVM60 ref: 0054A9BA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054A9CE
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004253D8,000000A4), ref: 0054A9F2
__vbaFreeObj.MSVBVM60 ref: 0054A9FB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054AA0F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004253D8,000000A4), ref: 0054AA3F
__vbaFreeStr.MSVBVM60 ref: 0054AA48
__vbaFreeObj.MSVBVM60 ref: 0054AA51
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054AA65
__vbaI2I4.MSVBVM60 ref: 0054AA6E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041C24C,000000E4), ref: 0054AA93
__vbaFreeObj.MSVBVM60 ref: 0054AA9C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054AAB6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F758,00000050), ref: 0054AAD3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054AAE7
#712.MSVBVM60(?,____,00000000,?,000000FF,00000000), ref: 0054AB02
__vbaStrMove.MSVBVM60 ref: 0054AB0D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F758,00000054), ref: 0054AB2D
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0054AB41
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0054AB51
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 0054AB6D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018), ref: 0054AB92
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000078), ref: 0054ABB2
__vbaFreeObj.MSVBVM60 ref: 0054ABBE
__vbaHresultCheckObj.MSVBVM60(00000000,?,004241E8,000002B0), ref: 0054AC1F
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 0054AC38
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018), ref: 0054AC5D
__vbaI2I4.MSVBVM60 ref: 0054AC6B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,0000007C), ref: 0054AC85
__vbaFreeObj.MSVBVM60 ref: 0054AC8E
__vbaExitProc.MSVBVM60 ref: 0054ACF2
__vbaFreeStr.MSVBVM60(0054AD39), ref: 0054AD2C
__vbaFreeStr.MSVBVM60 ref: 0054AD31
__vbaFreeStr.MSVBVM60 ref: 0054AD36

Strings

____, xrefs: 0054AAF9

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$Free$Copy$ListNew2$#712ErrorExitMoveProc
String ID: ____
API String ID: 290660795-322806939
Opcode ID: d0232e1f94e96f705689ef663a2a00f316bacc2ba5f0a256100075bf0a6f79b2
Instruction ID: 062dcf9d0aa85bccea6ee3a471603a350962f4881689fe35a2b849a1fca287e2
Opcode Fuzzy Hash: d0232e1f94e96f705689ef663a2a00f316bacc2ba5f0a256100075bf0a6f79b2
Instruction Fuzzy Hash: 4CE13B71940209AFDB04DFA4DD88EDEBBF8FF98705F20412AF541A72A0DB74A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0051A300 Relevance: 68.4, APIs: 37, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 0051A345

Part of subcall function 00517750: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
Part of subcall function 00517750: __vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
Part of subcall function 00517750: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1
Part of subcall function 00517750: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
Part of subcall function 00517750: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

__vbaCopyBytes.MSVBVM60(00000312,00554F78,00551090,?,6D02D8E2), ref: 0051A35F
#648.MSVBVM60(0000000A,?,6D02D8E2), ref: 0051A377
__vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 0051A386
__vbaStrCat.MSVBVM60(RDEPART.ZUR,?,?,6D02D8E2), ref: 0051A39B
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A3AC
__vbaFileOpen.MSVBVM60(00004304,00000189,?,00000000,?,6D02D8E2), ref: 0051A3C0
__vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 0051A3CF
__vbaRecDestruct.MSVBVM60(0040E79C,00554F78,?,?,?,6D02D8E2), ref: 0051A3E5
__vbaGetOwner4.MSVBVM60(00413BB8,00000000,?,6D02D8E2), ref: 0051A3F1
__vbaStrFixstr.MSVBVM60(00000006,005551C6,?,6D02D8E2), ref: 0051A404
__vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051A40B
#581.MSVBVM60(00000000,?,6D02D8E2), ref: 0051A40E
__vbaLsetFixstr.MSVBVM60(00000006,005551C6,?,?,6D02D8E2), ref: 0051A422
__vbaFreeStr.MSVBVM60 ref: 0051A449
__vbaLsetFixstr.MSVBVM60(00000006,005551C6,0040BC48), ref: 0051A461
__vbaStrFixstr.MSVBVM60(00000006,005551C6), ref: 0051A46E
__vbaStrMove.MSVBVM60 ref: 0051A475
__vbaLenBstr.MSVBVM60(00000000), ref: 0051A478
__vbaFreeStr.MSVBVM60 ref: 0051A48E
__vbaLsetFixstr.MSVBVM60(00000006,005551C6,0040BC48), ref: 0051A4A3
__vbaStrFixstr.MSVBVM60(?,005550EE), ref: 0051A4B0
__vbaStrMove.MSVBVM60 ref: 0051A4B7
__vbaStrCmp.MSVBVM60(00411AD8,00000000), ref: 0051A4BF
__vbaFreeStr.MSVBVM60 ref: 0051A4D5
__vbaStrFixstr.MSVBVM60(?,005550F0), ref: 0051A4DE
__vbaStrMove.MSVBVM60 ref: 0051A4E5
__vbaStrCmp.MSVBVM60(00411AD8,00000000), ref: 0051A4ED
__vbaFreeStr.MSVBVM60 ref: 0051A503
__vbaStrFixstr.MSVBVM60(0000003C,00554F78), ref: 0051A50C
__vbaStrMove.MSVBVM60 ref: 0051A513
#523.MSVBVM60(00000000), ref: 0051A516
__vbaStrMove.MSVBVM60 ref: 0051A521
__vbaLsetFixstr.MSVBVM60(0000003C,00554F78,?), ref: 0051A52E
__vbaStrMove.MSVBVM60 ref: 0051A543
__vbaFreeStr.MSVBVM60 ref: 0051A548
__vbaExitProc.MSVBVM60 ref: 0051A54A

Strings

/U, xrefs: 0051A53E
RDEPART.ZUR, xrefs: 0051A396

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FixstrMove$Free$Lset$ErrorExitProc$#523#581#648BstrBytesCopyDestructFileOpenOwner4
String ID: RDEPART.ZUR$/U
API String ID: 3260983411-2744602622
Opcode ID: a1c28b86407f609eed261f27ddd247a6708db54e89afd6f072a90c527e72b6d8
Instruction ID: 86857d38ef2815bba2cc59185d9e20a48c5957bcd5eedeccafb08f70655c5f81
Opcode Fuzzy Hash: a1c28b86407f609eed261f27ddd247a6708db54e89afd6f072a90c527e72b6d8
Instruction Fuzzy Hash: 5B515F75A40208AFDB00DBA4DE5ABEEBFB4FF48701F104126E506F61E0DBB55944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0052DB10 Relevance: 66.8, APIs: 37, Strings: 1, Instructions: 334COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0052DB77
__vbaStrCopy.MSVBVM60 ref: 0052DB7F
__vbaStrCopy.MSVBVM60 ref: 0052DB87
__vbaStrCopy.MSVBVM60 ref: 0052DB8F
__vbaOnError.MSVBVM60(?), ref: 0052DB93
__vbaStrCmp.MSVBVM60(0040BF34,?), ref: 0052DBA2
__vbaObjSet.MSVBVM60(?,00000000), ref: 0052DBBA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F748,00000040), ref: 0052DBE3
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000054), ref: 0052DC0B
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0052DC17
__vbaStrCmp.MSVBVM60(0040BF34,?), ref: 0052DC31
__vbaObjSet.MSVBVM60(?,00000000), ref: 0052DC49
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F748,00000040), ref: 0052DC6C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000054), ref: 0052DC8C
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0052DC98
__vbaStrCat.MSVBVM60(\LAPPAK.DAT,?), ref: 0052DCBC
__vbaStrMove.MSVBVM60 ref: 0052DCC7
__vbaFreeStr.MSVBVM60(?), ref: 0052DCE5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0052DD02
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F748,00000040), ref: 0052DD25
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 0052DD59
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000014), ref: 0052DD7E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040F7B8,00000050), ref: 0052DD9E
__vbaStrCat.MSVBVM60(\LAPPAK.DAT,?), ref: 0052DDA9
__vbaStrMove.MSVBVM60 ref: 0052DDB4
__vbaFreeStrList.MSVBVM60(00000002,?,?,?), ref: 0052DDD9
__vbaFreeObj.MSVBVM60 ref: 0052DDE5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0052DDFE
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F748,00000040), ref: 0052DE21
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,0000009C), ref: 0052DE45
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0052DE51
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F63C,000002A0), ref: 0052DE75
__vbaExitProc.MSVBVM60 ref: 0052DECE
__vbaFreeStr.MSVBVM60(0052DF1A), ref: 0052DF08
__vbaFreeStr.MSVBVM60 ref: 0052DF0D
__vbaFreeStr.MSVBVM60 ref: 0052DF12
__vbaFreeStr.MSVBVM60 ref: 0052DF17

Strings

\LAPPAK.DAT, xrefs: 0052DCB7, 0052DDA4

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckFreeHresult$CopyList$Move$ErrorExitNew2Proc
String ID: \LAPPAK.DAT
API String ID: 2541668140-2072162877
Opcode ID: 840b883f9ccc370e9e284482cfb16fd1ba1e13d810c398e9cc4b61e26152de43
Instruction ID: 547544bf1a81952e097a8119e506b1e0155e72b6ee275f622c92246854e71090
Opcode Fuzzy Hash: 840b883f9ccc370e9e284482cfb16fd1ba1e13d810c398e9cc4b61e26152de43
Instruction Fuzzy Hash: BEB18371900229AFDB14EBA4ED89EEEBBBCFF59701F104125F541F71A0DA70A845CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00537860 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 219COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005378AD
#709.MSVBVM60(?,00411AE0,000000FF,00000000), ref: 005378C7
#709.MSVBVM60(?,00411AE0,000000FF,00000000,?,00411AE0,000000FF,00000000), ref: 005378D8
#616.MSVBVM60(-00000001,-00000001,?,00411AE0,000000FF,00000000,?,00411AE0,000000FF,00000000), ref: 005378E7
__vbaStrMove.MSVBVM60(?,00411AE0,000000FF,00000000,?,00411AE0,000000FF,00000000), ref: 005378F2
__vbaStrCat.MSVBVM60(.ver,?,?,00411AE0,000000FF,00000000), ref: 00537901
__vbaStrMove.MSVBVM60(?,00411AE0,000000FF,00000000), ref: 0053790C
__vbaExitProc.MSVBVM60(?,00411AE0,000000FF,00000000), ref: 00537912
__vbaFreeStr.MSVBVM60(005379B1,?,00411AE0,000000FF,00000000), ref: 005379AA
__vbaErrorOverflow.MSVBVM60(?,00411AE0,000000FF,00000000,?,00411AE0,000000FF,00000000), ref: 005379CE
__vbaOnError.MSVBVM60(?,6D110D5B,?,00000000), ref: 00537A34
__vbaStrToAnsi.MSVBVM60(?,DllRegisterServer), ref: 00537A49
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00537A56
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00537A61
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00537A6C
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00537A89
#685.MSVBVM60 ref: 00537A9B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00537AA6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 00537AC7
__vbaStrI4.MSVBVM60(?,AutoUpdate: Dll Error ,0040BC48), ref: 00537ADB

Strings

AutoUpdate: Dll Error , xrefs: 00537AD2
x-@, xrefs: 005378A6
while trying to register , xrefs: 00537AFF
.ver, xrefs: 005378FC
DllRegisterServer, xrefs: 00537A3A

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$#709AnsiFreeMove$#616#685CheckExitHresultListOverflowProcSystemUnicode
String ID: while trying to register $.ver$AutoUpdate: Dll Error $DllRegisterServer$x-@
API String ID: 843027139-3977734300
Opcode ID: 9df0a22ed86258b8b8e6bbcc3b083e2d16daf603ea15dbdcf440ba3cf9bad5fa
Instruction ID: 5eccd277ebbecd0f1593e11a94204458a3bb69996c8c7fdfb4aa5ab9ed1f4cc6
Opcode Fuzzy Hash: 9df0a22ed86258b8b8e6bbcc3b083e2d16daf603ea15dbdcf440ba3cf9bad5fa
Instruction Fuzzy Hash: 5271E8B5D00218AFCB14DFA9DD89ADEBBB8FF58751F10422AE506B22A0DB745940CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00532B10 Relevance: 66.7, APIs: 37, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00532B58
#525.MSVBVM60(00000104), ref: 00532B63
__vbaStrMove.MSVBVM60 ref: 00532B74
__vbaLenBstr.MSVBVM60(?), ref: 00532B7A
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00532B89
__vbaSetSystemError.MSVBVM60(00000000), ref: 00532B97
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00532BA5
__vbaFreeStr.MSVBVM60 ref: 00532BB4
#616.MSVBVM60(?,00000000), ref: 00532BBB
__vbaStrMove.MSVBVM60 ref: 00532BC6
__vbaStrCat.MSVBVM60(\IMC_ID.DAT,?), ref: 00532BD1
__vbaStrMove.MSVBVM60 ref: 00532BDC
__vbaFreeStr.MSVBVM60 ref: 00532BF8
#648.MSVBVM60(0000000A), ref: 00532C15
__vbaFreeVar.MSVBVM60 ref: 00532C20
__vbaStrCat.MSVBVM60(\IMC_ID.DAT,?), ref: 00532C2F
__vbaStrMove.MSVBVM60 ref: 00532C3A
__vbaFileOpen.MSVBVM60(00004001,000000FF,00000000,00000000), ref: 00532C45
__vbaFreeStr.MSVBVM60 ref: 00532C4E
__vbaInputFile.MSVBVM60(0041C9A4,00000000,?), ref: 00532C5A
__vbaInputFile.MSVBVM60(00420128,00000000,?), ref: 00532C6A
__vbaFileClose.MSVBVM60(00000000), ref: 00532C74
__vbaStrCopy.MSVBVM60 ref: 00532C82
#648.MSVBVM60(0000000A), ref: 00532CA1
__vbaFreeVar.MSVBVM60 ref: 00532CAC
__vbaStrCat.MSVBVM60(\IMC_ID.DAT,?), ref: 00532CBB
__vbaStrMove.MSVBVM60 ref: 00532CC6
__vbaFileOpen.MSVBVM60(00004002,000000FF,00000000,00000000), ref: 00532CD1
__vbaFreeStr.MSVBVM60 ref: 00532CDA
__vbaPrintFile.MSVBVM60(0041AC28,00000000,?), ref: 00532CEC
__vbaPrintFile.MSVBVM60(00420130,00000000,00000000), ref: 00532CF8
__vbaFileClose.MSVBVM60(00000000), ref: 00532CFE
__vbaOnError.MSVBVM60(00000000), ref: 00532D06
__vbaOnError.MSVBVM60(00000000), ref: 00532D0E
__vbaExitProc.MSVBVM60 ref: 00532D14
__vbaFreeStr.MSVBVM60(00532D7B), ref: 00532D73
__vbaFreeStr.MSVBVM60 ref: 00532D78

Strings

\IMC_ID.DAT, xrefs: 00532BCC, 00532C2A, 00532CB6

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FileFree$Move$Error$#648CloseInputOpenPrint$#525#616AnsiBstrCopyExitProcSystemUnicode
String ID: \IMC_ID.DAT
API String ID: 1789694674-299948528
Opcode ID: cd84916c5c963d6e9e0d10fef946de6f9dc6013be4894ed386c42b758861dbbe
Instruction ID: bb9fd120620b31031202844abc8117dbd23d23fe49478b173813a529b8a41d4b
Opcode Fuzzy Hash: cd84916c5c963d6e9e0d10fef946de6f9dc6013be4894ed386c42b758861dbbe
Instruction Fuzzy Hash: 6C512C75900218AFDB04EFA4DE89AEEBBB9FF48711F144129F606B32A0DB745941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 005450E0 Relevance: 63.4, APIs: 35, Strings: 1, Instructions: 373COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 005450FE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054513A
#598.MSVBVM60(?,?,?,?,004047D6), ref: 0054515D
__vbaObjSet.MSVBVM60(00000000,00000000,?,?,?,?,004047D6), ref: 00545194
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,0000012C), ref: 005451CB
__vbaFreeObj.MSVBVM60 ref: 005451E0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545201
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000054), ref: 00545235
__vbaFreeObj.MSVBVM60 ref: 0054524A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054526B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,000001B4), ref: 005452A6
__vbaFreeObj.MSVBVM60 ref: 005452BB
__vbaObjSet.MSVBVM60(?,00000000), ref: 005452DC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000050), ref: 0054530F
__vbaStrCmp.MSVBVM60([ImcDDEIgnore],?), ref: 0054532A
__vbaFreeStr.MSVBVM60 ref: 0054533F
__vbaFreeObj.MSVBVM60 ref: 00545348
__vbaHresultCheckObj.MSVBVM60(00000000,?,004229D8,00000710), ref: 00545387
__vbaObjSet.MSVBVM60(00000000,00000000,?,?,?,?,004047D6), ref: 005453C6
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000050), ref: 005453F9
__vbaStrCmp.MSVBVM60(?), ref: 00545415
__vbaFreeStr.MSVBVM60 ref: 00545429
__vbaFreeObj.MSVBVM60 ref: 00545432
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054545B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000054), ref: 0054548F
__vbaFreeObj.MSVBVM60 ref: 005454A4
__vbaObjSet.MSVBVM60(?,00000000), ref: 005454C5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000054), ref: 005454FA
__vbaFreeObj.MSVBVM60 ref: 0054550F
#598.MSVBVM60 ref: 0054551C
#685.MSVBVM60 ref: 00545529
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545534
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000001C), ref: 00545567
__vbaFreeObj.MSVBVM60 ref: 0054558B
__vbaFreeStr.MSVBVM60(005455CA,?,?,?,?,004047D6), ref: 005455C3

Strings

[ImcDDEIgnore], xrefs: 0054520A, 00545325, 00545464

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CheckHresult$#598$#685ChkstkError
String ID: [ImcDDEIgnore]
API String ID: 3009146042-1376360919
Opcode ID: c21b5a9c10166b410ac7ba3090dd0ebef4cbe711c95a6f4c0596a6e59aa057e5
Instruction ID: 4f7f3c962b237c9d1caabe0e50cde5d95fb7079683e3de1570530873a82465ee
Opcode Fuzzy Hash: c21b5a9c10166b410ac7ba3090dd0ebef4cbe711c95a6f4c0596a6e59aa057e5
Instruction Fuzzy Hash: F7F10674D10609EFDB04DFA0D988AEEBBB5FF48705F208529F502AB2A0DB749984CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00536150 Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 282COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 005361AA
__vbaStrCat.MSVBVM60(00000000), ref: 005361BC
__vbaStrMove.MSVBVM60 ref: 005361C7

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStr.MSVBVM60(?), ref: 005361E5
__vbaStrCat.MSVBVM60(00000000,004047D6), ref: 0053622A
__vbaStrMove.MSVBVM60 ref: 00536235
__vbaFreeStr.MSVBVM60(?), ref: 00536252
__vbaStrCat.MSVBVM60(?,AutoUpdate: Needs update - doesn't exist in target folder: ,0040BC48), ref: 00536275
__vbaStrMove.MSVBVM60(?,AutoUpdate: Needs update - doesn't exist in target folder: ,0040BC48), ref: 00536280
__vbaFreeStr.MSVBVM60(00000000,?,AutoUpdate: Needs update - doesn't exist in target folder: ,0040BC48), ref: 0053628F
__vbaStrCat.MSVBVM60(?,00000000), ref: 005362B6
__vbaStrMove.MSVBVM60 ref: 005362C1
__vbaFreeStrList.MSVBVM60(00000002,?,?,?), ref: 005362E5
__vbaStrCat.MSVBVM60(?,AutoUpdate: Needs update - ver file doesn't exist in target folder: ,0040BC48), ref: 0053630B
__vbaStrMove.MSVBVM60(?,AutoUpdate: Needs update - ver file doesn't exist in target folder: ,0040BC48), ref: 00536316
__vbaFreeStr.MSVBVM60(00000000,?,AutoUpdate: Needs update - ver file doesn't exist in target folder: ,0040BC48), ref: 00536325
__vbaStrCat.MSVBVM60(00000000,AutoUpdate: Needs update - ver files are different: ,0040BC48), ref: 0053639D
__vbaStrMove.MSVBVM60 ref: 005363A8

Part of subcall function 00524BC0: __vbaChkstk.MSVBVM60(00000000,004047D6), ref: 00524BDE
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60(6D02D8B1,00000001,00000000,00000000,004047D6), ref: 00524C0E
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60 ref: 00524C1A
Part of subcall function 00524BC0: __vbaOnError.MSVBVM60(000000FF), ref: 00524C29
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(000007D0,?), ref: 00524C42
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C50
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524C57
Part of subcall function 00524BC0: #525.MSVBVM60(00000000), ref: 00524C5E
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C6C
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(000007D0,?,00000000), ref: 00524C7F
Part of subcall function 00524BC0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00524C95
Part of subcall function 00524BC0: __vbaCopyBytes.MSVBVM60(000007EE,?,?), ref: 00524CB8
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000003,?,MSG), ref: 00524CD3
Part of subcall function 00524BC0: #520.MSVBVM60(?,00004008), ref: 00524D04
Part of subcall function 00524BC0: __vbaStrVarMove.MSVBVM60(?), ref: 00524D11
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D1F
Part of subcall function 00524BC0: __vbaFreeVar.MSVBVM60 ref: 00524D2B
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(?), ref: 00524D3F
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(00000096,?), ref: 00524D53
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D61
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524D68

__vbaFreeStr.MSVBVM60(00000000), ref: 005363B7
__vbaStrCat.MSVBVM60(?,00000000), ref: 005363E4
__vbaStrMove.MSVBVM60 ref: 005363EB
__vbaStrCat.MSVBVM60(?), ref: 00536414
__vbaStrMove.MSVBVM60 ref: 0053641B
__vbaStrCmp.MSVBVM60(?,?), ref: 00536437
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00536461
__vbaExitProc.MSVBVM60 ref: 005364E1

Strings

AutoUpdate: Needs update - doesn't exist in target folder: , xrefs: 0053626D
AutoUpdate: Needs update - ver file doesn't exist in target folder: , xrefs: 00536303
AutoUpdate: Needs update - ver file doesn't exist in source folder: , xrefs: 00536395
AutoUpdate: Needs update - ver files are different: , xrefs: 0053647F
AutoUpdate: Needs update - client is being forced: , xrefs: 00536214

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Fixstr$BstrCopyErrorList$Lset$#520#525AnsiBytesChkstkExitProcSystemUnicode
String ID: AutoUpdate: Needs update - client is being forced: $AutoUpdate: Needs update - doesn't exist in target folder: $AutoUpdate: Needs update - ver file doesn't exist in source folder: $AutoUpdate: Needs update - ver file doesn't exist in target folder: $AutoUpdate: Needs update - ver files are different:
API String ID: 2713773130-2847673832
Opcode ID: 1b76700a9632612deb4dec12aa918ceec641cc9ac6a442c164b6b53a64dd85fd
Instruction ID: de3a728d33b9d10571979be6eb7d3f92d480469aa098d28bb3df6a18b159051c
Opcode Fuzzy Hash: 1b76700a9632612deb4dec12aa918ceec641cc9ac6a442c164b6b53a64dd85fd
Instruction Fuzzy Hash: 26A15175900204EFCB14DFA4D989DEEBBB9FF88701B10465AF502B72A4DB74AD44CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004072DC Relevance: 59.7, APIs: 29, Strings: 5, Instructions: 216COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0053BDDE
__vbaOnError.MSVBVM60(?,6D02D8B1,6D01A323,?,00000000,004047D6), ref: 0053BE0E
__vbaNew.MSVBVM60(0041CEB4), ref: 0053BE20
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053BE2B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CEC4,00000044), ref: 0053BE68
__vbaStrCat.MSVBVM60(\Microsoft.NET\Framework\v4.0.30319\regasm.exe,?), ref: 0053BEB9
__vbaStrMove.MSVBVM60 ref: 0053BEC4
__vbaFreeStr.MSVBVM60 ref: 0053BECD
__vbaMidStmtBstr.MSVBVM60(00000000,0040920C,?,?,?,?), ref: 0053BF00
__vbaStrCat.MSVBVM60(\Microsoft.NET\Framework\v4.0.30319\regasm.exe,?), ref: 0053BF66
__vbaStrMove.MSVBVM60 ref: 0053BF71
__vbaFreeStr.MSVBVM60 ref: 0053BF7A
__vbaStrCopy.MSVBVM60(?), ref: 0053BFE0
__vbaStrCat.MSVBVM60(00414B08,Unable to find Regasm.exe, Please have System Administrator install .NET Framework 4.0), ref: 0053BFF0
__vbaStrMove.MSVBVM60 ref: 0053BFFB
__vbaStrCat.MSVBVM60(Once the Framework is installed you will need to reinstall the Pervasive Client,00000000), ref: 0053C007
__vbaStrMove.MSVBVM60 ref: 0053C012
__vbaStrCat.MSVBVM60(00414B08,00000000), ref: 0053C01E
__vbaStrMove.MSVBVM60 ref: 0053C029
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053C034
__vbaStrMove.MSVBVM60 ref: 0053C03F

Part of subcall function 00526160: __vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000), ref: 005261DB
Part of subcall function 00526160: __vbaObjIs.MSVBVM60(?,00000000), ref: 005261E8
Part of subcall function 00526160: __vbaVargVar.MSVBVM60(?), ref: 00526285

__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,?,?,00000000,0000000A,00000000), ref: 0053C074
__vbaFreeVar.MSVBVM60 ref: 0053C080
__vbaOnError.MSVBVM60(000000FF), ref: 0053C281
__vbaCastObj.MSVBVM60(00000000,0041CEA4), ref: 0053C295
__vbaObjSet.MSVBVM60(?,00000000), ref: 0053C2A0
__vbaExitProc.MSVBVM60 ref: 0053C31D
__vbaFreeObj.MSVBVM60(0053C366), ref: 0053C356
__vbaFreeStr.MSVBVM60 ref: 0053C35F

Strings

\Microsoft.NET\Framework\v4.0.30319\regasm.exe, xrefs: 0053BEB4, 0053BF61
RegAsm Check, xrefs: 0053BFD8
Once the Framework is installed you will need to reinstall the Pervasive Client, xrefs: 0053C002
Unable to find Regasm.exe, Please have System Administrator install .NET Framework 4.0, xrefs: 0053BFE6
$, xrefs: 0053C287

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FreeMove$Error$BstrCastCheckChkstkCopyExitHresultListProcStmtVarg
String ID: $$Once the Framework is installed you will need to reinstall the Pervasive Client$RegAsm Check$Unable to find Regasm.exe, Please have System Administrator install .NET Framework 4.0$\Microsoft.NET\Framework\v4.0.30319\regasm.exe
API String ID: 1546219165-1319911226
Opcode ID: d16eae105322315769cae9fc14996b0358112821e5ebae75ac4818afa5c2df66
Instruction ID: 15ec481be87879d1dfac2bfcb2a091dfc50cb55d7d0e8fd58bb245d680315f08
Opcode Fuzzy Hash: d16eae105322315769cae9fc14996b0358112821e5ebae75ac4818afa5c2df66
Instruction Fuzzy Hash: B691F975900208EFDB04DFE4DA98BEEBBB9BF48705F208169F502B72A0DB745A45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00517CD0 Relevance: 59.6, APIs: 24, Strings: 10, Instructions: 135COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517D15

Part of subcall function 0052A890: __vbaStrCat.MSVBVM60(JAILCTRL.ZUR,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052A8D5
Part of subcall function 0052A890: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,00000000,004047D6), ref: 0052A8E2
Part of subcall function 0052A890: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052A8F9
Part of subcall function 0052A890: __vbaStrCopy.MSVBVM60 ref: 0052A910
Part of subcall function 0052A890: __vbaStrCopy.MSVBVM60 ref: 0052A91C

__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517D25
__vbaStrCmp.MSVBVM60(JMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517D3A
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517D45
__vbaStrCmp.MSVBVM60(RMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517D5E
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517D69
__vbaFreeStr.MSVBVM60(00517F16,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517F0F

Part of subcall function 00519830: __vbaOnError.MSVBVM60(?,?,6D02D8E2), ref: 00519875
Part of subcall function 00519830: __vbaCopyBytes.MSVBVM60(000004B0,00553E4E,00551090,?,6D02D8E2), ref: 0051988F
Part of subcall function 00519830: #648.MSVBVM60(0000000A,?,6D02D8E2), ref: 005198A7
Part of subcall function 00519830: __vbaFreeVar.MSVBVM60(?,6D02D8E2), ref: 005198B6
Part of subcall function 00519830: __vbaStrCat.MSVBVM60(JDEPART.ZUR,?,?,6D02D8E2), ref: 005198CB
Part of subcall function 00519830: __vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 005198DC
Part of subcall function 00519830: __vbaFileOpen.MSVBVM60(00004304,00000258,?,00000000,?,6D02D8E2), ref: 005198F0
Part of subcall function 00519830: __vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 005198FF
Part of subcall function 00519830: __vbaRecDestruct.MSVBVM60(0040DFBC,00553E4E,?,?,?,6D02D8E2), ref: 00519915
Part of subcall function 00519830: __vbaGetOwner4.MSVBVM60(00412F80,00000000,?,6D02D8E2), ref: 00519921
Part of subcall function 00519830: __vbaStrFixstr.MSVBVM60(?,00553FDC,?,6D02D8E2), ref: 00519934
Part of subcall function 00519830: __vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 0051993B
Part of subcall function 00519830: __vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519943
Part of subcall function 00519830: __vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519959
Part of subcall function 00519830: __vbaStrFixstr.MSVBVM60(?,00553FDE,?,6D02D8E2), ref: 00519962
Part of subcall function 00519830: __vbaStrMove.MSVBVM60(?,6D02D8E2), ref: 00519969
Part of subcall function 00519830: __vbaStrCmp.MSVBVM60(00411AD8,00000000,?,6D02D8E2), ref: 00519971
Part of subcall function 00519830: __vbaFreeStr.MSVBVM60(?,6D02D8E2), ref: 00519987
Part of subcall function 00519830: __vbaStrFixstr.MSVBVM60(?,00554174,?,6D02D8E2), ref: 00519990

Strings

QST, xrefs: 00517DE9
CIV, xrefs: 00517E0D
MPS, xrefs: 00517D7D
RMS, xrefs: 00517D59
REP, xrefs: 00517E31
INV, xrefs: 00517DC5
FMS, xrefs: 00517DA1
EMS, xrefs: 00517E55
JMS, xrefs: 00517D2F
AMS, xrefs: 00517E79

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$CopyFixstr$ErrorExitProc$#648BytesDestructFileOpenOwner4
String ID: AMS$CIV$EMS$FMS$INV$JMS$MPS$QST$REP$RMS
API String ID: 3892184802-4101040264
Opcode ID: 05db429c327efea6b3fa1b59f96f6db6d6b5d3c42642ac35d559d5b559211c62
Instruction ID: 93e5b281f876708bde6bc397d787031284e8c8fb83008ee3ca6a453f20b8fca0
Opcode Fuzzy Hash: 05db429c327efea6b3fa1b59f96f6db6d6b5d3c42642ac35d559d5b559211c62
Instruction Fuzzy Hash: B2412071A4520EABE711EBE8DE06EEF7EB5BF4C744B204416FA01E1564EB7048C18B76

Uniqueness

Uniqueness Score: -1.00%

Function 0052B150 Relevance: 58.7, APIs: 39, Instructions: 179COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,?,0051C230), ref: 0052B16E
__vbaOnError.MSVBVM60(?,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0052B19E
#610.MSVBVM60(?), ref: 0052B1AF
#545.MSVBVM60(?,?), ref: 0052B1BD
__vbaStrVarMove.MSVBVM60(?), ref: 0052B1C7
__vbaStrMove.MSVBVM60 ref: 0052B1D2
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B1E2
#610.MSVBVM60(?), ref: 0052B1F6
#542.MSVBVM60(?,?), ref: 0052B204
__vbaStrVarMove.MSVBVM60(?), ref: 0052B20E
__vbaStrMove.MSVBVM60 ref: 0052B219
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B229
#610.MSVBVM60(?), ref: 0052B23D
#553.MSVBVM60(?,?), ref: 0052B24B
__vbaStrVarMove.MSVBVM60(?), ref: 0052B255
__vbaStrMove.MSVBVM60 ref: 0052B260
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B270
__vbaLenBstr.MSVBVM60(?), ref: 0052B284
__vbaStrCat.MSVBVM60(?,0040BF2C), ref: 0052B29F
__vbaStrMove.MSVBVM60 ref: 0052B2AA
__vbaLenBstr.MSVBVM60(?), ref: 0052B2BD
__vbaStrCat.MSVBVM60(?,0040BF2C), ref: 0052B2D8
__vbaStrMove.MSVBVM60 ref: 0052B2E3
__vbaLenBstr.MSVBVM60(?), ref: 0052B2F6
__vbaStrCat.MSVBVM60(?,0040BF2C), ref: 0052B311
__vbaStrMove.MSVBVM60 ref: 0052B31C
__vbaStrCat.MSVBVM60(0041DEF8,?), ref: 0052B334
__vbaStrMove.MSVBVM60 ref: 0052B33F
__vbaStrCat.MSVBVM60(?,00000000), ref: 0052B34A
__vbaStrMove.MSVBVM60 ref: 0052B355
__vbaStrCat.MSVBVM60(0041DEF8,00000000), ref: 0052B361
__vbaStrMove.MSVBVM60 ref: 0052B36C
__vbaStrCat.MSVBVM60(?,00000000), ref: 0052B377
__vbaStrMove.MSVBVM60 ref: 0052B382
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0052B396
__vbaExitProc.MSVBVM60 ref: 0052B411
__vbaFreeStr.MSVBVM60(0052B478), ref: 0052B45F
__vbaFreeStr.MSVBVM60 ref: 0052B468
__vbaFreeStr.MSVBVM60 ref: 0052B471

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$List$#610Bstr$#542#545#553ChkstkErrorExitProc
String ID:
API String ID: 3221568732-0
Opcode ID: b274043b64c470ba96c0abc7072f2fa47492fb72ccec82135b63b1431db0c8d4
Instruction ID: 94b4d92971eaa988826ebe2e89700f6996a9dbb37e1722cbf036345295cd11b3
Opcode Fuzzy Hash: b274043b64c470ba96c0abc7072f2fa47492fb72ccec82135b63b1431db0c8d4
Instruction Fuzzy Hash: 87712E75D00208EFEB04DFE0DE88AEEBB79FF44705F108165E512B65A0DB745A49CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0054A1B0 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

#525.MSVBVM60(00000080), ref: 0054A280
__vbaStrMove.MSVBVM60 ref: 0054A28E
__vbaLsetFixstr.MSVBVM60(00000080,?,00000000), ref: 0054A2A1
__vbaFreeStr.MSVBVM60 ref: 0054A2AD
__vbaRecUniToAnsi.MSVBVM60(0040E900,?,00000094), ref: 0054A2C6
__vbaSetSystemError.MSVBVM60(00000000), ref: 0054A2D8
__vbaRecAnsiToUni.MSVBVM60(0040E900,00000094,?), ref: 0054A2ED
__vbaStrToAnsi.MSVBVM60(?,NTLM,?), ref: 0054A32E
__vbaStrToAnsi.MSVBVM60(?,NTLM,?), ref: 0054A34C
__vbaSetSystemError.MSVBVM60(00000000), ref: 0054A358
__vbaFreeStr.MSVBVM60 ref: 0054A360
__vbaSetSystemError.MSVBVM60(?,?,00000014), ref: 0054A378
__vbaSetSystemError.MSVBVM60(?), ref: 0054A39B
__vbaSetSystemError.MSVBVM60 ref: 0054A3A8
__vbaSetSystemError.MSVBVM60(?,00000008,?), ref: 0054A3BF
__vbaSetSystemError.MSVBVM60 ref: 0054A3DD
__vbaSetSystemError.MSVBVM60(?,00000008,?), ref: 0054A3F4
__vbaStrCopy.MSVBVM60 ref: 0054A40F
__vbaLenBstr.MSVBVM60 ref: 0054A41B
__vbaStrCopy.MSVBVM60 ref: 0054A42C
__vbaLenBstr.MSVBVM60 ref: 0054A438
__vbaStrCopy.MSVBVM60 ref: 0054A449
__vbaLenBstr.MSVBVM60 ref: 0054A455
__vbaSetSystemError.MSVBVM60(?), ref: 0054A5AD
__vbaSetSystemError.MSVBVM60(00000000), ref: 0054A5D1
__vbaSetSystemError.MSVBVM60(?), ref: 0054A5FE
__vbaSetSystemError.MSVBVM60(?), ref: 0054A62B
__vbaSetSystemError.MSVBVM60 ref: 0054A63B
__vbaSetSystemError.MSVBVM60(00000000,00000000,?), ref: 0054A649
__vbaSetSystemError.MSVBVM60 ref: 0054A659
__vbaSetSystemError.MSVBVM60(00000000,00000000,?), ref: 0054A667
__vbaRecDestruct.MSVBVM60(00423970,?,0054A68D), ref: 0054A686

Strings

NTLM, xrefs: 0054A328, 0054A346

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ErrorSystem$Ansi$BstrCopy$Free$#525DestructFixstrLsetMove
String ID: NTLM
API String ID: 649674787-1704676186
Opcode ID: 012de8c934c641eda5c436b048f80c059dad3196b9f5e37c27ae1374e38abdc0
Instruction ID: 999c7b2ec3ffd61923e30b1bce9c2f149f6782cc1a07edf3351c35891a58c93d
Opcode Fuzzy Hash: 012de8c934c641eda5c436b048f80c059dad3196b9f5e37c27ae1374e38abdc0
Instruction Fuzzy Hash: 8AE13E71D002189FDB61EFA4CC84AEEB7B9FF88704F40859DE509A7290DB745A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00406E29 Relevance: 56.3, APIs: 28, Strings: 4, Instructions: 275COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0053090E
__vbaOnError.MSVBVM60(000000FF,?,6D02D8B1,00000000,00000000,004047D6), ref: 0053093E
__vbaI2I4.MSVBVM60(?,?,?,?,004047D6), ref: 0053094D
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041B34C,0000009C), ref: 00530989
__vbaChkstk.MSVBVM60 ref: 005309D2
__vbaChkstk.MSVBVM60 ref: 00530A01
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041B34C,000002B0), ref: 00530A5A
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00530A9E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000028), ref: 00530B04
__vbaLateMemCallLd.MSVBVM60(?,?,count,00000000), ref: 00530B3C
__vbaVarSub.MSVBVM60(?,?,00000000), ref: 00530B51
__vbaI2Var.MSVBVM60(00000000), ref: 00530B58
__vbaFreeObj.MSVBVM60(?,?,?,004047D6), ref: 00530B65

Strings

IMC, xrefs: 005327C3
count, xrefs: 00530B2F
', xrefs: 00532728
hqU, xrefs: 00530ABA

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckChkstkHresult$CallErrorFreeLateNew2
String ID: '$IMC$count$hqU
API String ID: 1365647829-629121883
Opcode ID: b8ebf50a0d6e2c333dbb56aefc611cea072c8f1fed38bcffbd41b00fc77b2b66
Instruction ID: 9d95f285037f65a3404051b94ce0d4fbdaeea588be062808b7e75696817ae9dd
Opcode Fuzzy Hash: b8ebf50a0d6e2c333dbb56aefc611cea072c8f1fed38bcffbd41b00fc77b2b66
Instruction Fuzzy Hash: C5D115B4900318EFEB14DFA4D998BDEBBB5FF48300F108199E50AA7290DB745A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0052A490 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 216COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0052A50E
#669.MSVBVM60 ref: 0052A514
__vbaStrMove.MSVBVM60 ref: 0052A525
#617.MSVBVM60(?,00004008,?), ref: 0052A54D
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 0052A56E
__vbaFreeVar.MSVBVM60 ref: 0052A57D
#631.MSVBVM60(?,00000002,0000000A), ref: 0052A5B4
__vbaStrMove.MSVBVM60 ref: 0052A5BF
__vbaFreeVar.MSVBVM60 ref: 0052A5C4
__vbaVarDup.MSVBVM60 ref: 0052A5FB
__vbaStrCat.MSVBVM60(0041D8B4,?,0000000A,000000FF,00000000), ref: 0052A611
__vbaStrMove.MSVBVM60 ref: 0052A61C
#711.MSVBVM60(?,00000000), ref: 0052A623
__vbaVarIndexLoadRefLock.MSVBVM60(?,?,?,?), ref: 0052A65F
#617.MSVBVM60(?,00000000,?), ref: 0052A683
__vbaAryUnlock.MSVBVM60(?), ref: 0052A689
__vbaInStrVar.MSVBVM60(?,00000000,?,00000008,?), ref: 0052A6A4
__vbaBoolVarNull.MSVBVM60(00000000), ref: 0052A6AB
__vbaFreeStr.MSVBVM60 ref: 0052A6B6
__vbaFreeVarList.MSVBVM60(00000005,0000000A,?,?,?,?), ref: 0052A6D5
__vbaVarDup.MSVBVM60 ref: 0052A714
#711.MSVBVM60(?,?,0000000A,000000FF,00000000), ref: 0052A729
__vbaVarIndexLoad.MSVBVM60(?,?,?), ref: 0052A761
__vbaStrVarMove.MSVBVM60(00000000), ref: 0052A76B
__vbaStrMove.MSVBVM60 ref: 0052A776
__vbaFreeVarList.MSVBVM60(00000003,0000000A,?,?), ref: 0052A786
__vbaStrCopy.MSVBVM60 ref: 0052A797
__vbaExitProc.MSVBVM60 ref: 0052A7A3
__vbaFreeStr.MSVBVM60(0052A86E), ref: 0052A867

Strings

4ZU, xrefs: 0052A792
/\-, xrefs: 0052A668

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$#617#711IndexListLoad$#631#669BoolCopyErrorExitLockNullProcUnlock
String ID: /\-$4ZU
API String ID: 3111010882-2984497330
Opcode ID: 7dc319b642ea873b879e8b5a7b2302a40e4f84c9d824ca944e30e8a108d88d0c
Instruction ID: 59ab12264ea3d6aa1fe2520953b7427b2571866267d33938e776004e6fd659f2
Opcode Fuzzy Hash: 7dc319b642ea873b879e8b5a7b2302a40e4f84c9d824ca944e30e8a108d88d0c
Instruction Fuzzy Hash: 50A1E6B1D002189FDB14DFA5CE44ADDFBB8FF48300F10829AE50AA7261DBB45A49CF64

Uniqueness

Uniqueness Score: -1.00%

Function 005296E0 Relevance: 52.9, APIs: 35, Instructions: 438COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,00000000), ref: 0052974F
__vbaSetSystemError.MSVBVM60 ref: 00529763
__vbaSetSystemError.MSVBVM60(?,000000F0,?,?), ref: 00529789
__vbaNew2.MSVBVM60(004105F0,00557168,?,000000F0,?,?), ref: 00529A6C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,000000F0,?,?), ref: 00529A91
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000080,?,000000F0,?,?), ref: 00529AB7
__vbaNew2.MSVBVM60(004105F0,00557168,?,000000F0,?,?), ref: 00529ACB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,000000F0,?,?), ref: 00529AF0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000088,?,000000F0,?,?), ref: 00529B16
__vbaNew2.MSVBVM60(004105F0,00557168,?,000000F0,?,?), ref: 00529B2A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,000000F0,?,?), ref: 00529B4F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000080,?,000000F0,?,?), ref: 00529B75
__vbaNew2.MSVBVM60(004105F0,00557168,?,000000F0,?,?), ref: 00529B89
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,000000F0,?,?), ref: 00529BAE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000088,?,000000F0,?,?), ref: 00529BD4
__vbaFpI4.MSVBVM60(?,?,?,?,000000F0,?,?), ref: 00529C16
__vbaFpI4.MSVBVM60(?,?,00000000,?,000000F0,?,?), ref: 00529C51
__vbaFpI4.MSVBVM60(?,?,00000000,?,000000F0,?,?), ref: 00529C8C
__vbaFpI4.MSVBVM60(?,?,00000000,?,000000F0,?,?), ref: 00529CC7
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,000000F0,?,?), ref: 00529CD5

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$ErrorNew2$System
String ID:
API String ID: 1375553304-0
Opcode ID: a126ebe4e6bf8e67b54fa9796d948438c00e7b1708761f0e34ba2e41708523cc
Instruction ID: 9fe61fe9c3fc516da2af5bcac987d414cca2540240d46b74105aa48b4c3f861c
Opcode Fuzzy Hash: a126ebe4e6bf8e67b54fa9796d948438c00e7b1708761f0e34ba2e41708523cc
Instruction Fuzzy Hash: 72F19D70900219EBDF10DFA4ED88EAEBBB9FF99301F108169E545B72A4DB309895CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00536760 Relevance: 52.6, APIs: 26, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 005367B9

Part of subcall function 0052CC00: __vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC45
Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052CC70
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC7D
Part of subcall function 0052CC00: __vbaStrCat.MSVBVM60(CcwAssemblies,00000000), ref: 0052CC85
Part of subcall function 0052CC00: __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC8C
Part of subcall function 0052CC00: __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC91
Part of subcall function 0052CC00: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC97

__vbaStrMove.MSVBVM60(?), ref: 005367D6
__vbaStrCat.MSVBVM60(\VersionFolder.txt,00000000), ref: 005367E4
__vbaStrMove.MSVBVM60 ref: 005367EB
__vbaFreeStr.MSVBVM60 ref: 005367F0

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

#648.MSVBVM60(0000000A,?), ref: 00536816
__vbaFreeVar.MSVBVM60 ref: 00536827
__vbaFileOpen.MSVBVM60(?,000000FF,00000000,?), ref: 00536832
__vbaLineInputStr.MSVBVM60(?,00000000), ref: 0053683D
__vbaFileClose.MSVBVM60(00000000), ref: 00536844
#520.MSVBVM60(0000000A,00004008), ref: 0053685F
__vbaStrVarMove.MSVBVM60(0000000A), ref: 00536869
__vbaStrMove.MSVBVM60 ref: 00536874
__vbaFreeVar.MSVBVM60 ref: 00536879
__vbaStrCmp.MSVBVM60(0040BC48,?,?), ref: 0053688A
__vbaStrCopy.MSVBVM60 ref: 0053689A
__vbaExitProc.MSVBVM60 ref: 005368A0
__vbaStrCopy.MSVBVM60 ref: 005368B8
__vbaStrCat.MSVBVM60(?,AutoUpdate: ,0040BC48), ref: 005368CC
__vbaStrMove.MSVBVM60 ref: 005368D3
__vbaStrCat.MSVBVM60( doesn't exist.,00000000), ref: 005368DB
__vbaStrMove.MSVBVM60 ref: 005368E2

Part of subcall function 00524BC0: __vbaChkstk.MSVBVM60(00000000,004047D6), ref: 00524BDE
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60(6D02D8B1,00000001,00000000,00000000,004047D6), ref: 00524C0E
Part of subcall function 00524BC0: __vbaStrCopy.MSVBVM60 ref: 00524C1A
Part of subcall function 00524BC0: __vbaOnError.MSVBVM60(000000FF), ref: 00524C29
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(000007D0,?), ref: 00524C42
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C50
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524C57
Part of subcall function 00524BC0: #525.MSVBVM60(00000000), ref: 00524C5E
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524C6C
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(000007D0,?,00000000), ref: 00524C7F
Part of subcall function 00524BC0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00524C95
Part of subcall function 00524BC0: __vbaCopyBytes.MSVBVM60(000007EE,?,?), ref: 00524CB8
Part of subcall function 00524BC0: __vbaLsetFixstr.MSVBVM60(00000003,?,MSG), ref: 00524CD3
Part of subcall function 00524BC0: #520.MSVBVM60(?,00004008), ref: 00524D04
Part of subcall function 00524BC0: __vbaStrVarMove.MSVBVM60(?), ref: 00524D11
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D1F
Part of subcall function 00524BC0: __vbaFreeVar.MSVBVM60 ref: 00524D2B
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(?), ref: 00524D3F
Part of subcall function 00524BC0: __vbaStrFixstr.MSVBVM60(00000096,?), ref: 00524D53
Part of subcall function 00524BC0: __vbaStrMove.MSVBVM60 ref: 00524D61
Part of subcall function 00524BC0: __vbaLenBstr.MSVBVM60(00000000), ref: 00524D68

__vbaFreeStrList.MSVBVM60(00000002,?,?,00000000), ref: 00536940
__vbaExitProc.MSVBVM60 ref: 00536949
__vbaFreeStr.MSVBVM60(00536993), ref: 0053698B
__vbaFreeStr.MSVBVM60 ref: 00536990

Strings

AutoUpdate: , xrefs: 005368C3
\VersionFolder.txt, xrefs: 005367D9
UnknownVersion, xrefs: 005368B0
doesn't exist., xrefs: 005368D6

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Copy$ErrorFixstr$BstrExitProc$#520FileListLset$#525#648AnsiBytesChkstkCloseInputLineOpenSystemUnicode
String ID: doesn't exist.$AutoUpdate: $UnknownVersion$\VersionFolder.txt
API String ID: 1118645432-2910113411
Opcode ID: 9ea3fafb4558e3abcf6733f416cbfb1d1f956c3155af70dd5aba1adb4833d336
Instruction ID: 9be481748ea9672fc6db7364fb1cfb00ffc65684c9462e539b4bd5cabe44ddfb
Opcode Fuzzy Hash: 9ea3fafb4558e3abcf6733f416cbfb1d1f956c3155af70dd5aba1adb4833d336
Instruction Fuzzy Hash: C151DC76D10269ABCB04DFA4DE459DEBBB8FF58700F10412AE502B72A4DB745A05CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00517870 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 133COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005178B5
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005178C9
__vbaStrCmp.MSVBVM60(RMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005178DC
__vbaStrCmp.MSVBVM60(MPS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005178F2
__vbaStrCmp.MSVBVM60(INV,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051790E
__vbaStrFixstr.MSVBVM60(0000000E,005550D0,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517921
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051792C
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517932
__vbaStrCmp.MSVBVM60(EMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051794D
__vbaStrCmp.MSVBVM60(AMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517963
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517977
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517979

Strings

QST, xrefs: 00517990
CIV, xrefs: 005179AB
MPS, xrefs: 005178ED
RMS, xrefs: 005178D1
REP, xrefs: 005179FE
INV, xrefs: 00517909
FMS, xrefs: 005179C7
EMS, xrefs: 00517948
Phone # N/A, xrefs: 0051796F
JMS, xrefs: 005179E3
AMS, xrefs: 0051795E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CopyExitProc$ErrorFixstrMove
String ID: AMS$CIV$EMS$FMS$INV$JMS$MPS$Phone # N/A$QST$REP$RMS
API String ID: 1529319174-3332942827
Opcode ID: f323a75b7f97147b50dc7a5f11b6e6701d2f1b586bd7afadb87913793201f495
Instruction ID: 1225002a653b9a9e945decc82c4b6655682d170bd557cdd93a94109a191feebb
Opcode Fuzzy Hash: f323a75b7f97147b50dc7a5f11b6e6701d2f1b586bd7afadb87913793201f495
Instruction Fuzzy Hash: 4341B870B8435EAFD7009BF8CD55EE93EF4BB1CB01B100526E612E71E0D674A9888B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040735E Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D02D8B1,00000001,6D050F46), ref: 00543B24
__vbaStrCat.MSVBVM60(09@), ref: 00543B3C
__vbaStrMove.MSVBVM60 ref: 00543B49

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStr.MSVBVM60(?), ref: 00543B63
__vbaStrCat.MSVBVM60(09@,00000000), ref: 00543B7E
__vbaStrMove.MSVBVM60 ref: 00543B85
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 00543B8C
__vbaSetSystemError.MSVBVM60(00000000), ref: 00543B9B
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00543BBA
#685.MSVBVM60 ref: 00543BCC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00543BD7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 00543BF8
__vbaStrI4.MSVBVM60(?,AutoUpdate: Dll error ,0040BC48), ref: 00543C0C
__vbaStrMove.MSVBVM60 ref: 00543C17
__vbaStrCat.MSVBVM60(00000000), ref: 00543C1A
__vbaStrMove.MSVBVM60 ref: 00543C21
__vbaStrCat.MSVBVM60( deleting ,00000000), ref: 00543C29
__vbaStrMove.MSVBVM60 ref: 00543C30
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00543C39
__vbaStrMove.MSVBVM60 ref: 00543C40
__vbaStrCat.MSVBVM60(?,00000000), ref: 00543C49
__vbaStrMove.MSVBVM60(?,00000000), ref: 00543C50
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,00000000,?,00000000), ref: 00543C6E
__vbaFreeObj.MSVBVM60 ref: 00543C7A
__vbaExitProc.MSVBVM60 ref: 00543C80
__vbaExitProc.MSVBVM60 ref: 00543C97

Strings

09@, xrefs: 00543B2A, 00543B72, 00543C33, 00543B35, 00543B7D
AutoUpdate: Dll error , xrefs: 00543C03
deleting , xrefs: 00543C24

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Error$AnsiExitListProcSystem$#685CheckHresultUnicode
String ID: deleting $09@$AutoUpdate: Dll error
API String ID: 850630476-3097892929
Opcode ID: c2f758e2ab2e62555640b3294c761198337289335b8f7ff08313bbc3d5e10f02
Instruction ID: fa6023ad53dca255da1208705946fc1dc7a1337d8f48b4e967a24ecc9f9641ab
Opcode Fuzzy Hash: c2f758e2ab2e62555640b3294c761198337289335b8f7ff08313bbc3d5e10f02
Instruction Fuzzy Hash: AE51D8B6900258AFCB14DFA4DD85EDEBBF8FF48700F10452AF506E3254EA34AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00549A80 Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 347COMMON

Download Yara Rule

APIs

__vbaRecUniToAnsi.MSVBVM60(00423970,?,?,00000000,00000000,004047DE,?), ref: 00549B2A
__vbaStrToAnsi.MSVBVM60(?,NTLM,00000002,00000000,00000000), ref: 00549B3D
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00549B52
__vbaRecAnsiToUni.MSVBVM60(00423970,?,?), ref: 00549B61
__vbaFreeStr.MSVBVM60 ref: 00549B6A
__vbaRecUniToAnsi.MSVBVM60(00423970,?,?,00000000,00000000,004047DE,?), ref: 00549B90
__vbaStrToAnsi.MSVBVM60(?,NTLM,00000002,00000000,00000000), ref: 00549BA3
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00549BB8
__vbaRecAnsiToUni.MSVBVM60(00423970,?,?), ref: 00549BCA
__vbaFreeStr.MSVBVM60 ref: 00549BD3
__vbaRecDestructAnsi.MSVBVM60(00423970,?), ref: 00549BE5
__vbaSetSystemError.MSVBVM60 ref: 00549C14
__vbaSetSystemError.MSVBVM60(00000000,00000008,0000000C), ref: 00549C22
__vbaSetSystemError.MSVBVM60(00000000,?,0000000C), ref: 00549C48
__vbaSetSystemError.MSVBVM60 ref: 00549C69
__vbaSetSystemError.MSVBVM60(00000000,00000008,0000000C), ref: 00549C77
__vbaSetSystemError.MSVBVM60(00000000,?,0000000C), ref: 00549C9B
__vbaSetSystemError.MSVBVM60(004047DE,00000000,00000000,00000000,00000000,00000010,00000000,00000000,004047E6,?,?,?), ref: 00549D58
__vbaSetSystemError.MSVBVM60(004047E6,?), ref: 00549D9C
__vbaSetSystemError.MSVBVM60(?,?,0000000C), ref: 00549DB4
__vbaSetSystemError.MSVBVM60 ref: 00549E03
__vbaSetSystemError.MSVBVM60(00000000,00000000,?), ref: 00549E11
__vbaSetSystemError.MSVBVM60 ref: 00549E21
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000), ref: 00549E2F
__vbaRecDestructAnsi.MSVBVM60(00423970,?,00549E62), ref: 00549E51
__vbaRecDestructAnsi.MSVBVM60(00423970,?), ref: 00549E5F

Strings

NTLM, xrefs: 00549B37, 00549B9D

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ErrorSystem$Ansi$Destruct$Free
String ID: NTLM
API String ID: 2657684050-1704676186
Opcode ID: 94ebeceaea7000943ed4fd294e3d64e7a9aa641a110e18b3366714a95f0f4e59
Instruction ID: 709be4b3d93f21924eb25cd80f6382e5128218d76983d556e31f85a571a2d146
Opcode Fuzzy Hash: 94ebeceaea7000943ed4fd294e3d64e7a9aa641a110e18b3366714a95f0f4e59
Instruction Fuzzy Hash: 5DC14FB0E00219AFEB14DFA4DC85FEEBBB8FF48704F108519F105A7191E7B469458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0051BEF0 Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,?,0051F838), ref: 0051BF0E
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000000,00000000,00000000,004047D6), ref: 0051BF3E
__vbaGenerateBoundsError.MSVBVM60 ref: 0051BF61
__vbaGenerateBoundsError.MSVBVM60 ref: 0051BF80
#523.MSVBVM60 ref: 0051BF96
__vbaStrMove.MSVBVM60 ref: 0051BFA1
#517.MSVBVM60(00000000), ref: 0051BFA8
__vbaStrMove.MSVBVM60 ref: 0051BFB3
#523.MSVBVM60(?,00000000), ref: 0051BFC7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0051BFD2
#517.MSVBVM60(00000000,?,00000000), ref: 0051BFD9
__vbaStrMove.MSVBVM60(?,00000000), ref: 0051BFE4
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 0051BFEB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000), ref: 0051C00F
__vbaGenerateBoundsError.MSVBVM60 ref: 0051C044
#709.MSVBVM60(?,00414914,000000FF,00000000), ref: 0051C065
__vbaGenerateBoundsError.MSVBVM60(?,00414914,000000FF,00000000), ref: 0051C093
#709.MSVBVM60(?,00414914,000000FF,00000000,?,00414914,000000FF,00000000), ref: 0051C0B4
__vbaGenerateBoundsError.MSVBVM60(?,00414914,000000FF,00000000,?,00414914,000000FF,00000000), ref: 0051C0E4
#631.MSVBVM60(?,?,0000000A,?,00414914,000000FF,00000000,?,00414914,000000FF,00000000), ref: 0051C10E
__vbaStrMove.MSVBVM60(?,00414914,000000FF,00000000,?,00414914,000000FF,00000000), ref: 0051C119
__vbaFreeVar.MSVBVM60(?,00414914,000000FF,00000000,?,00414914,000000FF,00000000), ref: 0051C122

Strings

3, xrefs: 0051C0D2
3, xrefs: 0051C138

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$BoundsGenerateMove$#517#523#709Free$#631ChkstkList
String ID: 3$3
API String ID: 3429770755-2538865259
Opcode ID: b72d425cb7bf03d1ea75556a12183d867919f503bfa12a6ce4a44ab5e008540e
Instruction ID: 52557bb5a9cae379e05b206d79b022c3cf4cf5b2885547cdb96f81a17ca75248
Opcode Fuzzy Hash: b72d425cb7bf03d1ea75556a12183d867919f503bfa12a6ce4a44ab5e008540e
Instruction Fuzzy Hash: 6B7146B4D40248DFEB10CFA4D948BDEBFB4FB09305F10826AE506AB2A4CB755989CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0054F350 Relevance: 46.7, APIs: 31, Instructions: 219COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054F36E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054F3A7
__vbaStrCat.MSVBVM60(?,?), ref: 0054F407
__vbaStrMove.MSVBVM60 ref: 0054F412
__vbaFreeStr.MSVBVM60 ref: 0054F41B
__vbaStrCopy.MSVBVM60 ref: 0054F437
__vbaFreeStr.MSVBVM60(0054F46B), ref: 0054F464
__vbaErrorOverflow.MSVBVM60 ref: 0054F488
__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,?,004047D6), ref: 0054F4AE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004047D6), ref: 0054F4E7
#593.MSVBVM60(0000000A), ref: 0054F506
__vbaR8IntI2.MSVBVM60 ref: 0054F528
__vbaFreeVar.MSVBVM60 ref: 0054F535
__vbaStrI2.MSVBVM60(0000000A), ref: 0054F555
__vbaStrMove.MSVBVM60 ref: 0054F560

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ErrorFree$ChkstkMove$#593CopyOverflow
String ID:
API String ID: 3002057956-0
Opcode ID: 8a4c135b52c8857a6dbffa33c205c364bd3daf83fdb12f918d8da171240c6bd7
Instruction ID: def16d546509da3573d64766ae991fb3f30d888884063e5d98fd765adce971ee
Opcode Fuzzy Hash: 8a4c135b52c8857a6dbffa33c205c364bd3daf83fdb12f918d8da171240c6bd7
Instruction Fuzzy Hash: A8916EB5900209EFDB00DFA4DA58BDEBBB4FF48705F108169F502B76A0DB785A84CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0054E650 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054E66E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054E6A7
__vbaGenerateBoundsError.MSVBVM60 ref: 0054E6CA
__vbaStrCat.MSVBVM60(Runstore.asl,00000000), ref: 0054E6E5
__vbaStrMove.MSVBVM60 ref: 0054E6F0
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054E742
__vbaHresultCheckObj.MSVBVM60(00000000,?,00426048,000000D0), ref: 0054E78A
__vbaFreeObj.MSVBVM60 ref: 0054E79F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054E7D6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00426048,00000050), ref: 0054E819
__vbaFreeObj.MSVBVM60 ref: 0054E82E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054E865
__vbaHresultCheckObj.MSVBVM60(00000000,?,00426048,00000038), ref: 0054E8A8
__vbaFreeObj.MSVBVM60 ref: 0054E8BD
__vbaStrCopy.MSVBVM60 ref: 0054E8D5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054E90C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00426048,0000017C), ref: 0054E954
__vbaFreeObj.MSVBVM60 ref: 0054E978
__vbaStrCopy.MSVBVM60 ref: 0054E996
__vbaFreeStr.MSVBVM60(0054E9D3,?), ref: 0054E9C3
__vbaFreeStr.MSVBVM60 ref: 0054E9CC

Strings

_aslcont, xrefs: 0054E7EE
3, xrefs: 0054E6BB
Runstore.asl, xrefs: 0054E6E0
%..Pw_ STOREstore,,&(C2C*c2c) .. {-$- $-@-}, xrefs: 0054E87D

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$Free$CopyError$BoundsChkstkGenerateMove
String ID: %..Pw_ STOREstore,,&(C2C*c2c) .. {-$- $-@-}$3$Runstore.asl$_aslcont
API String ID: 941585278-2695391203
Opcode ID: f30e1f57bf2593e91cb724954ebfbb84aab9c89e36fc8ad8c8842a7df3c232f1
Instruction ID: 0318d19bb3bf0ab8752251455c0e96d4d5a7cf6738b93d39ccffb6ce078dbd92
Opcode Fuzzy Hash: f30e1f57bf2593e91cb724954ebfbb84aab9c89e36fc8ad8c8842a7df3c232f1
Instruction Fuzzy Hash: CFB1DF74A00618EFDB04DFA4E988BDDBBB5BF48305F208529F506BB2A0CB749945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004057FD Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 176COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D0F595C,00000000,00000000), ref: 00548DA4
__vbaStrCopy.MSVBVM60 ref: 00548DB2

Part of subcall function 00529F00: __vbaStrCopy.MSVBVM60(6D02D8B1,00000001,00000000), ref: 00529F58
Part of subcall function 00529F00: __vbaOnError.MSVBVM60(?), ref: 00529F60
Part of subcall function 00529F00: #524.MSVBVM60(?,00004008), ref: 00529F7B
Part of subcall function 00529F00: __vbaStrVarMove.MSVBVM60(?), ref: 00529F85
Part of subcall function 00529F00: __vbaStrMove.MSVBVM60 ref: 00529F96
Part of subcall function 00529F00: __vbaFreeVar.MSVBVM60 ref: 00529F9B
Part of subcall function 00529F00: __vbaLenBstr.MSVBVM60(?), ref: 00529FAD
Part of subcall function 00529F00: #616.MSVBVM60(?,00000000), ref: 00529FBA
Part of subcall function 00529F00: __vbaStrMove.MSVBVM60(?,00000000), ref: 00529FC5
Part of subcall function 00529F00: __vbaStrCmp.MSVBVM60(?,00000000,?,00000000), ref: 00529FCC
Part of subcall function 00529F00: __vbaFreeStr.MSVBVM60(?,00000000), ref: 00529FDE
Part of subcall function 00529F00: __vbaExitProc.MSVBVM60(?,00000000), ref: 00529FF4
Part of subcall function 00529F00: __vbaFreeStr.MSVBVM60(0052A112), ref: 0052A10B

#631.MSVBVM60(?,00000002,0000000A,?,00414914,FFFFFFFF), ref: 00548DF4
__vbaStrMove.MSVBVM60 ref: 00548E01
__vbaFreeVar.MSVBVM60 ref: 00548E0C
__vbaLenBstr.MSVBVM60(My Computer,0000000A,?,My Computer,00000000,?,00414914,FFFFFFFF), ref: 00548E57
#631.MSVBVM60(?,-00000001), ref: 00548E6B
__vbaStrMove.MSVBVM60 ref: 00548E72
__vbaFreeVar.MSVBVM60 ref: 00548E77
#631.MSVBVM60(?,00000002,0000000A,?,00414914,FFFFFFFF,?,My Computer,00000000,?,00414914,FFFFFFFF), ref: 00548EAF
__vbaStrMove.MSVBVM60 ref: 00548EB6
__vbaFreeVar.MSVBVM60 ref: 00548EBB
__vbaLenBstr.MSVBVM60(HKEY_USERS,0000000A,?,HKEY_USERS,FFFFFFFF,?,HKEY_PERFORMANCE_DATA,FFFFFFFF,?,HKEY_LOCAL_MACHINE,FFFFFFFF,?,HKEY_DYN_DATA,FFFFFFFF,?,HKEY_CURRENT_USER), ref: 005490DA
#631.MSVBVM60(?,-00000001), ref: 005490EE
__vbaStrMove.MSVBVM60 ref: 005490F5
__vbaFreeVar.MSVBVM60 ref: 005490FA
#631.MSVBVM60(?,00000002,0000000A,?,00414914,FFFFFFFF,?,HKEY_USERS,FFFFFFFF,?,HKEY_PERFORMANCE_DATA,FFFFFFFF,?,HKEY_LOCAL_MACHINE,FFFFFFFF,?), ref: 00549132
__vbaStrMove.MSVBVM60 ref: 00549139

Strings

My Computer, xrefs: 00548E2D, 00548E52
HKEY_CLASSES_ROOT, xrefs: 00548EC8, 00548EF6
H@@, xrefs: 00549140, 00548EDB

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$#631$Bstr$CopyError$#524#616ExitProc
String ID: H@@$HKEY_CLASSES_ROOT$My Computer
API String ID: 3580412770-1091027075
Opcode ID: b2b7ff5efcc69354c2e25c063dd5ed6a79dfb91dfac5e51d2e110bb004b0c5ef
Instruction ID: 91d5bd0f28f38688b598b8eb673575318c5b0feb05361593a63bcd2084d8509b
Opcode Fuzzy Hash: b2b7ff5efcc69354c2e25c063dd5ed6a79dfb91dfac5e51d2e110bb004b0c5ef
Instruction Fuzzy Hash: A861F7B19002499FDB04DFA4DA85AEEBBB8FF48700F604259E511B7294EB74AE05CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00407233 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D110D5B,?,00000000), ref: 00537A34
__vbaStrToAnsi.MSVBVM60(?,DllRegisterServer), ref: 00537A49
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00537A56
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00537A61
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00537A6C
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00537A89
#685.MSVBVM60 ref: 00537A9B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00537AA6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 00537AC7
__vbaStrI4.MSVBVM60(?,AutoUpdate: Dll Error ,0040BC48), ref: 00537ADB
__vbaStrMove.MSVBVM60 ref: 00537AEC
__vbaStrCat.MSVBVM60(00000000), ref: 00537AF5
__vbaStrMove.MSVBVM60 ref: 00537AFC
__vbaStrCat.MSVBVM60( while trying to register ,00000000), ref: 00537B04
__vbaStrMove.MSVBVM60 ref: 00537B0B
__vbaStrCat.MSVBVM60(?,00000000), ref: 00537B11
__vbaStrMove.MSVBVM60(?,00000000), ref: 00537B18
__vbaStrCat.MSVBVM60(00411AE0,00000000,?,00000000), ref: 00537B20
__vbaStrMove.MSVBVM60(?,00000000), ref: 00537B27
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,00000000,?,00000000), ref: 00537B45
__vbaFreeObj.MSVBVM60 ref: 00537B51
__vbaExitProc.MSVBVM60 ref: 00537B57
__vbaExitProc.MSVBVM60 ref: 00537B6E

Strings

AutoUpdate: Dll Error , xrefs: 00537AD2
while trying to register , xrefs: 00537AFF
DllRegisterServer, xrefs: 00537A3A

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$AnsiErrorExitListProc$#685CheckHresultSystemUnicode
String ID: while trying to register $AutoUpdate: Dll Error $DllRegisterServer
API String ID: 3384073744-1035403093
Opcode ID: 30f7eff193d5f47e7c5226284227bd60500679fd1e4f316dd9eb96305c299f77
Instruction ID: bef89038836b0e85649ca33b1a49534129725773c1bde972ba0bb246b5faf604
Opcode Fuzzy Hash: 30f7eff193d5f47e7c5226284227bd60500679fd1e4f316dd9eb96305c299f77
Instruction Fuzzy Hash: D54107B1D00218ABCB14DBA5DD89ADEFFB8FF98740F14412AF506B3160DA749945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407281 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,00000001,?,6D05285F), ref: 00539E84
__vbaStrToAnsi.MSVBVM60(?,DllUnregisterServer), ref: 00539E99
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00539EA6
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00539EB1
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00539EBC
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00539ED9
#685.MSVBVM60 ref: 00539EEB
__vbaObjSet.MSVBVM60(?,00000000), ref: 00539EF6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004145C8,0000004C), ref: 00539F17
__vbaStrI4.MSVBVM60(?,Dll Error ,0040BC48), ref: 00539F2B
__vbaStrMove.MSVBVM60 ref: 00539F3C
__vbaStrCat.MSVBVM60(00000000), ref: 00539F45
__vbaStrMove.MSVBVM60 ref: 00539F4C
__vbaStrCat.MSVBVM60( while trying to unregister ,00000000), ref: 00539F54
__vbaStrMove.MSVBVM60 ref: 00539F5B
__vbaStrCat.MSVBVM60(?,00000000), ref: 00539F61
__vbaStrMove.MSVBVM60(?,00000000), ref: 00539F68
__vbaStrCat.MSVBVM60(00411AE0,00000000,?,00000000), ref: 00539F70
__vbaStrMove.MSVBVM60(?,00000000), ref: 00539F77
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,00000000,?,00000000), ref: 00539F95
__vbaFreeObj.MSVBVM60 ref: 00539FA1
__vbaExitProc.MSVBVM60 ref: 00539FA7
__vbaExitProc.MSVBVM60 ref: 00539FBE

Strings

while trying to unregister , xrefs: 00539F4F
DllUnregisterServer, xrefs: 00539E8A
Dll Error , xrefs: 00539F22

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$AnsiErrorExitListProc$#685CheckHresultSystemUnicode
String ID: while trying to unregister $Dll Error $DllUnregisterServer
API String ID: 3384073744-3171966574
Opcode ID: 7ecddb39d3c03417863f08ae03efd346a6b388d9b2161ec63c760164198a9c33
Instruction ID: 49f93caead7e554cc56d6f52ea7cc80497c95d0e1e372ee893fca7d6d8be6ee1
Opcode Fuzzy Hash: 7ecddb39d3c03417863f08ae03efd346a6b388d9b2161ec63c760164198a9c33
Instruction Fuzzy Hash: 8541E6B1D00218ABCB14DFA5DD89ADEBFB8FF98701F14412AF506B2160DAB499458FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00517AB0 Relevance: 43.9, APIs: 15, Strings: 10, Instructions: 122COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517AF5
__vbaStrCmp.MSVBVM60(RMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B0C
__vbaStrCmp.MSVBVM60(MPS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B22
__vbaStrCmp.MSVBVM60(INV,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B3E
__vbaStrFixstr.MSVBVM60(00000002,00555380,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B51
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B5C
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B62
__vbaStrCmp.MSVBVM60(AMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B7D
__vbaStrCmp.MSVBVM60(QST,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517B96
__vbaStrCmp.MSVBVM60(CIV,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517BAF
__vbaStrCmp.MSVBVM60(FMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517BC7
__vbaStrCmp.MSVBVM60(JMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517BE3
__vbaStrCmp.MSVBVM60(REP,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517BFF
__vbaStrCmp.MSVBVM60(EMS,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517C1A

Strings

QST, xrefs: 00517B91
CIV, xrefs: 00517BAA
MPS, xrefs: 00517B1D
RMS, xrefs: 00517B01
REP, xrefs: 00517BFA
INV, xrefs: 00517B39
FMS, xrefs: 00517BC2
EMS, xrefs: 00517C15
JMS, xrefs: 00517BDE
AMS, xrefs: 00517B78

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ErrorExitFixstrMoveProc
String ID: AMS$CIV$EMS$FMS$INV$JMS$MPS$QST$REP$RMS
API String ID: 2195488108-4101040264
Opcode ID: 470bc85bcc2a842ff150fef305fb4c78f189f7e776c3a4033caa917dc4653190
Instruction ID: 2f0828d08e9a5984006eb7edd1a7306752870b75007d045b08bf2adb2e1c63dc
Opcode Fuzzy Hash: 470bc85bcc2a842ff150fef305fb4c78f189f7e776c3a4033caa917dc4653190
Instruction Fuzzy Hash: 3341E570A88319AFE7009BA8CE16FE57EF4BB5CB457104117EA12E71E0F774AC848B65

Uniqueness

Uniqueness Score: -1.00%

Function 00549850 Relevance: 42.1, APIs: 22, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 005498C0
__vbaStrCopy.MSVBVM60 ref: 005498C8
__vbaStrCopy.MSVBVM60 ref: 005498D0
__vbaOnError.MSVBVM60(?), ref: 005498D9
__vbaStrCopy.MSVBVM60 ref: 005498E7
__vbaStrCat.MSVBVM60(?,My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\), ref: 005498F8
__vbaStrMove.MSVBVM60 ref: 00549905
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0054990D
__vbaStrMove.MSVBVM60 ref: 00549914
__vbaStrCat.MSVBVM60(?,00000000), ref: 0054991B
__vbaStrMove.MSVBVM60 ref: 00549922
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0054992A
__vbaStrMove.MSVBVM60 ref: 00549931
__vbaStrCat.MSVBVM60(?,00000000), ref: 00549938
__vbaStrMove.MSVBVM60 ref: 0054993F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004202F0,00000038), ref: 00549965
__vbaStrMove.MSVBVM60 ref: 00549974
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00549990
__vbaExitProc.MSVBVM60 ref: 005499F0
__vbaFreeStr.MSVBVM60(00549A4A), ref: 00549A3D
__vbaFreeStr.MSVBVM60 ref: 00549A42
__vbaFreeStr.MSVBVM60 ref: 00549A47

Strings

VALUE NOT FOUND!, xrefs: 005498DF
My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\, xrefs: 005498E9

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$CopyFree$CheckErrorExitHresultListProc
String ID: My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\IMC\$VALUE NOT FOUND!
API String ID: 1958484078-2433272957
Opcode ID: 93c8b8dbfe168a46a73488da6467360e660a0e5254a3f3425d5c44f7376fe257
Instruction ID: b7537d7d498cc2054957842bed331a2aef3e7d18a1e2d122b4ea1d6c0b600dd5
Opcode Fuzzy Hash: 93c8b8dbfe168a46a73488da6467360e660a0e5254a3f3425d5c44f7376fe257
Instruction Fuzzy Hash: 1651E5B1D00218AFCB04DFA9DD859DEBBB8FF58700F60812AE506B3254DB706A45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0053B750 Relevance: 40.7, APIs: 27, Instructions: 177COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0053B79B
__vbaStrCat.MSVBVM60(00414914), ref: 0053B7B2
__vbaStrMove.MSVBVM60 ref: 0053B7BF
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053B7C8
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B7CF
__vbaStrCat.MSVBVM60(00414914,00000000,?,00000000), ref: 0053B7D7
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B7DE
__vbaStrCat.MSVBVM60(00000000,00000000,?,00000000), ref: 0053B7E4
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B7EB

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,?,00000000), ref: 0053B814
__vbaStrCat.MSVBVM60(00414914), ref: 0053B831
__vbaStrMove.MSVBVM60 ref: 0053B838
__vbaStrCat.MSVBVM60(?,00000000), ref: 0053B841
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B848
__vbaStrCat.MSVBVM60(00414914,00000000,?,00000000), ref: 0053B850
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B857
__vbaStrCat.MSVBVM60(00000000,00000000,?,00000000), ref: 0053B85D
__vbaStrMove.MSVBVM60(?,00000000), ref: 0053B864
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,?,00000000), ref: 0053B892
__vbaStrCat.MSVBVM60(00414914), ref: 0053B8B4
__vbaStrMove.MSVBVM60 ref: 0053B8BB
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0053B8C4
__vbaStrMove.MSVBVM60 ref: 0053B8CB
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0053B8ED
__vbaExitProc.MSVBVM60 ref: 0053B906
__vbaExitProc.MSVBVM60 ref: 0053B91D

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$List$ErrorExitProc$AnsiSystemUnicode
String ID:
API String ID: 4077986295-0
Opcode ID: cb571f186f453d3ba27cdc761a0c4bc500ef25d97d83a292684ebdc95d025d40
Instruction ID: 112fa21b85c4e5580fef8e306cbc8e0ebba0e47244c66794c6f436b7210530c9
Opcode Fuzzy Hash: cb571f186f453d3ba27cdc761a0c4bc500ef25d97d83a292684ebdc95d025d40
Instruction Fuzzy Hash: A551EEB2D10208AFDB04EFA8DD85EEE7BB9FF88710F10812AE506E7254DB705904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00544960 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054497E
__vbaOnError.MSVBVM60(?,?,?,?,?,004047D6), ref: 005449BA
__vbaObjSet.MSVBVM60(00000000,00000000,?,?,?,?,004047D6), ref: 005449F1
__vbaStrCat.MSVBVM60(|ImcDdeTopic,?,?,?,?,?,004047D6), ref: 00544A05
__vbaStrMove.MSVBVM60(?,?,?,?,?,004047D6), ref: 00544A10
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,000000F4), ref: 00544A43
__vbaFreeStr.MSVBVM60 ref: 00544A58
__vbaFreeObj.MSVBVM60 ref: 00544A61
__vbaObjSet.MSVBVM60(?,00000000), ref: 00544A82
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,000000FC), ref: 00544ABC
__vbaFreeObj.MSVBVM60 ref: 00544AD1
__vbaOnError.MSVBVM60(000000FF), ref: 00544AE0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00544B01
__vbaI2I4.MSVBVM60 ref: 00544B0F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041F758,00000104), ref: 00544B42
__vbaFreeObj.MSVBVM60 ref: 00544B57
#685.MSVBVM60 ref: 00544B64
__vbaObjSet.MSVBVM60(?,00000000), ref: 00544B6F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000001C), ref: 00544BA2
__vbaFreeObj.MSVBVM60 ref: 00544BC6
__vbaExitProc.MSVBVM60(?,?,?,?,004047D6), ref: 00544C64

Strings

lblData, xrefs: 00544A8B
|ImcDdeTopic, xrefs: 00544A00

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CheckHresult$Error$#685ChkstkExitMoveProc
String ID: lblData$|ImcDdeTopic
API String ID: 3687618548-2646159494
Opcode ID: 6f4ea5724414b4d4c30bbfb0ae8beee817ee754f459e994db4792177f8c6d861
Instruction ID: f916faf513b3143a4625c5a6d54d096a16b3f9d55016aeb5408b5386853af7cd
Opcode Fuzzy Hash: 6f4ea5724414b4d4c30bbfb0ae8beee817ee754f459e994db4792177f8c6d861
Instruction Fuzzy Hash: 64912D74940209EFDB14DFA4CA88BDEBBB5FF48305F208169F506AB2A0DB74A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00529100 Relevance: 39.3, APIs: 26, Instructions: 296COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D0527C2,6D116A18), ref: 0052919C
__vbaSetSystemError.MSVBVM60(?,?), ref: 005291B7
__vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 005291DB
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 00529209
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000088,?,?), ref: 0052923D
__vbaFpI4.MSVBVM60(?,?), ref: 00529264
__vbaFreeObj.MSVBVM60(?,?), ref: 0052926F
__vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 00529288
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 005292B0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000080,?,?), ref: 005292DC
__vbaFpI4.MSVBVM60(?,?), ref: 005292FD
__vbaFreeObj.MSVBVM60(?,?), ref: 00529308
__vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 00529321
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 00529349
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000088,?,?), ref: 00529375
__vbaFpI4.MSVBVM60(?,?), ref: 00529396
__vbaFreeObj.MSVBVM60(?,?), ref: 005293A1
__vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 005293BA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 005293E2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000080,?,?), ref: 0052940E
__vbaFpI4.MSVBVM60(?,?), ref: 0052942F
__vbaFreeObj.MSVBVM60(?,?), ref: 0052943A
__vbaCopyBytes.MSVBVM60(00000034,?,?,?,?,?,?,?), ref: 0052947D
__vbaCopyBytes.MSVBVM60(00000018,?,?,?,?), ref: 005294C7
__vbaExitProc.MSVBVM60(?,?), ref: 005294CD

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$FreeNew2$BytesCopyError$ExitProcSystem
String ID:
API String ID: 2070361196-0
Opcode ID: 23782ab14ce8ae5200ff73b57155fad4744aab5614976bd60ebfeb1e37dd7357
Instruction ID: a7e81f10a4da74f3e6d74abc2d2bcd1046d8cb06d69c932c42c60eadd0c423e3
Opcode Fuzzy Hash: 23782ab14ce8ae5200ff73b57155fad4744aab5614976bd60ebfeb1e37dd7357
Instruction Fuzzy Hash: 7FB13A70E40228EFDB20DF65DD48BDABBB4BF59701F1141AAE489B3290DB705984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0051B500 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0051B548
#525.MSVBVM60(00000400), ref: 0051B553
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B564
__vbaLenBstr.MSVBVM60(?,00000000), ref: 0051B56B
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051B57A
__vbaSetSystemError.MSVBVM60(00001000,00000000,?,00000000,00000000), ref: 0051B593
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B5A1
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B5AA
#616.MSVBVM60(?,00000000), ref: 0051B5B9
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B5C4
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B5C6
__vbaStrI4.MSVBVM60(?,Error (), ref: 0051B5DC
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B5E7
__vbaStrCat.MSVBVM60(00000000), ref: 0051B5F0
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B5F7
__vbaStrCat.MSVBVM60() not defined.,00000000), ref: 0051B5FF
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B606
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051B65E
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0051B667
__vbaFreeStr.MSVBVM60(0051B6A1), ref: 0051B69A

Strings

Error (, xrefs: 0051B5D6
) not defined., xrefs: 0051B5FA

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$ErrorExitProc$#525#616AnsiBstrListSystemUnicode
String ID: ) not defined.$Error (
API String ID: 1206874142-3254790709
Opcode ID: 26b55ca079e8a11aa66ea5534ad7388c3198e77ada2be50ff4358ed21d7bf4d8
Instruction ID: 777ac7a8ef5a2c2f5558724089e7b6ee986e60273cc7b801fdb4e26ac093f256
Opcode Fuzzy Hash: 26b55ca079e8a11aa66ea5534ad7388c3198e77ada2be50ff4358ed21d7bf4d8
Instruction Fuzzy Hash: CE3119B2D00208ABDB049FA9DD88EEEFBB8FF98741F10412AF502B2560DBB45540CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040666E Relevance: 37.7, APIs: 25, Instructions: 207COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0054E15E
__vbaOnError.MSVBVM60(000000FF), ref: 0054E19A
__vbaStrMove.MSVBVM60 ref: 0054E1D0
__vbaLenBstr.MSVBVM60(?), ref: 0054E1E1
#632.MSVBVM60(?,00004008,00000062,00000002), ref: 0054E222
__vbaStrVarMove.MSVBVM60(?), ref: 0054E22C
__vbaStrMove.MSVBVM60 ref: 0054E237
__vbaStrMove.MSVBVM60 ref: 0054E26A
__vbaFreeStr.MSVBVM60 ref: 0054E273
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0054E283
#632.MSVBVM60(?,00004008,000001CD,00000002), ref: 0054E2BF
__vbaStrVarMove.MSVBVM60(?), ref: 0054E2C9
__vbaStrMove.MSVBVM60 ref: 0054E2D4
__vbaStrMove.MSVBVM60 ref: 0054E307
__vbaFreeStr.MSVBVM60 ref: 0054E310
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0054E320
#632.MSVBVM60(?,00004008,0000037F,00000002), ref: 0054E35C
__vbaStrVarMove.MSVBVM60(?), ref: 0054E366
__vbaStrMove.MSVBVM60 ref: 0054E371
__vbaStrMove.MSVBVM60 ref: 0054E3A4
__vbaFreeStr.MSVBVM60 ref: 0054E3AD
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0054E3BD
__vbaStrCmp.MSVBVM60(0040BC48), ref: 0054E3D8
__vbaStrCmp.MSVBVM60(0040BC48,00000000), ref: 0054E3F0
__vbaFreeStr.MSVBVM60(0054E446), ref: 0054E43F

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$#632List$BstrChkstkError
String ID:
API String ID: 4056443131-0
Opcode ID: dd87a26009a804f36e89ae4629474de7bba48434696490baf65c5ce9818aa186
Instruction ID: 28cba707324abb94248680d9736a0dc6c57f22f1f6ef41f02723621e8481337a
Opcode Fuzzy Hash: dd87a26009a804f36e89ae4629474de7bba48434696490baf65c5ce9818aa186
Instruction Fuzzy Hash: 5591EAB5900218EFDB04CF94D988EDEBBB5FF48704F108169E506BB2A0D774AA49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0051A940 Relevance: 37.7, APIs: 25, Instructions: 153COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0051A9AF
#526.MSVBVM60(?,00000104), ref: 0051A9BE
__vbaStrVarMove.MSVBVM60(?), ref: 0051A9CE
__vbaStrMove.MSVBVM60 ref: 0051A9DB
__vbaFreeVar.MSVBVM60 ref: 0051A9E0
__vbaI2I4.MSVBVM60(00000000), ref: 0051A9EC
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051A9FB
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 0051AA08
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0051AA16
__vbaFreeStr.MSVBVM60 ref: 0051AA1F
#520.MSVBVM60(?,00004008), ref: 0051AA3A
#608.MSVBVM60(?,00000000), ref: 0051AA45
__vbaVarTstNe.MSVBVM60(?,?), ref: 0051AA53
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0051AA69
#608.MSVBVM60(?,00000000), ref: 0051AA91
__vbaInStrVar.MSVBVM60(?,00000000,?,00000008,?), ref: 0051AACD
__vbaVarSub.MSVBVM60(?,00000002,00000000), ref: 0051AADF
__vbaI4Var.MSVBVM60(00000000), ref: 0051AAE6
#617.MSVBVM60(?,00004008,00000000), ref: 0051AAF8
__vbaStrVarMove.MSVBVM60(?), ref: 0051AB02
__vbaStrMove.MSVBVM60 ref: 0051AB09
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0051AB19
__vbaStrCopy.MSVBVM60 ref: 0051AB28
__vbaExitProc.MSVBVM60 ref: 0051AB2E
__vbaFreeStr.MSVBVM60(0051ABF7), ref: 0051ABF0

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$#608ErrorList$#520#526#617AnsiCopyExitProcSystemUnicode
String ID:
API String ID: 1818406350-0
Opcode ID: a212c7d5336a39c79586c4dc688cf5e555e04e2cacee6f8dc1725a86f0e51114
Instruction ID: fa03f7fe8e3cd4a614a3238f53270cf59d4052d12515a8d8ab9da90c7865b904
Opcode Fuzzy Hash: a212c7d5336a39c79586c4dc688cf5e555e04e2cacee6f8dc1725a86f0e51114
Instruction Fuzzy Hash: 1861A4B2C10218AFDB14DFA4DD88ADEBBB8FB48700F00856AF616B7160DB745645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407274 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D02D8B1,?,FFFFFFFF), ref: 0053963E
__vbaNew.MSVBVM60(00406724), ref: 0053964E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00539659
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,000000E4), ref: 00539679
__vbaFreeObj.MSVBVM60 ref: 00539682
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,000000DC), ref: 005396A7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00421E50,000006FC), ref: 005396D7
__vbaFreeObj.MSVBVM60 ref: 005396E4
__vbaStrCopy.MSVBVM60 ref: 005396F2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,000000DC), ref: 00539717
__vbaHresultCheckObj.MSVBVM60(00000000,?,00421E50,00000708), ref: 0053973D
__vbaFreeObj.MSVBVM60 ref: 0053974F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,000000DC), ref: 0053977D
__vbaStrCopy.MSVBVM60 ref: 0053978A

Strings

?|?, xrefs: 00539782

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$Free$Copy$Error
String ID: ?|?
API String ID: 2978451322-3852099704
Opcode ID: f3f8b1377909f8591cd325c1d46f4e760723ba761a087793f0eefba472fcbea3
Instruction ID: 742c2eda1cad9882aabf5a1d6d4b6bc52124b8cfa42f592b4f89eeac4697d19c
Opcode Fuzzy Hash: f3f8b1377909f8591cd325c1d46f4e760723ba761a087793f0eefba472fcbea3
Instruction Fuzzy Hash: 27519E70A00219AFDB10DFA4DD89EEEBBF8FF94B00F14002AF546B71A5D7B46905CA64

Uniqueness

Uniqueness Score: -1.00%

Function 0054C0C0 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054C0DE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054C117
__vbaVarDup.MSVBVM60 ref: 0054C160
#626.MSVBVM60(?,?,0000000A), ref: 0054C172
__vbaChkstk.MSVBVM60 ref: 0054C17D
__vbaVarLateMemCallLd.MSVBVM60(?,?,Instancesof,?), ref: 0054C1B6
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,?,004047D6), ref: 0054C1C0
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,004047D6), ref: 0054C1CE
__vbaForEachCollAd.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,004047D6), ref: 0054C1E0
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054C1FE
__vbaLateMemCallLd.MSVBVM60(?,?,Domain,00000000), ref: 0054C21F
__vbaStrVarMove.MSVBVM60(00000000), ref: 0054C229
__vbaStrMove.MSVBVM60 ref: 0054C234
__vbaFreeVar.MSVBVM60 ref: 0054C23D
__vbaNextEachCollAd.MSVBVM60(?,?), ref: 0054C255
__vbaFreeObjList.MSVBVM60(00000002,?,?,0054C2C7), ref: 0054C2B4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054C2C0

Strings

winmgmts:\, xrefs: 0054C146
Win32_ComputerSystem, xrefs: 0054C124
Instancesof, xrefs: 0054C1A9
Domain, xrefs: 0054C212

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CallChkstkCollEachLateListMove$#626AddrefErrorNext
String ID: Domain$Instancesof$Win32_ComputerSystem$winmgmts:\
API String ID: 3831327470-995246301
Opcode ID: 7007c6a59f2f6eb37e530e06ff4b8d45b482caf1513ccacfa1b63b77fa03c9df
Instruction ID: b9d4646867cf0b8bc7b9cfc47e71f9cc52c42d97bd7021067e21a80c33bf5021
Opcode Fuzzy Hash: 7007c6a59f2f6eb37e530e06ff4b8d45b482caf1513ccacfa1b63b77fa03c9df
Instruction Fuzzy Hash: 17511BB5900218EFDB10DF94DD88BDEBB78BF48704F10819AE506B7290DBB55A88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00529F00 Relevance: 36.1, APIs: 24, Instructions: 135COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(6D02D8B1,00000001,00000000), ref: 00529F58
__vbaOnError.MSVBVM60(?), ref: 00529F60
#524.MSVBVM60(?,00004008), ref: 00529F7B
__vbaStrVarMove.MSVBVM60(?), ref: 00529F85
__vbaStrMove.MSVBVM60 ref: 00529F96
__vbaFreeVar.MSVBVM60 ref: 00529F9B
__vbaLenBstr.MSVBVM60(?), ref: 00529FAD
#616.MSVBVM60(?,00000000), ref: 00529FBA
__vbaStrMove.MSVBVM60(?,00000000), ref: 00529FC5
__vbaStrCmp.MSVBVM60(?,00000000,?,00000000), ref: 00529FCC
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00529FDE
__vbaExitProc.MSVBVM60(?,00000000), ref: 00529FF4
#517.MSVBVM60(00402510), ref: 0052A010
__vbaStrMove.MSVBVM60 ref: 0052A017
__vbaLenBstr.MSVBVM60(?), ref: 0052A026
__vbaStrMove.MSVBVM60(00000000), ref: 0052A033
#616.MSVBVM60(00000000), ref: 0052A036
__vbaStrMove.MSVBVM60 ref: 0052A041
#517.MSVBVM60(?,00000000), ref: 0052A048
__vbaStrMove.MSVBVM60 ref: 0052A04F
__vbaStrCmp.MSVBVM60(00000000), ref: 0052A052
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0052A073
__vbaFreeStr.MSVBVM60(0052A112), ref: 0052A10B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$#517#616Bstr$#524CopyErrorExitListProc
String ID:
API String ID: 435390261-0
Opcode ID: ba4df7072e260cd53d182afb10831a41a468b56118e39b438eeb859888203ada
Instruction ID: cec10bdcff1f32e35c87ad0ba3c9f6731fb903db41a7f1a9f5ea303d80316722
Opcode Fuzzy Hash: ba4df7072e260cd53d182afb10831a41a468b56118e39b438eeb859888203ada
Instruction Fuzzy Hash: 2C51F8B1D002189BCB04DFA5DE889DEFBB9FF58710F10822AE502B7660DB745945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0051B7C0 Relevance: 36.1, APIs: 24, Instructions: 132COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D02D8CD,6D02D8B1,00000000), ref: 0051B808
#525.MSVBVM60(000001F4), ref: 0051B813
__vbaStrMove.MSVBVM60 ref: 0051B824
__vbaLenBstr.MSVBVM60(?), ref: 0051B82A
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051B839
__vbaSetSystemError.MSVBVM60(00000000), ref: 0051B847
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B855
__vbaFreeStr.MSVBVM60 ref: 0051B869
#523.MSVBVM60(?), ref: 0051B87C
__vbaStrMove.MSVBVM60 ref: 0051B887
#618.MSVBVM60(?,?), ref: 0051B88F
__vbaStrMove.MSVBVM60 ref: 0051B89A
#537.MSVBVM60(00000000,00000000), ref: 0051B89E
__vbaStrMove.MSVBVM60 ref: 0051B8A9
__vbaStrCmp.MSVBVM60(00000000), ref: 0051B8AC
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051B8C5
__vbaLenBstr.MSVBVM60(?), ref: 0051B8D7
#616.MSVBVM60(?,-00000001), ref: 0051B8EB
__vbaStrMove.MSVBVM60 ref: 0051B8F6
#523.MSVBVM60(?), ref: 0051B8FC
__vbaStrMove.MSVBVM60 ref: 0051B907
__vbaExitProc.MSVBVM60 ref: 0051B909
__vbaFreeStr.MSVBVM60(0051B9A8), ref: 0051B9A1
__vbaErrorOverflow.MSVBVM60 ref: 0051B9BC

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$ErrorFree$#523Bstr$#525#537#616#618AnsiExitListOverflowProcSystemUnicode
String ID:
API String ID: 1986884744-0
Opcode ID: 74c93ff263d4987312e23a4f980adc315aaa90c5d1d91318aaa957e3ddb6e32f
Instruction ID: a4ea5891a4ccf48c4a783bf4e470603f97b224111525dbeae22e7e84ebf3396c
Opcode Fuzzy Hash: 74c93ff263d4987312e23a4f980adc315aaa90c5d1d91318aaa957e3ddb6e32f
Instruction Fuzzy Hash: 5141EB76D00208ABDB04EFA5DE889DEBBB8FB4C701F544169E502F7660DB359D44CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0052A130 Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0052A17B
__vbaLenBstr.MSVBVM60 ref: 0052A18F
#618.MSVBVM60(00000000,00000000), ref: 0052A19C
__vbaStrMove.MSVBVM60 ref: 0052A1A7
__vbaStrCmp.MSVBVM60(?,00000000), ref: 0052A1B1
__vbaFreeStr.MSVBVM60(?,00000000), ref: 0052A1C3
__vbaExitProc.MSVBVM60(?,00000000), ref: 0052A1D9
#517.MSVBVM60(8%@), ref: 0052A1F5
__vbaStrMove.MSVBVM60 ref: 0052A202
__vbaLenBstr.MSVBVM60 ref: 0052A214
__vbaStrMove.MSVBVM60(00000000), ref: 0052A220
#618.MSVBVM60(00000000), ref: 0052A223
__vbaStrMove.MSVBVM60 ref: 0052A22E
#517.MSVBVM60(?,00000000), ref: 0052A237
__vbaStrMove.MSVBVM60(?,00000000), ref: 0052A23E
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 0052A241
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000,?,00000000), ref: 0052A262
__vbaExitProc.MSVBVM60 ref: 0052A277
__vbaExitProc.MSVBVM60 ref: 0052A2D9

Strings

8%@, xrefs: 0052A181, 0052A1EE

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$ExitProc$#517#618BstrFree$ErrorList
String ID: 8%@
API String ID: 717954980-1259797581
Opcode ID: c5bfd98f4afd46bfcb0cd835edf881c60201761e8782a0ea5ae9b94324c4d572
Instruction ID: 122990a37b13c7ed440c88c1dc5b23f4a5b54a203cffd2047c592a390389c50f
Opcode Fuzzy Hash: c5bfd98f4afd46bfcb0cd835edf881c60201761e8782a0ea5ae9b94324c4d572
Instruction Fuzzy Hash: 1D413C75D00218EFCB04DFA5DE489DEFBB8FF58710B10825AE952B76A0DB705940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00524210 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0052422E
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000000,00000000,00000000,004047D6), ref: 0052425E
__vbaGenerateBoundsError.MSVBVM60 ref: 00524281
__vbaStrCat.MSVBVM60(ImcSys.log), ref: 0052429C
__vbaStrMove.MSVBVM60 ref: 005242A7
__vbaStrMove.MSVBVM60(00000009,?), ref: 005242FF
__vbaStrCat.MSVBVM60(00000000), ref: 00524306
__vbaStrMove.MSVBVM60 ref: 00524311
__vbaFreeStr.MSVBVM60 ref: 0052431A

Strings

3, xrefs: 00524272
ImcSys.log, xrefs: 00524297

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Error$BoundsChkstkFreeGenerate
String ID: 3$ImcSys.log
API String ID: 2959541723-254898153
Opcode ID: 99823ebfee0757f8ae32e0e47f168bcda002c0ecb190164f4ac20fb504351449
Instruction ID: 2344155d7fcad03dc3341d1bbc6ad94b6137e512436133ab9b607416ae3480be
Opcode Fuzzy Hash: 99823ebfee0757f8ae32e0e47f168bcda002c0ecb190164f4ac20fb504351449
Instruction Fuzzy Hash: 8E410674D00208EFDB04DFA4EA98BAEBBB5BF44705F108169F502B76A0DB745A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 005270C0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0052710E

Part of subcall function 0051B7C0: __vbaOnError.MSVBVM60(?,6D02D8CD,6D02D8B1,00000000), ref: 0051B808
Part of subcall function 0051B7C0: #525.MSVBVM60(000001F4), ref: 0051B813
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B824
Part of subcall function 0051B7C0: __vbaLenBstr.MSVBVM60(?), ref: 0051B82A
Part of subcall function 0051B7C0: __vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051B839
Part of subcall function 0051B7C0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0051B847
Part of subcall function 0051B7C0: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B855
Part of subcall function 0051B7C0: __vbaFreeStr.MSVBVM60 ref: 0051B869
Part of subcall function 0051B7C0: #523.MSVBVM60(?), ref: 0051B87C
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B887
Part of subcall function 0051B7C0: #618.MSVBVM60(?,?), ref: 0051B88F
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B89A
Part of subcall function 0051B7C0: #537.MSVBVM60(00000000,00000000), ref: 0051B89E
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B8A9
Part of subcall function 0051B7C0: __vbaStrCmp.MSVBVM60(00000000), ref: 0051B8AC
Part of subcall function 0051B7C0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051B8C5
Part of subcall function 0051B7C0: __vbaLenBstr.MSVBVM60(?), ref: 0051B8D7

__vbaStrMove.MSVBVM60 ref: 00527124
__vbaStrCat.MSVBVM60(\ImcGeneralService.port,00000000), ref: 0052712C
__vbaStrMove.MSVBVM60 ref: 00527137
__vbaFreeStr.MSVBVM60 ref: 0052713C

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

#648.MSVBVM60(0000000A,?), ref: 00527166
__vbaFreeVar.MSVBVM60 ref: 00527171
__vbaFileOpen.MSVBVM60(?,000000FF,00000000,?), ref: 00527180
__vbaLineInputStr.MSVBVM60(?,00000000), ref: 0052718B
__vbaFileClose.MSVBVM60(00000000), ref: 00527192
#581.MSVBVM60(?), ref: 0052719C
__vbaFpR8.MSVBVM60 ref: 005271A2
#581.MSVBVM60(?), ref: 005271B9
__vbaFpI2.MSVBVM60 ref: 005271BF
__vbaExitProc.MSVBVM60 ref: 005271C8
__vbaExitProc.MSVBVM60(?), ref: 005271E0
__vbaFreeStr.MSVBVM60(00527282), ref: 0052727A
__vbaFreeStr.MSVBVM60 ref: 0052727F

Strings

-/, xrefs: 005271D9
\ImcGeneralService.port, xrefs: 00527127

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$Error$#581AnsiBstrExitFileProcSystemUnicode$#523#525#537#618#648CloseInputLineListOpen
String ID: -/$\ImcGeneralService.port
API String ID: 2380444643-571113249
Opcode ID: 962b94a5aa713f438d2a23f52871b125e11b8f63e2d018ef34da9e250d1be59f
Instruction ID: e5e68a7e779cdf113e3ed9df7f4d86932747552469e36c511e0a099dc5364525
Opcode Fuzzy Hash: 962b94a5aa713f438d2a23f52871b125e11b8f63e2d018ef34da9e250d1be59f
Instruction Fuzzy Hash: A631F8B5C00219EFDB04DFA4EE49ADEBBB4FF49700F10416AE906B26A4DB345940CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0051AF40 Relevance: 34.7, APIs: 23, Instructions: 151COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0051AF88
__vbaStrToAnsi.MSVBVM60(?,0040BC48,00000000), ref: 0051AF9E
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051AFAB
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 0051AFB5
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0051AFC0
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0051AFD3
#525.MSVBVM60(00000000), ref: 0051AFE5
__vbaStrMove.MSVBVM60 ref: 0051AFF0
__vbaLenBstr.MSVBVM60(?), ref: 0051B000
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051B00B
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000), ref: 0051B015
__vbaSetSystemError.MSVBVM60(00000000), ref: 0051B01F
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B030
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B03A
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051B051
__vbaLenBstr.MSVBVM60(?), ref: 0051B067
#616.MSVBVM60(?,?), ref: 0051B089
__vbaStrMove.MSVBVM60 ref: 0051B094
__vbaStrCopy.MSVBVM60 ref: 0051B0A0
__vbaExitProc.MSVBVM60 ref: 0051B0A6
__vbaExitProc.MSVBVM60 ref: 0051B10B
__vbaFreeStr.MSVBVM60(0051B145), ref: 0051B13E
__vbaErrorOverflow.MSVBVM60 ref: 0051B15B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AnsiError$FreeUnicode$BstrExitListMoveProcSystem$#525#616CopyOverflow
String ID:
API String ID: 3048654924-0
Opcode ID: 03359a26ff5e6bb80272bffeb80c030998bf73a7fe90ecfdfef8798d89db9881
Instruction ID: b414b5a26dadff895e2d1c1d5576814214163c190dcba22cfe678f20347a003b
Opcode Fuzzy Hash: 03359a26ff5e6bb80272bffeb80c030998bf73a7fe90ecfdfef8798d89db9881
Instruction Fuzzy Hash: 38410C71D10218ABDB04DFA8DE88DDEBBB8BB48711F10456AF901F3660DB749940CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0054E9F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 186COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054EA0E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054EA3E
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0054EA56
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054EA8D
__vbaGenerateBoundsError.MSVBVM60 ref: 0054EABB
__vbaStrCat.MSVBVM60(Runstore.asl), ref: 0054EAD5
__vbaStrMove.MSVBVM60 ref: 0054EAE0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00426048,000000D0), ref: 0054EB13
__vbaFreeStr.MSVBVM60 ref: 0054EB28
__vbaFreeObj.MSVBVM60 ref: 0054EB31
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054EB68
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00426048,00000038), ref: 0054EBAB
__vbaFreeObj.MSVBVM60 ref: 0054EBC0
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,00000054), ref: 0054EBF7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00426048,00000178), ref: 0054EC3F
__vbaFreeObj.MSVBVM60 ref: 0054EC54

Strings

3, xrefs: 0054EAAC
Runstore.asl, xrefs: 0054EAD0
%..Pw_ STOREstore,,&(C2C*c2c) .. {-$- $-@-}, xrefs: 0054EB80

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$Free$Error$BoundsChkstkCopyGenerateMove
String ID: %..Pw_ STOREstore,,&(C2C*c2c) .. {-$- $-@-}$3$Runstore.asl
API String ID: 64510880-327077039
Opcode ID: 23354ea7ca692b39e8bd9f6f9280f2b26f3e33bc55cfb6d78d7c1963a1300a33
Instruction ID: 7c58fede7499c0ca16fbd9b3ac3b61e162ec932643e3997a69c3e2246a454326
Opcode Fuzzy Hash: 23354ea7ca692b39e8bd9f6f9280f2b26f3e33bc55cfb6d78d7c1963a1300a33
Instruction Fuzzy Hash: 1A81C2B4A01608EFDB04DF94E989BDDBBB5FB48315F208519F506BB2A0C7749984CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004069E9 Relevance: 33.2, APIs: 22, Instructions: 170COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00545E6D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545E9D
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545EA4
__vbaI2Var.MSVBVM60(00000000), ref: 00545EAE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545ED1
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545ED8
__vbaI2Var.MSVBVM60(00000000), ref: 00545EE2
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00545EFC
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00545F0C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545F4D
__vbaLateIdSt.MSVBVM60(00000000), ref: 00545F50
__vbaFreeObj.MSVBVM60 ref: 00545F5F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545F73
__vbaLateIdCall.MSVBVM60(00000000), ref: 00545F76
__vbaFreeObj.MSVBVM60 ref: 00545F82
#598.MSVBVM60 ref: 00545F84
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545F9C
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00545FA3
__vbaI2Var.MSVBVM60(00000000), ref: 00545FAD
__vbaFreeObj.MSVBVM60 ref: 00545FC1
__vbaFreeVar.MSVBVM60 ref: 00545FC6
__vbaExitProc.MSVBVM60 ref: 0054603E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Late$Call$List$#598ErrorExitProc
String ID:
API String ID: 1371230615-0
Opcode ID: 53d5cd4c1701ddd649b7eecd1d97d66d285fd723f99c9b62ada1dcd2b7bdf40a
Instruction ID: b95669ef8477708eb66ad66cf03569ebe9e024689a7445fb76a4ede9cb59a509
Opcode Fuzzy Hash: 53d5cd4c1701ddd649b7eecd1d97d66d285fd723f99c9b62ada1dcd2b7bdf40a
Instruction Fuzzy Hash: 8F515FB1800208ABC714DFA4CD49AEEFBB8FF48704F14861AF542AB2A1DB745905CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005460B0 Relevance: 33.1, APIs: 22, Instructions: 142COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00546101
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054611E
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00546125
__vbaI2Var.MSVBVM60(00000000), ref: 0054612F
__vbaFreeObj.MSVBVM60 ref: 00546144
__vbaFreeVar.MSVBVM60 ref: 0054614D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0054616A
__vbaLateIdCall.MSVBVM60(00000000), ref: 0054616D
__vbaFreeObj.MSVBVM60 ref: 00546179
__vbaObjSet.MSVBVM60(?,00000000), ref: 00546191
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00546198
__vbaI2Var.MSVBVM60(00000000), ref: 005461A2
__vbaFreeObj.MSVBVM60 ref: 005461B7
__vbaFreeVar.MSVBVM60 ref: 005461C0
__vbaObjSet.MSVBVM60(?,00000000), ref: 005461DD
__vbaLateIdCall.MSVBVM60(00000000), ref: 005461E0
__vbaFreeObj.MSVBVM60 ref: 005461EC
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00546205
__vbaObjSetAddref.MSVBVM60(?,?), ref: 00546218
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000010), ref: 00546232
__vbaFreeObj.MSVBVM60 ref: 0054623B
__vbaExitProc.MSVBVM60 ref: 00546298

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CallLate$AddrefCheckErrorExitHresultNew2Proc
String ID:
API String ID: 3495891872-0
Opcode ID: 12e3092b2cfe513770c77b60157756533f9bd9f289d51cf8a9e22debd48322c1
Instruction ID: cb9f6af3d92a2b5bd15aa47001128fed0a977d1b0d8c9115af092dabc37f3c16
Opcode Fuzzy Hash: 12e3092b2cfe513770c77b60157756533f9bd9f289d51cf8a9e22debd48322c1
Instruction Fuzzy Hash: 975139B5900215ABD7109FA4ED88FEE7F78FF08B05F04412AF902F61A1DB746944CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00549E90 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?,NTLM,?,00000000,00000000,00000000,00000000,004047DE,?), ref: 00549F1C
__vbaStrToAnsi.MSVBVM60(?,NTLM,?,00000000,00000000,00000000,00000000,004047DE,?), ref: 00549F2B
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00549F40
__vbaFreeStr.MSVBVM60 ref: 00549F45
__vbaSetSystemError.MSVBVM60 ref: 00549F74
__vbaSetSystemError.MSVBVM60(00000000,00000008,0000000C), ref: 00549F82
__vbaSetSystemError.MSVBVM60(00000000,?,0000000C), ref: 00549FA8
__vbaSetSystemError.MSVBVM60 ref: 00549FBF
__vbaSetSystemError.MSVBVM60(00000000,00000008,0000000C), ref: 00549FCD
__vbaSetSystemError.MSVBVM60(00000000,?,0000000C), ref: 00549FF1
__vbaSetSystemError.MSVBVM60(004047DE,00000000,00000000,00000000,00000010,004047E6,?,?,?), ref: 0054A09A
__vbaSetSystemError.MSVBVM60(004047E6,?), ref: 0054A0DE
__vbaSetSystemError.MSVBVM60(?,?,0000000C), ref: 0054A0F6
__vbaSetSystemError.MSVBVM60 ref: 0054A145
__vbaSetSystemError.MSVBVM60(00000000,00000000,?), ref: 0054A153
__vbaSetSystemError.MSVBVM60 ref: 0054A163
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000), ref: 0054A171

Strings

NTLM, xrefs: 00549F14

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ErrorSystem$Ansi$Free
String ID: NTLM
API String ID: 2744985876-1704676186
Opcode ID: 9567268fbe3eb98f2b9d0638f18697a26a4e13eaf1ac15d80c56b8e518f5d6fc
Instruction ID: 12a556e6f9d8ffdc3d44b8fb7476b0ee3afeafe68337d3e98451c68d2d806803
Opcode Fuzzy Hash: 9567268fbe3eb98f2b9d0638f18697a26a4e13eaf1ac15d80c56b8e518f5d6fc
Instruction Fuzzy Hash: A9A14CB1D00219AFDB14DFE5C885EEEBBB8FF48704F10852AF105A7280D7749945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004057A2 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00547FB9
__vbaNew.MSVBVM60(00421AB8), ref: 00547FC4
__vbaObjSet.MSVBVM60(?,00000000), ref: 00547FCF
#525.MSVBVM60(000000FF), ref: 0054805D
__vbaStrMove.MSVBVM60 ref: 00548068
__vbaLenBstr.MSVBVM60(?), ref: 0054806E
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00548079
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 00548093
__vbaStrToUnicode.MSVBVM60(?,?), ref: 005480A1
__vbaFreeStr.MSVBVM60 ref: 005480BA
#519.MSVBVM60(?), ref: 005480CD
__vbaStrMove.MSVBVM60 ref: 005480D8
__vbaLenBstr.MSVBVM60(?), ref: 005480DE
#616.MSVBVM60(?,-00000001), ref: 005480EE
__vbaStrMove.MSVBVM60 ref: 005480F9
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040C1E0,00000020), ref: 00548155
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 00548169
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0054819D
__vbaExitProc.MSVBVM60 ref: 0054820C
__vbaFreeObj.MSVBVM60(0054826F), ref: 00548253
__vbaFreeStr.MSVBVM60 ref: 00548262
__vbaFreeStr.MSVBVM60 ref: 00548267
__vbaFreeStr.MSVBVM60 ref: 0054826C
__vbaErrorOverflow.MSVBVM60 ref: 00548296
__vbaOnError.MSVBVM60(?), ref: 00548302
__vbaStrCopy.MSVBVM60 ref: 00548310
__vbaStrMove.MSVBVM60 ref: 00548395

Strings

0?@, xrefs: 00547FB2

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$ErrorMove$Bstr$#519#525#616AddrefAnsiCheckCopyExitHresultListOverflowProcSystemUnicode
String ID: 0?@
API String ID: 1357455381-4113061678
Opcode ID: 85b2a2b76cc9e367ce18373b69de7fa88158e55a5677ad166c894958fb0cae9c
Instruction ID: 6f0fc4fd46f3494c7e21d4a382e554372b4074d20847e20513629c1b21582db8
Opcode Fuzzy Hash: 85b2a2b76cc9e367ce18373b69de7fa88158e55a5677ad166c894958fb0cae9c
Instruction Fuzzy Hash: 0881F5B1D10218EBDB14DF95DD84EEEFBB9BF98700F10865AE106A7260DB705A44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004066AF Relevance: 31.7, APIs: 21, Instructions: 169COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0054EF8E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004047D6), ref: 0054EFC7
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 0054EFDA
__vbaI2I4.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 0054EFE2
#632.MSVBVM60(?,00004008,00000001,00000002), ref: 0054F062
__vbaStrVarVal.MSVBVM60(?,?), ref: 0054F070
#516.MSVBVM60(00000000), ref: 0054F077
#573.MSVBVM60(?,00000002), ref: 0054F090
__vbaVarCat.MSVBVM60(?,?,00000008,00000002), ref: 0054F0BE
#619.MSVBVM60(?,00000000), ref: 0054F0CC
__vbaStrVarMove.MSVBVM60(?), ref: 0054F0D9
__vbaStrMove.MSVBVM60 ref: 0054F0E4
__vbaFreeStr.MSVBVM60 ref: 0054F0ED
__vbaFreeVarList.MSVBVM60(00000006,00000002,?,00000002,?,?,?), ref: 0054F113
#632.MSVBVM60(?,00004008,00000002,00000002), ref: 0054F168
#632.MSVBVM60(?,00004008,?,00000002), ref: 0054F1A3
__vbaVarCat.MSVBVM60(?,?,00000008), ref: 0054F1B8
__vbaVarCat.MSVBVM60(?,?,00000000), ref: 0054F1CD
__vbaStrVarMove.MSVBVM60(00000000), ref: 0054F1D4
__vbaStrMove.MSVBVM60 ref: 0054F1DF
__vbaFreeVarList.MSVBVM60(00000006,00000002,?,00000002,?,?,?), ref: 0054F205
__vbaStrCat.MSVBVM60(0042605C,?), ref: 0054F23E
__vbaStrMove.MSVBVM60 ref: 0054F249
__vbaStrCat.MSVBVM60(?,00000000), ref: 0054F254
#617.MSVBVM60(?,00000008), ref: 0054F273
__vbaStrVarMove.MSVBVM60(?), ref: 0054F27D
__vbaStrMove.MSVBVM60 ref: 0054F288
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0054F298
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0054F2AB
__vbaFreeStr.MSVBVM60(0054F31E), ref: 0054F30E
__vbaFreeStr.MSVBVM60 ref: 0054F317

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FreeMove$List$#632$#516#573#617#619BstrChkstkError
String ID:
API String ID: 4022085649-0
Opcode ID: 78aed0866ade4d660acb94971466f268b08616a4774cd11585633c8eb9840025
Instruction ID: eacf50f759f30382980df9b89fbf10ec1a969885ea673f1eae91055185615090
Opcode Fuzzy Hash: 78aed0866ade4d660acb94971466f268b08616a4774cd11585633c8eb9840025
Instruction Fuzzy Hash: 3C71D9B6800218EBDB14CFD4DD48BDEBBB8BF48304F10859AE50AB7151DB755A88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004052F2 Relevance: 30.2, APIs: 20, Instructions: 157COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D013917,6D02D8B1,6D02D9D4), ref: 0054DEBD
__vbaSetSystemError.MSVBVM60 ref: 0054DED0
__vbaRedim.MSVBVM60(00000080,?,?,00000011,?,-00000002,00000000), ref: 0054DEF9
__vbaAryLock.MSVBVM60(?,?), ref: 0054DF0A
__vbaGenerateBoundsError.MSVBVM60 ref: 0054DF27
__vbaGenerateBoundsError.MSVBVM60 ref: 0054DF34
__vbaSetSystemError.MSVBVM60(?), ref: 0054DF4B
__vbaAryUnlock.MSVBVM60(?), ref: 0054DF55
__vbaStrVarCopy.MSVBVM60(00002011), ref: 0054DF72
__vbaStrMove.MSVBVM60 ref: 0054DF83
#608.MSVBVM60(?,00000000), ref: 0054DF9A
__vbaInStrVar.MSVBVM60(?,00000000,?,00000008,?), ref: 0054DFD9
__vbaVarSub.MSVBVM60(?,00000002,00000000), ref: 0054DFEB
__vbaI4Var.MSVBVM60(00000000), ref: 0054DFF2
#617.MSVBVM60(?,00004008,00000000), ref: 0054E004
__vbaStrVarMove.MSVBVM60(?), ref: 0054E00E
__vbaStrMove.MSVBVM60 ref: 0054E019
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0054E029
__vbaExitProc.MSVBVM60 ref: 0054E032
__vbaFreeStr.MSVBVM60(0054E111), ref: 0054E0FE
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0054E10A
__vbaErrorOverflow.MSVBVM60(00000000), ref: 0054E12E
__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0054E15E
__vbaOnError.MSVBVM60(000000FF), ref: 0054E19A
__vbaStrMove.MSVBVM60 ref: 0054E1D0
__vbaLenBstr.MSVBVM60(?), ref: 0054E1E1
#632.MSVBVM60(?,00004008,00000062,00000002), ref: 0054E222
__vbaStrVarMove.MSVBVM60(?), ref: 0054E22C
__vbaStrMove.MSVBVM60 ref: 0054E237
__vbaStrMove.MSVBVM60 ref: 0054E26A
__vbaFreeStr.MSVBVM60 ref: 0054E273
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0054E283
#632.MSVBVM60(?,00004008,000001CD,00000002), ref: 0054E2BF
__vbaStrVarMove.MSVBVM60(?), ref: 0054E2C9
__vbaStrMove.MSVBVM60 ref: 0054E2D4
__vbaStrMove.MSVBVM60 ref: 0054E307
__vbaFreeStr.MSVBVM60 ref: 0054E310
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0054E320
#632.MSVBVM60(?,00004008,0000037F,00000002), ref: 0054E35C
__vbaStrVarMove.MSVBVM60(?), ref: 0054E366
__vbaStrMove.MSVBVM60 ref: 0054E371
__vbaStrMove.MSVBVM60 ref: 0054E3A4
__vbaFreeStr.MSVBVM60 ref: 0054E3AD
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0054E3BD
__vbaStrCmp.MSVBVM60(0040BC48), ref: 0054E3D8

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Error$List$#632$BoundsGenerateSystem$#608#617BstrChkstkCopyDestructExitLockOverflowProcRedimUnlock
String ID:
API String ID: 931618285-0
Opcode ID: aac596f03a92c137688d519f4d7245b9645fde00f19e7b0bc98f2b77f2e17306
Instruction ID: b859144dc981d287ef337ce4836b3a22fcbca09e15aa4fc43cb4797878bb346a
Opcode Fuzzy Hash: aac596f03a92c137688d519f4d7245b9645fde00f19e7b0bc98f2b77f2e17306
Instruction Fuzzy Hash: D36129B5D002189FDB14DFA5CE49ADEFBB8BF98300F10815AE606B7261D7B45A44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0051AC10 Relevance: 30.1, APIs: 20, Instructions: 149COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0051AC83
#525.MSVBVM60(00000080), ref: 0051AC98
__vbaStrMove.MSVBVM60 ref: 0051ACA6
__vbaLsetFixstr.MSVBVM60(00000080,?,00000000), ref: 0051ACB9
__vbaFreeStr.MSVBVM60 ref: 0051ACC5
__vbaRecUniToAnsi.MSVBVM60(0040E918,?,00000094), ref: 0051ACDE
__vbaSetSystemError.MSVBVM60(00000000), ref: 0051ACF0
__vbaRecAnsiToUni.MSVBVM60(0040E918,00000094,?), ref: 0051AD09
__vbaExitProc.MSVBVM60 ref: 0051AD2B
__vbaExitProc.MSVBVM60 ref: 0051AD4D
__vbaExitProc.MSVBVM60 ref: 0051AD91
__vbaExitProc.MSVBVM60 ref: 0051AE4C

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ExitProc$AnsiError$#525FixstrFreeLsetMoveSystem
String ID:
API String ID: 4088872373-0
Opcode ID: a39ddc952a0ca9118b3929f549231bdf2b2af3e3402f0c4096440e6c714aaebd
Instruction ID: 4c03cfef8e98ef440d8fcdefb2ba095db3f9298db23b20c240ce27608ee1133b
Opcode Fuzzy Hash: a39ddc952a0ca9118b3929f549231bdf2b2af3e3402f0c4096440e6c714aaebd
Instruction Fuzzy Hash: DD51CFB4D0162ACBEB12AF90DD096DD7FB4FB08701F00459AF605B2560EBB88AC5CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00536540 Relevance: 30.1, APIs: 20, Instructions: 129fileCOMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0053659A

Part of subcall function 0052B150: __vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,?,0051C230), ref: 0052B16E
Part of subcall function 0052B150: __vbaOnError.MSVBVM60(?,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0052B19E
Part of subcall function 0052B150: #610.MSVBVM60(?), ref: 0052B1AF
Part of subcall function 0052B150: #545.MSVBVM60(?,?), ref: 0052B1BD
Part of subcall function 0052B150: __vbaStrVarMove.MSVBVM60(?), ref: 0052B1C7
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B1D2
Part of subcall function 0052B150: __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B1E2
Part of subcall function 0052B150: #610.MSVBVM60(?), ref: 0052B1F6
Part of subcall function 0052B150: #542.MSVBVM60(?,?), ref: 0052B204
Part of subcall function 0052B150: __vbaStrVarMove.MSVBVM60(?), ref: 0052B20E
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B219
Part of subcall function 0052B150: __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B229
Part of subcall function 0052B150: #610.MSVBVM60(?), ref: 0052B23D
Part of subcall function 0052B150: #553.MSVBVM60(?,?), ref: 0052B24B
Part of subcall function 0052B150: __vbaStrVarMove.MSVBVM60(?), ref: 0052B255
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B260
Part of subcall function 0052B150: __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B270
Part of subcall function 0052B150: __vbaLenBstr.MSVBVM60(?), ref: 0052B284
Part of subcall function 0052B150: __vbaStrCat.MSVBVM60(?,0040BF2C), ref: 0052B29F
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B2AA

__vbaStrMove.MSVBVM60 ref: 005365B0

Part of subcall function 0052B490: #523.MSVBVM60(00000000,6D02D8B1,00000000,00000000), ref: 0052B4F4
Part of subcall function 0052B490: __vbaStrMove.MSVBVM60 ref: 0052B4FF
Part of subcall function 0052B490: __vbaStrCmp.MSVBVM60(0040BC48,00000000), ref: 0052B50B
Part of subcall function 0052B490: __vbaFreeStr.MSVBVM60 ref: 0052B51D
Part of subcall function 0052B490: __vbaStrCopy.MSVBVM60 ref: 0052B530

__vbaStrMove.MSVBVM60(?), ref: 005365CA
__vbaStrCat.MSVBVM60(0041BEBC,00000000), ref: 005365D8
__vbaStrMove.MSVBVM60 ref: 005365DF

Part of subcall function 0052AE60: __vbaVarVargNofree.MSVBVM60(6D02D8B1,00000001,00000000), ref: 0052AEC1
Part of subcall function 0052AE60: __vbaBoolVarNull.MSVBVM60(00000000), ref: 0052AEC8
Part of subcall function 0052AE60: #611.MSVBVM60 ref: 0052AEDD
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60 ref: 0052AEEA
Part of subcall function 0052AE60: #611.MSVBVM60 ref: 0052AEEC
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60 ref: 0052AEF3
Part of subcall function 0052AE60: #611.MSVBVM60 ref: 0052AEF5
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60 ref: 0052AEFC
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60(00000002), ref: 0052AF31
Part of subcall function 0052AE60: #616.MSVBVM60(00000000), ref: 0052AF34
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60 ref: 0052AF3F
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60(00000004,?,00000000), ref: 0052AF51
Part of subcall function 0052AE60: #631.MSVBVM60(00000000), ref: 0052AF5A
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60 ref: 0052AF61
Part of subcall function 0052AE60: __vbaStrCat.MSVBVM60(00000000), ref: 0052AF64
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60 ref: 0052AF6F
Part of subcall function 0052AE60: __vbaStrMove.MSVBVM60(00000007,?,00000000), ref: 0052AF81
Part of subcall function 0052AE60: #631.MSVBVM60(00000000), ref: 0052AF84

__vbaStrMove.MSVBVM60(0000000B,00000000), ref: 005365F0
__vbaStrCat.MSVBVM60(00000000), ref: 005365F3
__vbaStrMove.MSVBVM60 ref: 005365FA
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 0053660E
__vbaFreeVar.MSVBVM60 ref: 0053661A
#648.MSVBVM60(0000000A), ref: 00536632
__vbaFreeVar.MSVBVM60 ref: 0053663D
__vbaStrCat.MSVBVM60(?), ref: 0053665E
__vbaStrMove.MSVBVM60 ref: 00536665
__vbaFileOpen.MSVBVM60(00000002,000000FF,00000000,00000000), ref: 0053666D
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0053667D
__vbaPrintFile.MSVBVM60(0041AC28,00000000,?), ref: 0053668D
__vbaFileClose.MSVBVM60(00000000), ref: 00536697
__vbaExitProc.MSVBVM60 ref: 005366FB
__vbaFreeStr.MSVBVM60(00536737), ref: 00536730

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$List$#610#611File$#631Error$#523#542#545#553#616#648BoolBstrChkstkCloseCopyExitNofreeNullOpenPrintProcVarg
String ID:
API String ID: 2792051231-0
Opcode ID: fb455777fb93b10d57abb79d7575431ab25d0be8d60f346143bfbdfd13bac66e
Instruction ID: 29313671eb01355767f7bedf77cbbb34fbb780fcbee77e43a119f77e9cb60e31
Opcode Fuzzy Hash: fb455777fb93b10d57abb79d7575431ab25d0be8d60f346143bfbdfd13bac66e
Instruction Fuzzy Hash: 2051F8B5D00218ABCB00DFA5DD889DEFBB9FF98700F10811AF516A72A0DB749945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0051B9D0 Relevance: 30.1, APIs: 20, Instructions: 123COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6), ref: 0051B9EE
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051BA1E
#526.MSVBVM60(?,00000100), ref: 0051BA42
__vbaStrVarMove.MSVBVM60(?), ref: 0051BA4C
__vbaStrMove.MSVBVM60 ref: 0051BA57
__vbaFreeVar.MSVBVM60 ref: 0051BA60
__vbaStrToAnsi.MSVBVM60(?,?,000000FF), ref: 0051BA79
__vbaSetSystemError.MSVBVM60(00000000), ref: 0051BA88
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0051BA96
__vbaFreeStr.MSVBVM60 ref: 0051BAAE
#523.MSVBVM60(?), ref: 0051BADC
__vbaStrMove.MSVBVM60 ref: 0051BAE7
#618.MSVBVM60(?,?), ref: 0051BAFA
#608.MSVBVM60(?,00000000), ref: 0051BB10
__vbaVarTstEq.MSVBVM60(?,00008008), ref: 0051BB1E
__vbaFreeVarList.MSVBVM60(00000002,00008008,?), ref: 0051BB32
__vbaLenBstr.MSVBVM60(?), ref: 0051BB4E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FreeMove$Error$#523#526#608#618AnsiBstrChkstkListSystemUnicode
String ID:
API String ID: 1886188025-0
Opcode ID: 6fd0411f4d5f153da54d27dca2024760077131f8df743c0b2e9ac1a0d8158ee8
Instruction ID: a8c015c421cfecf85fd124304326f306e8d29d2e69051f5dce64df0aecb9e2c7
Opcode Fuzzy Hash: 6fd0411f4d5f153da54d27dca2024760077131f8df743c0b2e9ac1a0d8158ee8
Instruction Fuzzy Hash: 0A41FB75900208EFEB04DFE0DA88BEEBBB8FF48705F144569E502B76A0DB785A44CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004052CD Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054CCEE

Part of subcall function 00529F00: __vbaStrCopy.MSVBVM60(6D02D8B1,00000001,00000000), ref: 00529F58
Part of subcall function 00529F00: __vbaOnError.MSVBVM60(?), ref: 00529F60
Part of subcall function 00529F00: #524.MSVBVM60(?,00004008), ref: 00529F7B
Part of subcall function 00529F00: __vbaStrVarMove.MSVBVM60(?), ref: 00529F85
Part of subcall function 00529F00: __vbaStrMove.MSVBVM60 ref: 00529F96
Part of subcall function 00529F00: __vbaFreeVar.MSVBVM60 ref: 00529F9B
Part of subcall function 00529F00: __vbaLenBstr.MSVBVM60(?), ref: 00529FAD
Part of subcall function 00529F00: #616.MSVBVM60(?,00000000), ref: 00529FBA
Part of subcall function 00529F00: __vbaStrMove.MSVBVM60(?,00000000), ref: 00529FC5
Part of subcall function 00529F00: __vbaStrCmp.MSVBVM60(?,00000000,?,00000000), ref: 00529FCC
Part of subcall function 00529F00: __vbaFreeStr.MSVBVM60(?,00000000), ref: 00529FDE
Part of subcall function 00529F00: __vbaExitProc.MSVBVM60(?,00000000), ref: 00529FF4
Part of subcall function 00529F00: __vbaFreeStr.MSVBVM60(0052A112), ref: 0052A10B

__vbaHresultCheckObj.MSVBVM60(00000000,?,0041CBD0,0000001C,?,?,?,0041B180,FFFFFFFF), ref: 0054CD32
__vbaStrMove.MSVBVM60(?,?,?,0041B180,FFFFFFFF), ref: 0054CD47
__vbaStrCopy.MSVBVM60(?,0041B180,FFFFFFFF), ref: 0054CD50
#632.MSVBVM60(?,00004008,00000003,0000000A,?,0041B180,FFFFFFFF), ref: 0054CDAD
__vbaStrVarMove.MSVBVM60(?), ref: 0054CDBD
__vbaStrMove.MSVBVM60(?,?,?,0041B180,FFFFFFFF), ref: 0054CDC4
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?), ref: 0054CDD0
__vbaInStr.MSVBVM60(00000000,00414914,?,?), ref: 0054CDE5
#617.MSVBVM60(0000000A,00004008,-00000001), ref: 0054CE0E
__vbaStrVarMove.MSVBVM60(0000000A), ref: 0054CE18
__vbaStrMove.MSVBVM60(?,0041B180,FFFFFFFF), ref: 0054CE1F
__vbaFreeVar.MSVBVM60(?,0041B180,FFFFFFFF), ref: 0054CE24
__vbaVarCopy.MSVBVM60(?,?,?,0041B180,FFFFFFFF), ref: 0054CE3D
__vbaStrCmp.MSVBVM60(?,?,?,0041B180,FFFFFFFF), ref: 0054CE4F
__vbaExitProc.MSVBVM60(?,?,?,0041B180,FFFFFFFF), ref: 0054CEC9
__vbaFreeStr.MSVBVM60(0054CF1A,?,?,?,0041B180,FFFFFFFF), ref: 0054CF12
__vbaFreeStr.MSVBVM60(?,?,?,0041B180,FFFFFFFF), ref: 0054CF17

Strings

PC@, xrefs: 0054CCE7

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$Copy$ErrorExitProc$#524#616#617#632BstrCheckHresultList
String ID: PC@
API String ID: 1737970807-1047898868
Opcode ID: 7663b9a8d98861346def10eeb1701497a6806f876c6f023aeb71238f34f7cc7a
Instruction ID: 7d9ff7bc9516731198117bcfb811ab444c4125cb554fd095a41c33e5683a93e0
Opcode Fuzzy Hash: 7663b9a8d98861346def10eeb1701497a6806f876c6f023aeb71238f34f7cc7a
Instruction Fuzzy Hash: 575129B1C01228ABCB14DFA4DD84AEEBBB8FF88704F10815AF505A7294DBB45A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00406E02 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,00000000), ref: 0052F3B7
__vbaStrCat.MSVBVM60(IMCSHUT.FLG,?,?,?,00000000), ref: 0052F3D2
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0052F3DF
__vbaFreeStr.MSVBVM60(?,?,00000000), ref: 0052F406
#546.MSVBVM60(?,?,?,00000000), ref: 0052F426
__vbaDateVar.MSVBVM60(?,?,?,00000000), ref: 0052F430
__vbaFreeVar.MSVBVM60(?,?,00000000), ref: 0052F43C
__vbaStrCat.MSVBVM60(IMCUPDAT.FLG,?,?,?,00000000), ref: 0052F460
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 0052F467
__vbaFreeStr.MSVBVM60(?,?,00000000), ref: 0052F480
__vbaStrCopy.MSVBVM60(?,?,00000000), ref: 0052F493
__vbaDateStr.MSVBVM60(1/1/1990,?,?,00000000), ref: 0052F4A6
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041B34C,000001B8,?,?,00000000), ref: 0052F4D7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041B34C,000002B4,?,?,00000000), ref: 0052F4FF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041B37C,00000710,?,?,00000000), ref: 0052F561
__vbaExitProc.MSVBVM60(?,?,00000000), ref: 0052F5BE
__vbaFreeStr.MSVBVM60(0052F5F3,?,?,00000000), ref: 0052F5EC

Strings

(The software is being updated.), xrefs: 0052F48B
IMCSHUT.FLG, xrefs: 0052F3C7
IMCUPDAT.FLG, xrefs: 0052F45B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CheckHresult$DateMove$#546CopyErrorExitProc
String ID: (The software is being updated.)$IMCSHUT.FLG$IMCUPDAT.FLG
API String ID: 2405078829-103984946
Opcode ID: e8152e0c47414dbad0c35a9c7ea23c9a35089af5fd03ea848ae5f07cb5e220de
Instruction ID: 27af814189937a20e7a77354f362c2ae34737eac39b4db7fdf4c9ecc56038806
Opcode Fuzzy Hash: e8152e0c47414dbad0c35a9c7ea23c9a35089af5fd03ea848ae5f07cb5e220de
Instruction Fuzzy Hash: 96515971900218EFCB10DFA4D9889DEFBF4FF99700F10856AE416A76A0DBB4A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 005466D0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 005466EE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054672A
__vbaStrCat.MSVBVM60(?,<Start of Message>,?,?,?,?,004047D6), ref: 00546742
__vbaStrMove.MSVBVM60(?,<Start of Message>,?,?,?,?,004047D6), ref: 0054674D
__vbaStrCat.MSVBVM60(<End of Message>,00000000,?,<Start of Message>,?,?,?,?,004047D6), ref: 00546759
__vbaChkstk.MSVBVM60 ref: 0054676E
__vbaObjSet.MSVBVM60(?,00000000), ref: 005467A4
__vbaLateIdCall.MSVBVM60(00000000), ref: 005467AB
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 005467B7
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 005467C0
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 005467C9
#685.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 005467D6
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,004047D6), ref: 005467E1
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000001C), ref: 00546814
__vbaFreeObj.MSVBVM60 ref: 00546838

Strings

<Start of Message>, xrefs: 00546737
<End of Message>, xrefs: 00546754

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Chkstk$#685CallCheckErrorHresultLateMove
String ID: <End of Message>$<Start of Message>
API String ID: 434918432-2792829184
Opcode ID: 88dc299dd7154a7d09b0cadf0c9e1b701160d62996531ce50f8b14afb1c3814b
Instruction ID: 406c4799bfa62175a4dce45bf914cd97140a2f491c9230a9fae9d80037eb9046
Opcode Fuzzy Hash: 88dc299dd7154a7d09b0cadf0c9e1b701160d62996531ce50f8b14afb1c3814b
Instruction Fuzzy Hash: 694107B5D00208EFDB04DFA4DA88BDEBBB4FF48705F108169E506AB2A4DB749A44CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040731D Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D02D8B1,6D01A323,?), ref: 00541D84
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,00000714), ref: 00541DC0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,000006FC), ref: 00541DF3
__vbaStrCopy.MSVBVM60 ref: 00541E2D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,00000710), ref: 00541E5C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,00000704), ref: 00541E8D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,0000070C), ref: 00541EB4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,00000708), ref: 00541EDB
__vbaStrMove.MSVBVM60 ref: 00541EEC
__vbaStrMove.MSVBVM60 ref: 00541EF7
__vbaStrMove.MSVBVM60 ref: 00541F02
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00541F33
__vbaExitProc.MSVBVM60 ref: 00541F3C
__vbaFreeStr.MSVBVM60(00541FDC), ref: 00541FD5

Strings

update the client, xrefs: 00541E25
remove the client, xrefs: 00541E1E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$Move$Free$CopyErrorExitListProc
String ID: remove the client$update the client
API String ID: 3457549527-654952164
Opcode ID: dc97d7c655f9e0a535948fbd066845d70537f8ec04b9dba9e220ac3feb42aeee
Instruction ID: 54d43a0d17490b6f5280b84ee299d567fdf2ed416b8d1e8d88d7cf11f2948cb6
Opcode Fuzzy Hash: dc97d7c655f9e0a535948fbd066845d70537f8ec04b9dba9e220ac3feb42aeee
Instruction Fuzzy Hash: 256158B1E00619AFCB04DF99D884DEEBBB9FF88700F108629E605A7290D774A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0052BC10 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000002,004047D6,00000002,?,00000000), ref: 0052BC2E
__vbaOnError.MSVBVM60(?,6D02D8B1,6D1160EF,?,00000002,004047D6,00000002), ref: 0052BC5E
__vbaStrCopy.MSVBVM60 ref: 0052BC83
__vbaFileOpen.MSVBVM60(00000002,000000FF,?), ref: 0052BCA1
__vbaStrCopy.MSVBVM60 ref: 0052BCCB
__vbaFileOpen.MSVBVM60(00004101,000000FF,?), ref: 0052BCEC
__vbaExitProc.MSVBVM60 ref: 0052BE42
__vbaFreeStr.MSVBVM60(0052BE75), ref: 0052BE6E

Strings

Append, xrefs: 0052BD5B
Random Access, xrefs: 0052BD0E
Input, xrefs: 0052BCC3
Output, xrefs: 0052BC7B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CopyFileOpen$ChkstkErrorExitFreeProc
String ID: Append$Input$Output$Random Access
API String ID: 1386293426-3549724484
Opcode ID: fc1cefbf484816a91d89461b20b6b494ce0d57bd3e8caa44ecbb971be99d994e
Instruction ID: dc163d0140e889f99c2c9b1a591a3a58cfd5b304450aa05ea7243664340080e0
Opcode Fuzzy Hash: fc1cefbf484816a91d89461b20b6b494ce0d57bd3e8caa44ecbb971be99d994e
Instruction Fuzzy Hash: 6B416DB4900205EFDB00DF80DA49BDE7BB4FF45314F2081A8E915AB2E0D7B59E85DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00548470 Relevance: 27.2, APIs: 18, Instructions: 186COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 005484CD
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 00548535
__vbaLenBstr.MSVBVM60 ref: 00548549
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 00548557
__vbaStrToAnsi.MSVBVM60(?,0040BC48,?,00000000,?,00000000), ref: 00548569
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 0054857C
__vbaStrToUnicode.MSVBVM60(00403FA8,?,?,00000000), ref: 00548587
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 005485A3
__vbaLenBstr.MSVBVM60 ref: 005485CB
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 005485DF
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000), ref: 005485ED
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 005485FC
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00548610
__vbaStrToUnicode.MSVBVM60(00403FA8,?,?,00000000), ref: 00548617
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0054862F
__vbaExitProc.MSVBVM60 ref: 005486A8
__vbaFreeStr.MSVBVM60(005486DA), ref: 005486D2
__vbaFreeStr.MSVBVM60 ref: 005486D7

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AnsiFree$ErrorUnicode$BstrListSystem$ExitProc
String ID:
API String ID: 2455878973-0
Opcode ID: babc722b94d4bb16dcce6b304ece505fd97df21e48181942a0fde92909189dae
Instruction ID: 2caf5cc2a5761990ee8ad21bb5023a78b156a19b13fc766e6f6675a99d7d50c9
Opcode Fuzzy Hash: babc722b94d4bb16dcce6b304ece505fd97df21e48181942a0fde92909189dae
Instruction Fuzzy Hash: 9061C5B2910218AFDB04DFD8DD84DEEBBB9FF48B00F14851AF502A7254DB70A9458FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00545730 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054578C
__vbaObjSet.MSVBVM60(?,00000000), ref: 005457AA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F758,00000050), ref: 005457CB
__vbaStrCmp.MSVBVM60([ImcDDEIgnore],?), ref: 005457DA
__vbaFreeStr.MSVBVM60 ref: 005457ED
__vbaFreeObj.MSVBVM60 ref: 005457F6
__vbaObjSet.MSVBVM60(?,00000000), ref: 00545813
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F758,00000050), ref: 00545834
__vbaStrMove.MSVBVM60 ref: 00545843
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 0054586C
__vbaFreeStr.MSVBVM60 ref: 00545878
__vbaFreeObj.MSVBVM60 ref: 00545881
#598.MSVBVM60 ref: 00545887
__vbaExitProc.MSVBVM60 ref: 005458E4

Strings

[ImcDDEIgnore], xrefs: 005457D5

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CheckHresult$#598ErrorEventExitMoveProcRaise
String ID: [ImcDDEIgnore]
API String ID: 1663459646-1376360919
Opcode ID: 1b469d9cf5408503e2a116b682085778218c802b2ffecdf06a278569d9bc8e60
Instruction ID: e281fef46f1c8ef3008725e231343002cb771d62377c1ad1a3b7be9198a9055d
Opcode Fuzzy Hash: 1b469d9cf5408503e2a116b682085778218c802b2ffecdf06a278569d9bc8e60
Instruction Fuzzy Hash: 78415771900209AFCB04DFA4CD88AEEBBB4FF48705F24412AE506F72A0DB345985CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0052B490 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

#523.MSVBVM60(00000000,6D02D8B1,00000000,00000000), ref: 0052B4F4
__vbaStrMove.MSVBVM60 ref: 0052B4FF
__vbaStrCmp.MSVBVM60(0040BC48,00000000), ref: 0052B50B
__vbaFreeStr.MSVBVM60 ref: 0052B51D
__vbaStrCopy.MSVBVM60 ref: 0052B530
#632.MSVBVM60(?,?,00000007,?), ref: 0052B576
#617.MSVBVM60(?,?,00000002), ref: 0052B591
#632.MSVBVM60(?,?,00000004,?), ref: 0052B5BF
__vbaVarAdd.MSVBVM60(?,?,?), ref: 0052B5D3
__vbaVarAdd.MSVBVM60(?,?,00000000), ref: 0052B5E1
__vbaStrVarMove.MSVBVM60(00000000), ref: 0052B5E4
__vbaStrMove.MSVBVM60 ref: 0052B5EF
__vbaFreeVarList.MSVBVM60(00000007,0000000A,?,?,?,?,?,?), ref: 0052B616

Strings

x&@, xrefs: 0052B4BC

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$#632Free$#523#617CopyList
String ID: x&@
API String ID: 315838868-278995534
Opcode ID: f4f2cf95aa4b6a2c565f15755ba5dd5170c1a6fdbc8a8b3063893c4fa44f43b1
Instruction ID: 05e585f006fc90710b5bd3a47433b46e1b5b951aff220730d0cf0c1931ab1b90
Opcode Fuzzy Hash: f4f2cf95aa4b6a2c565f15755ba5dd5170c1a6fdbc8a8b3063893c4fa44f43b1
Instruction Fuzzy Hash: 6551B6B1C00219EBEB14CF95D985EEEFBB8EF58700F00815AE519B72A0D7742A45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040724D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00537FEA
__vbaStrCopy.MSVBVM60 ref: 00538010
__vbaHresultCheckObj.MSVBVM60(00000000,?,004205B4,000000DC), ref: 00538035
__vbaStrCat.MSVBVM60(?,Remove ActiveX Library||), ref: 0053804F
__vbaStrMove.MSVBVM60(?,Remove ActiveX Library||), ref: 0053805C
__vbaStrCat.MSVBVM60(00414AE0,00000000,?,Remove ActiveX Library||), ref: 00538064
__vbaStrMove.MSVBVM60(?,Remove ActiveX Library||), ref: 0053806B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00421E50,00000714,?,Remove ActiveX Library||), ref: 00538090
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,Remove ActiveX Library||), ref: 005380A3
__vbaFreeObj.MSVBVM60 ref: 005380AF
__vbaSetSystemError.MSVBVM60(00000064), ref: 005380D7
#598.MSVBVM60 ref: 005380DD
__vbaStrCmp.MSVBVM60(0040BC48), ref: 005380EE
__vbaStrCopy.MSVBVM60 ref: 00538114
__vbaStrCmp.MSVBVM60(Succeeded,?), ref: 00538123
__vbaStrCat.MSVBVM60(00000000,AutoUpdate: New .NET general service must be installed to remove ,0040BC48), ref: 00538284
__vbaStrMove.MSVBVM60 ref: 0053828F
__vbaFreeStr.MSVBVM60(00000000), ref: 0053829E
__vbaExitProc.MSVBVM60(?,AutoUpdate: Unable to send message to service to remove ,0040BC48), ref: 005382FB
__vbaFreeStr.MSVBVM60(00538337), ref: 00538330

Strings

Remove ActiveX Library||, xrefs: 0053803E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$CheckCopyErrorHresult$#598ExitListProcSystem
String ID: Remove ActiveX Library||
API String ID: 1638892315-1769289753
Opcode ID: 58002afe0db7da455a3794968819c4545e2b4a178bf92a01621f9367a3afd6f0
Instruction ID: 1523d2e63c2a9d40048d32e79ff85c00822298d456bb675c83896c19760d2823
Opcode Fuzzy Hash: 58002afe0db7da455a3794968819c4545e2b4a178bf92a01621f9367a3afd6f0
Instruction Fuzzy Hash: F6412874D00218ABDB14DFA9D989ADEBBB8FF58700F10412AF501B72A1DBB45944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00522520 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000004,004047D6), ref: 0052253E
__vbaOnError.MSVBVM60(000000FF,6D01A323,6D02D8B1,6D013917,00000004,004047D6), ref: 0052256E
#577.MSVBVM60(?), ref: 00522585
__vbaDateVar.MSVBVM60(?), ref: 0052258F
__vbaFreeVar.MSVBVM60 ref: 0052259B
__vbaVarDup.MSVBVM60 ref: 005225BC
#660.MSVBVM60(?,00004007,?,?,?), ref: 005225DF
__vbaStrVarMove.MSVBVM60(?), ref: 005225E9
__vbaStrMove.MSVBVM60 ref: 005225F4
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00522604
__vbaStrCopy.MSVBVM60 ref: 0052261A
__vbaFreeStr.MSVBVM60(00522659), ref: 00522652

Strings

YYYYMMDD, xrefs: 005225A8

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$#577#660ChkstkCopyDateErrorList
String ID: YYYYMMDD
API String ID: 1146915271-1931280030
Opcode ID: a2918a539ae556aed5679fc969b128312314806b8331ebaa36b83cdbf326561a
Instruction ID: df401fbbae57756d677ee9cd1fd8da19ccab9577796cf43b7e8a995a5888f1e3
Opcode Fuzzy Hash: a2918a539ae556aed5679fc969b128312314806b8331ebaa36b83cdbf326561a
Instruction Fuzzy Hash: ED31E6B1800259EFDB04DFD0DE89BEEBBB4FB44705F104169E502B71A0DBB42A49CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0052CC00 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC45
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052CC70
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC7D
__vbaStrCat.MSVBVM60(CcwAssemblies,00000000), ref: 0052CC85
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC8C
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC91
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CC97
__vbaStrCat.MSVBVM60(DotNet\,?), ref: 0052CCBB
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CCC8
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052CD27

Strings

Deployment\GeneralService, xrefs: 0052CC80
CcwAssemblies, xrefs: 0052CCCB
DotNet\, xrefs: 0052CC65, 0052CCB0

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$ExitProc$ErrorFree
String ID: CcwAssemblies$Deployment\GeneralService$DotNet\
API String ID: 2108537301-858059702
Opcode ID: 5e79a35f39afcde796ee8249760bf74f241bdbf4cb1bb961823e92b7a3d2b83f
Instruction ID: 4027549e99af1b54097978561e2a03ecfe8f6b9677f74a0ce2fcd790c6cef1c2
Opcode Fuzzy Hash: 5e79a35f39afcde796ee8249760bf74f241bdbf4cb1bb961823e92b7a3d2b83f
Instruction Fuzzy Hash: AE212A75D102689FC700DF98DE459AE7FB8FB48B00B20416BE901B36A1D7B45D408F98

Uniqueness

Uniqueness Score: -1.00%

Function 005469E0 Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00546A3F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00546A5C
__vbaLateIdCallLd.MSVBVM60(?,00000000), ref: 00546A63
__vbaI2Var.MSVBVM60(00000000), ref: 00546A6D
__vbaFreeObj.MSVBVM60 ref: 00546A81
__vbaFreeVar.MSVBVM60 ref: 00546A8A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00546AC9
__vbaLateIdCall.MSVBVM60(00000000), ref: 00546ACC
__vbaFreeObj.MSVBVM60 ref: 00546AD8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00546B0D
__vbaLateIdCall.MSVBVM60(00000000), ref: 00546B10
__vbaFreeObj.MSVBVM60 ref: 00546B1C
__vbaExitProc.MSVBVM60 ref: 00546B79

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CallLate$ErrorExitProc
String ID:
API String ID: 295333928-0
Opcode ID: 492a21870fde0c53ed22d624b5f25099eb0c976e3bd76c82243b2e61e37c7c18
Instruction ID: 22970948d05953214f7b5c7d7f6071b7a1323faeefc0e747cb447066ade24cf2
Opcode Fuzzy Hash: 492a21870fde0c53ed22d624b5f25099eb0c976e3bd76c82243b2e61e37c7c18
Instruction Fuzzy Hash: E5413CB1D00208ABC700DFA8C949ADEFFB8FF48700F14826AE505AB261DB745941CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0054E480 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054E49E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054E4DA
__vbaStrMove.MSVBVM60 ref: 0054E514
__vbaMidStmtBstr.MSVBVM60(00000000,00000000,000000C8,00000062,?), ref: 0054E550
__vbaFreeStr.MSVBVM60 ref: 0054E559
__vbaMidStmtBstr.MSVBVM60(00000000,00000000,000000C8,000001CD,?), ref: 0054E598
__vbaFreeStr.MSVBVM60 ref: 0054E5A1
__vbaMidStmtBstr.MSVBVM60(00000000,00000000,000000C8,0000037F,?), ref: 0054E5E0
__vbaFreeStr.MSVBVM60 ref: 0054E5E9
__vbaFreeStr.MSVBVM60(0054E621), ref: 0054E61A

Strings

hD@, xrefs: 0054E5BC, 0054E5BF

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$BstrStmt$ChkstkErrorMove
String ID: hD@
API String ID: 1678278069-1531742235
Opcode ID: fd9cfdf97c507895629449fe6ab79041b997cef441751e98aec9c2e6805ed5ce
Instruction ID: 975a928ab9f146d6cf6034e7cd83f0b95f335a48804837628ae9a55f61254689
Opcode Fuzzy Hash: fd9cfdf97c507895629449fe6ab79041b997cef441751e98aec9c2e6805ed5ce
Instruction Fuzzy Hash: 7E51A2B5900209AFDB04DF94C998EDEBBB8FF48714F108158F605AB290D775AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407219 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D02D8B1,00000000,6D0527C2), ref: 00537720

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

#648.MSVBVM60(0000000A,?), ref: 0053774A
__vbaFreeVar.MSVBVM60 ref: 00537755
__vbaFileOpen.MSVBVM60(?,000000FF,00000000,00000000), ref: 00537763
__vbaLineInputStr.MSVBVM60(?,00000000), ref: 0053776E
__vbaFileClose.MSVBVM60(00000000), ref: 00537775
#519.MSVBVM60(?), ref: 0053777F
__vbaStrMove.MSVBVM60 ref: 0053778A
__vbaExitProc.MSVBVM60 ref: 00537790
__vbaExitProc.MSVBVM60(?), ref: 005377F5
__vbaFreeStr.MSVBVM60(00537838), ref: 00537831

Strings

(-@, xrefs: 00537719

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$ErrorExitFileProc$#519#648AnsiCloseInputLineMoveOpenSystemUnicode
String ID: (-@
API String ID: 3024560611-2682901813
Opcode ID: 202b8b93104b88e9a9e33c52711c3f35767b2b0712042923fec14ed38035636d
Instruction ID: a65b33a3a101eaca0a20acbe88cec6837e3bb61cbcea4e1a7f5d4c7e43662dfd
Opcode Fuzzy Hash: 202b8b93104b88e9a9e33c52711c3f35767b2b0712042923fec14ed38035636d
Instruction Fuzzy Hash: 5921F7B5C00259EFCB10DFA4DA48AEEBBB4FF09700F104169E905F66A0EB745941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004066D6 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,00000000,004047D6), ref: 0054F62E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004047D6), ref: 0054F672
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004047D6), ref: 0054F681
#717.MSVBVM60(?,?,00000040,00000000,?,?,?,00000000,004047D6), ref: 0054F69A
__vbaStrVarMove.MSVBVM60(?,?,?,?,00000000,004047D6), ref: 0054F6A4
__vbaStrMove.MSVBVM60(?,?,?,00000000,004047D6), ref: 0054F6AF
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004047D6), ref: 0054F6BD
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004047D6), ref: 0054F6C6
__vbaFreeVar.MSVBVM60(?,?,?,00000000,004047D6), ref: 0054F6CF
__vbaFreeStr.MSVBVM60(0054F700,?,?,?,00000000,004047D6), ref: 0054F6F9

Strings

?, xrefs: 004066D6

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CopyMove$#717ChkstkError
String ID: ?
API String ID: 4113884416-1684325040
Opcode ID: c970f6f7d1065dca8f80e4ddab06e06efab0f921882332277076a9c27e55d84b
Instruction ID: 23661f4f22747789e8908a1d0048538ed8b6a0e64ea62758032eac7b340bf8bf
Opcode Fuzzy Hash: c970f6f7d1065dca8f80e4ddab06e06efab0f921882332277076a9c27e55d84b
Instruction Fuzzy Hash: 8A214A71900209EFCB04DFA4DA59BDEBBB4FF48704F108169F916B72A0CB74AA44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 005473D0 Relevance: 18.1, APIs: 12, Instructions: 139COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054742D
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 00547472
__vbaLenBstr.MSVBVM60 ref: 005474AD
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 005474BB
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,00000000,?,00000000), ref: 005474CD
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 005474E0
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 005474EE
__vbaStrToUnicode.MSVBVM60(00403EB8,?,?,00000000), ref: 005474F9
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00547515
__vbaExitProc.MSVBVM60 ref: 0054758B
__vbaFreeStr.MSVBVM60(005475BD), ref: 005475B5
__vbaFreeStr.MSVBVM60 ref: 005475BA

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$AnsiErrorUnicode$BstrExitListProcSystem
String ID:
API String ID: 44810902-0
Opcode ID: 41e132ab76613348659aca86e3032957790067590fc26bd5a416d02549bed594
Instruction ID: 0572a223b814c87704d1c3f578ae8444636a33e87ba29aa79fcc109c48cddf18
Opcode Fuzzy Hash: 41e132ab76613348659aca86e3032957790067590fc26bd5a416d02549bed594
Instruction Fuzzy Hash: 4551B3B2D10218ABCB04DFE8C9849EEBBBDFF4CB10F14851AF502AB254D77499458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0051B290 Relevance: 18.1, APIs: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0051B303
#525.MSVBVM60(00000080), ref: 0051B325
__vbaStrMove.MSVBVM60 ref: 0051B333
__vbaLsetFixstr.MSVBVM60(00000080,?,00000000), ref: 0051B346
__vbaFreeStr.MSVBVM60 ref: 0051B352
__vbaRecUniToAnsi.MSVBVM60(0040E918,?,00000094), ref: 0051B36B
__vbaSetSystemError.MSVBVM60(00000000), ref: 0051B37D
__vbaRecAnsiToUni.MSVBVM60(0040E918,00000094,?), ref: 0051B396
__vbaExitProc.MSVBVM60 ref: 0051B3B9
__vbaExitProc.MSVBVM60 ref: 0051B3E8
__vbaExitProc.MSVBVM60 ref: 0051B435

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ExitProc$AnsiError$#525FixstrFreeLsetMoveSystem
String ID:
API String ID: 4088872373-0
Opcode ID: a50857e398d565942b29b9c7bf800ccd9b493373a4e002139dd9ede1bdfd8894
Instruction ID: 557eaee88219cee2b6897a271db155d09aa6cdf4facc26b2313822617c85ba47
Opcode Fuzzy Hash: a50857e398d565942b29b9c7bf800ccd9b493373a4e002139dd9ede1bdfd8894
Instruction Fuzzy Hash: 7041A074900324DFEB25CFA4DD54AE97BB6FB4C701F0085ABE605AB260DBB85984CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00544DF0 Relevance: 18.1, APIs: 12, Instructions: 102COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00544E3E
__vbaObjSet.MSVBVM60(?,00000000), ref: 00544E58
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544E64
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F758,00000104), ref: 00544E86
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544E8F
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544E9B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004229A8,00000174), ref: 00544EBB
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00544ED7
__vbaObjSetAddref.MSVBVM60(?,?), ref: 00544EED
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000010), ref: 00544F0A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544F13
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544F70

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$Free$AddrefErrorExitNew2Proc
String ID:
API String ID: 3439546456-0
Opcode ID: 20a3d3ee449378363667e00e71a9b0c86858711a5f2f8597e5688e806b2b3b76
Instruction ID: 9986774775f99bf701a0354e2b3705b1de3f74f914912c5a8ca2f20962b0a9a2
Opcode Fuzzy Hash: 20a3d3ee449378363667e00e71a9b0c86858711a5f2f8597e5688e806b2b3b76
Instruction Fuzzy Hash: 5C3149B1940214AFCB049FA4DD88ADEBFB8FF48705F50042AF546E76A0C7745985CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0051C1D0 Relevance: 18.1, APIs: 12, Instructions: 73COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,?,0051EEF8), ref: 0051C1EE
__vbaOnError.MSVBVM60(000000FF,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0051C21E

Part of subcall function 0052B150: __vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,?,0051C230), ref: 0052B16E
Part of subcall function 0052B150: __vbaOnError.MSVBVM60(?,6D02D8B1,00000001,00000000,00000000,004047D6), ref: 0052B19E
Part of subcall function 0052B150: #610.MSVBVM60(?), ref: 0052B1AF
Part of subcall function 0052B150: #545.MSVBVM60(?,?), ref: 0052B1BD
Part of subcall function 0052B150: __vbaStrVarMove.MSVBVM60(?), ref: 0052B1C7
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B1D2
Part of subcall function 0052B150: __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B1E2
Part of subcall function 0052B150: #610.MSVBVM60(?), ref: 0052B1F6
Part of subcall function 0052B150: #542.MSVBVM60(?,?), ref: 0052B204
Part of subcall function 0052B150: __vbaStrVarMove.MSVBVM60(?), ref: 0052B20E
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B219
Part of subcall function 0052B150: __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B229
Part of subcall function 0052B150: #610.MSVBVM60(?), ref: 0052B23D
Part of subcall function 0052B150: #553.MSVBVM60(?,?), ref: 0052B24B
Part of subcall function 0052B150: __vbaStrVarMove.MSVBVM60(?), ref: 0052B255
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B260
Part of subcall function 0052B150: __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0052B270
Part of subcall function 0052B150: __vbaLenBstr.MSVBVM60(?), ref: 0052B284
Part of subcall function 0052B150: __vbaStrCat.MSVBVM60(?,0040BF2C), ref: 0052B29F
Part of subcall function 0052B150: __vbaStrMove.MSVBVM60 ref: 0052B2AA

__vbaStrMove.MSVBVM60 ref: 0051C235
#631.MSVBVM60(?,?,00000002), ref: 0051C268
__vbaStrMove.MSVBVM60 ref: 0051C273
#631.MSVBVM60(?,00000009,00000002,00000000), ref: 0051C284
__vbaStrMove.MSVBVM60 ref: 0051C28F
__vbaStrCat.MSVBVM60(00000000), ref: 0051C296
__vbaStrMove.MSVBVM60 ref: 0051C2A1
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051C2B1
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0051C2C4
__vbaFreeStr.MSVBVM60(0051C318), ref: 0051C311

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$List$#610$#631ChkstkError$#542#545#553Bstr
String ID:
API String ID: 4167549970-0
Opcode ID: 3045aa7799f6f3cbf520a319c12ddee227a873981623f46e0f209b074b6deb41
Instruction ID: 61770119fa3aeef8515928062e2045f34ae28e135c9b677bd06996ada95188f6
Opcode Fuzzy Hash: 3045aa7799f6f3cbf520a319c12ddee227a873981623f46e0f209b074b6deb41
Instruction Fuzzy Hash: 5D31FAB1D00208EFEB04DFE0DD49BEEBB78FB48705F104129E502B66A1DBB55A45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005358B0 Relevance: 18.1, APIs: 12, Instructions: 72COMMON

Download Yara Rule

APIs

#606.MSVBVM60(000000FF,?), ref: 005358FF
__vbaStrMove.MSVBVM60 ref: 00535910
__vbaFreeVar.MSVBVM60 ref: 0053591B
__vbaStrToAnsi.MSVBVM60(?,?,000000FF), ref: 0053592A
__vbaSetSystemError.MSVBVM60(00000000), ref: 00535938
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00535946
__vbaFreeStr.MSVBVM60 ref: 0053594F
#617.MSVBVM60(00000002,?,00000000), ref: 0053596B
__vbaStrVarMove.MSVBVM60(00000002), ref: 00535975
__vbaStrMove.MSVBVM60 ref: 00535980
__vbaFreeVar.MSVBVM60 ref: 00535985
__vbaFreeStr.MSVBVM60(005359BA), ref: 005359B3

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$#606#617AnsiErrorSystemUnicode
String ID:
API String ID: 4257155933-0
Opcode ID: 862fac79ce34a497d9a81fddd25d682143350bc1846703f3c9da66ba8de00ea6
Instruction ID: 3ac9851e3594eaec444ebf15f0e6b5d9d5183dcbc294d1bffdf937bf11673a37
Opcode Fuzzy Hash: 862fac79ce34a497d9a81fddd25d682143350bc1846703f3c9da66ba8de00ea6
Instruction Fuzzy Hash: 1721EF71D01209AFDB04EFA4DA89AEEBBB9EF48700F104169E505B3660E7745A05CF54

Uniqueness

Uniqueness Score: -1.00%

Function 005359E0 Relevance: 18.1, APIs: 12, Instructions: 72COMMON

Download Yara Rule

APIs

#606.MSVBVM60(000000FF,?), ref: 00535A2F
__vbaStrMove.MSVBVM60 ref: 00535A40
__vbaFreeVar.MSVBVM60 ref: 00535A4B
__vbaStrToAnsi.MSVBVM60(?,?,000000FF), ref: 00535A5A
__vbaSetSystemError.MSVBVM60(00000000), ref: 00535A68
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00535A76
__vbaFreeStr.MSVBVM60 ref: 00535A7F
#617.MSVBVM60(00000002,?,00000000), ref: 00535A9B
__vbaStrVarMove.MSVBVM60(00000002), ref: 00535AA5
__vbaStrMove.MSVBVM60 ref: 00535AB0
__vbaFreeVar.MSVBVM60 ref: 00535AB5
__vbaFreeStr.MSVBVM60(00535AEA), ref: 00535AE3

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Move$#606#617AnsiErrorSystemUnicode
String ID:
API String ID: 4257155933-0
Opcode ID: 90e31adfbca77b91c8a1e070a6bcd42c09b7c402b0f6e5e1a1da08824a03c1b2
Instruction ID: d6ec7040a042449ff868878b725cca3a4c804c308969ab6ed3b8fb571e384788
Opcode Fuzzy Hash: 90e31adfbca77b91c8a1e070a6bcd42c09b7c402b0f6e5e1a1da08824a03c1b2
Instruction Fuzzy Hash: 48211071D00209AFDB04DFA4DA89AEEBBB8FF48700F104169E506B3260E7745A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 005475F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054764D
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 00547692
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000004,>@,00000004), ref: 005476D8
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 005476EB
__vbaStrToUnicode.MSVBVM60(?,?), ref: 005476F9
__vbaFreeStr.MSVBVM60 ref: 0054770C
__vbaExitProc.MSVBVM60 ref: 0054777F
__vbaFreeStr.MSVBVM60(005477B1), ref: 005477A9
__vbaFreeStr.MSVBVM60 ref: 005477AE

Strings

>@, xrefs: 005476C9, 005476CC

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Error$AnsiExitProcSystemUnicode
String ID: >@
API String ID: 3649733165-3542666865
Opcode ID: db4c99ef40ed9842160607f0dc3a527b0722b65cf17a588b6b2b32fbd4ac8570
Instruction ID: 7dda5f2feba7ced4078a9c7966c11cc15e91864e119f6f3fa114d3a8afe70f13
Opcode Fuzzy Hash: db4c99ef40ed9842160607f0dc3a527b0722b65cf17a588b6b2b32fbd4ac8570
Instruction Fuzzy Hash: 0941C5B5D10228ABCB10DFD8C9849EEBBB9FF48B10F14851AF512B7254D7B49945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 005272A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,0041C378,00000003), ref: 005272FA
__vbaAryConstruct2.MSVBVM60(?,0041C378,00000003), ref: 00527307
__vbaOnError.MSVBVM60(?), ref: 0052730B
__vbaSetSystemError.MSVBVM60(00000002), ref: 00527321
__vbaSetSystemError.MSVBVM60(00000004), ref: 0052732D
__vbaExitProc.MSVBVM60 ref: 00527352
__vbaExitProc.MSVBVM60 ref: 005273B4
__vbaAryDestruct.MSVBVM60(00000000,00004460,005273F8), ref: 005273E8
__vbaAryDestruct.MSVBVM60(00000000,00003000), ref: 005273F5

Strings

`D, xrefs: 00527331

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$Construct2DestructExitProcSystem
String ID: `D
API String ID: 3938146970-1435892945
Opcode ID: 4819749cfabad51dab176a065ac5d7dc524f33ae6cb047417d926c3ed6f48fc5
Instruction ID: 09c6f131964149395e672f8d5c7635266e4555b65de5416fdadcf6b59af33568
Opcode Fuzzy Hash: 4819749cfabad51dab176a065ac5d7dc524f33ae6cb047417d926c3ed6f48fc5
Instruction Fuzzy Hash: D5212BB1C4036CAACB20DFE5DD45A8DBFB8BB09B10F20462EA511B7691D7B41A44CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00406A5E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00547069
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00547071
__vbaOnError.MSVBVM60(?), ref: 00547075
__vbaObjSet.MSVBVM60(?,00000000), ref: 00547092
__vbaLateIdCall.MSVBVM60(00000000), ref: 00547099
__vbaFreeObj.MSVBVM60 ref: 005470A5
__vbaExitProc.MSVBVM60 ref: 00547102
__vbaFreeStr.MSVBVM60(0054713D), ref: 00547135
__vbaFreeStr.MSVBVM60 ref: 0054713A

Strings

G, xrefs: 00406A5E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Copy$CallErrorExitLateProc
String ID: G
API String ID: 3914876874-985283518
Opcode ID: ec3f9226610fc115e433005f38ddbd675019cb3bd21ff39f3edf066480f1c61b
Instruction ID: 499e9815f3b1a65138826359cb4622272cde7e3e2511b209993bd61ca51f8e8a
Opcode Fuzzy Hash: ec3f9226610fc115e433005f38ddbd675019cb3bd21ff39f3edf066480f1c61b
Instruction Fuzzy Hash: BC21F6B1C00219ABCB04DF99DE85ADEFBB8FF58704F10412AE945B32A0D7B45A41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0052AD40 Relevance: 16.6, APIs: 11, Instructions: 83COMMON

Download Yara Rule

APIs

#525.MSVBVM60(00000080,6D02D8B1,00000000,00000000,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052AD85
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052AD90
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052ADA4
__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052ADB1
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052ADBE
__vbaStrToAnsi.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052ADC5
__vbaStrToAnsi.MSVBVM60(?,?,?,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0052ADDD
__vbaSetSystemError.MSVBVM60(0000001C,00000000,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052ADE7
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052ADF5
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052AE11
__vbaFreeStr.MSVBVM60(0052AE4B,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0052AE44

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Ansi$CopyFree$#525ErrorListMoveSystemUnicode
String ID:
API String ID: 1576035910-0
Opcode ID: 352901084e84eb437ef5d450798eb9b9ad29bb1b8b9b1eb28a63ad79812a3b49
Instruction ID: de1cd6dd4a2cdc3599875197071386c2d50063ca9a0063dd6d04a02684c34eb8
Opcode Fuzzy Hash: 352901084e84eb437ef5d450798eb9b9ad29bb1b8b9b1eb28a63ad79812a3b49
Instruction Fuzzy Hash: 0031C8B1C00219AFDB04DBE4DD85DEEBBBCEF58701F10812AF502B2590EB746A45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005286B0 Relevance: 15.1, APIs: 10, Instructions: 81COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,00527857,?), ref: 005286CE
__vbaOnError.MSVBVM60(?,?,00000000,?,00000000,004047D6), ref: 005286FE
__vbaOnError.MSVBVM60(000000FF,?,00000000,004047D6), ref: 0052870D
__vbaSetSystemError.MSVBVM60(?,00000002,?,00000000,004047D6), ref: 0052872A
#685.MSVBVM60(?,00000002,?,00000000,004047D6), ref: 0052873D
__vbaObjSet.MSVBVM60(?,00000000,?,00000002,?,00000000,004047D6), ref: 00528748
__vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000001C), ref: 0052877B
__vbaFreeObj.MSVBVM60 ref: 00528796
__vbaOnError.MSVBVM60(?), ref: 005287A5
__vbaExitProc.MSVBVM60 ref: 00528836

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$#685CheckChkstkExitFreeHresultProcSystem
String ID:
API String ID: 3243212870-0
Opcode ID: 30a5f0cf338de1b9593c5f6517d1978955af361ea6b3cc6d6c1fde868759900b
Instruction ID: 015ce0dc524cf26ba8fee0ede85b1f5b4a367c4d7718e44302b0ddd967dc3c03
Opcode Fuzzy Hash: 30a5f0cf338de1b9593c5f6517d1978955af361ea6b3cc6d6c1fde868759900b
Instruction Fuzzy Hash: E631E0B4D01218EBDB04DFD4D948B9EBBB4FF49304F20856AE501BB290C7B85A44CF94

Uniqueness

Uniqueness Score: -1.00%

Function 005445C0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544619
__vbaNew2.MSVBVM60(004105F0,00557168), ref: 00544631
__vbaObjSetAddref.MSVBVM60(?), ref: 00544649
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000010), ref: 00544663
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544672
__vbaCastObj.MSVBVM60(00000000,00423D04), ref: 0054467B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00544686
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 0054468E
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544697
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005446F0

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AddrefFree$CastCheckErrorExitHresultNew2Proc
String ID:
API String ID: 3207434305-0
Opcode ID: 40f6c53847089ec52dc8abab042041e98c380c23649fd838ad93945e0d71497a
Instruction ID: 2a0917ba012176abba0fc2e5d7d9df4e714407c4c1271c5327937485318aaf3d
Opcode Fuzzy Hash: 40f6c53847089ec52dc8abab042041e98c380c23649fd838ad93945e0d71497a
Instruction Fuzzy Hash: 01219C75D50228ABCB009FA4DD49ADEBFB8FB4DB11F10411AF901B32A0D7B45841CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0052A320 Relevance: 15.1, APIs: 10, Instructions: 71COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0052A36B
#600.MSVBVM60(00004008), ref: 0052A388
__vbaFpI4.MSVBVM60 ref: 0052A38E
#598.MSVBVM60 ref: 0052A396
__vbaSetSystemError.MSVBVM60(001F0FFF,000000FF,00000000), ref: 0052A3B5
__vbaSetSystemError.MSVBVM60(00000000,000001F4), ref: 0052A3C4
#598.MSVBVM60 ref: 0052A3CE
__vbaSetSystemError.MSVBVM60(00000000,?), ref: 0052A3E0
__vbaSetSystemError.MSVBVM60(00000000), ref: 0052A3E8
__vbaExitProc.MSVBVM60 ref: 0052A3F0

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$System$#598$#600ExitProc
String ID:
API String ID: 1197202047-0
Opcode ID: 50c3cc380c09edd4fdbeb7833497848e419dacbae7477ebdf57380a1a10506bf
Instruction ID: 33e246370264e20a42c1f188db57b9b3d2301e97640510171edf41b533608f14
Opcode Fuzzy Hash: 50c3cc380c09edd4fdbeb7833497848e419dacbae7477ebdf57380a1a10506bf
Instruction Fuzzy Hash: 66214CB1C00218ABCB10EFAADD4998DFFF8FF98710F10862AE511B36A1C7B458408F95

Uniqueness

Uniqueness Score: -1.00%

Function 0052EB40 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__vbaDateStr.MSVBVM60(1/1/1990,?,?,?,?,?,?,?,?,004047D6), ref: 0052EB91
__vbaStrCat.MSVBVM60(IMCSHUT.FLG,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052EBA9
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,004047D6), ref: 0052EBB4
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,004047D6), ref: 0052EBE0
__vbaHresultCheckObj.MSVBVM60(00000000,004028D0,0041B37C,00000710,?,?,?,?,?,?,?,?,004047D6), ref: 0052EC06
__vbaHresultCheckObj.MSVBVM60(00000000,004028D0,0041B37C,00000710,?,?,?,?,?,?,?,?,004047D6), ref: 0052EC28

Strings

1/1/1990, xrefs: 0052EB82
IMCSHUT.FLG, xrefs: 0052EBA4

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$DateFreeMove
String ID: 1/1/1990$IMCSHUT.FLG
API String ID: 1553518758-3777194688
Opcode ID: 430b87b9ff8fd7c0b7e52768abb60a41e7c2ead4a01c04e9928c9f1faf1fe33a
Instruction ID: fd69bbb57654a5bced7ecfd6fc1da88afc0fd796f5d9e6f3d516bde09120f4e6
Opcode Fuzzy Hash: 430b87b9ff8fd7c0b7e52768abb60a41e7c2ead4a01c04e9928c9f1faf1fe33a
Instruction Fuzzy Hash: 3231AF70901619EFC700DF94CD89AAABFB8FF45700F50452AF946A72D0C7786981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0054BF00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054BF76
__vbaVarDup.MSVBVM60 ref: 0054BFB3
__vbaVarDup.MSVBVM60 ref: 0054BFC5
#595.MSVBVM60(?,00000040,?,?,?), ref: 0054BFD9
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 0054BFF1
__vbaExitProc.MSVBVM60 ref: 0054C063

Strings

What's this?, xrefs: 0054BF92
TriTech can securely store your administrator user name and password in an encrypted file on your network. If you choose to do so, xrefs: 0054BFB5

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$#595ErrorExitFreeListProc
String ID: TriTech can securely store your administrator user name and password in an encrypted file on your network. If you choose to do so$What's this?
API String ID: 291725240-1889265815
Opcode ID: d8b45bf2e390a252fdfc7c43fdddad4127ee618f90b30d0c188da39f2754d5ad
Instruction ID: cfeb1e5e7f53141f621c66cf0edcec251ae4e1132c8a099e71004f6dfb56ec51
Opcode Fuzzy Hash: d8b45bf2e390a252fdfc7c43fdddad4127ee618f90b30d0c188da39f2754d5ad
Instruction Fuzzy Hash: 7D31E6B1D11318DFCB14DFD8DA45ADDBBB8FB48B04F20816AE60AAB250D7B41A05CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00407378 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00544371

Part of subcall function 0051B7C0: __vbaOnError.MSVBVM60(?,6D02D8CD,6D02D8B1,00000000), ref: 0051B808
Part of subcall function 0051B7C0: #525.MSVBVM60(000001F4), ref: 0051B813
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B824
Part of subcall function 0051B7C0: __vbaLenBstr.MSVBVM60(?), ref: 0051B82A
Part of subcall function 0051B7C0: __vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051B839
Part of subcall function 0051B7C0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0051B847
Part of subcall function 0051B7C0: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B855
Part of subcall function 0051B7C0: __vbaFreeStr.MSVBVM60 ref: 0051B869
Part of subcall function 0051B7C0: #523.MSVBVM60(?), ref: 0051B87C
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B887
Part of subcall function 0051B7C0: #618.MSVBVM60(?,?), ref: 0051B88F
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B89A
Part of subcall function 0051B7C0: #537.MSVBVM60(00000000,00000000), ref: 0051B89E
Part of subcall function 0051B7C0: __vbaStrMove.MSVBVM60 ref: 0051B8A9
Part of subcall function 0051B7C0: __vbaStrCmp.MSVBVM60(00000000), ref: 0051B8AC
Part of subcall function 0051B7C0: __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0051B8C5
Part of subcall function 0051B7C0: __vbaLenBstr.MSVBVM60(?), ref: 0051B8D7

__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544387
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544392
__vbaStrCat.MSVBVM60(00414914,00000000), ref: 0054439A
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005443A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 005443D4
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544434

Strings

(:@, xrefs: 005443B1, 005443B4

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$ErrorFree$BstrList$#523#525#537#618AnsiExitProcSystemUnicode
String ID: (:@
API String ID: 1882619789-2590658979
Opcode ID: 52534e24b8090d4c257b24ed003d39fe4b555285df4d50d9ed09d56cbb916057
Instruction ID: 00d977cbab83cfdbcec06f350c84000d7044747611a89d1cda83aace71407aa8
Opcode Fuzzy Hash: 52534e24b8090d4c257b24ed003d39fe4b555285df4d50d9ed09d56cbb916057
Instruction Fuzzy Hash: 002106B5D00208AFDB00DFA9C985AEEBBB8FF4C700F50852EE915B3250D77469448FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00535460 Relevance: 13.6, APIs: 9, Instructions: 125COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 005354BB
__vbaNew2.MSVBVM60(00406138,005560EC), ref: 005354D3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F63C,000001B8), ref: 005354FE
__vbaNew2.MSVBVM60(00406138,005560EC), ref: 00535520
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F63C,000002B0), ref: 00535587
#598.MSVBVM60 ref: 0053558D
__vbaNew2.MSVBVM60(00406138,005560EC), ref: 005355A5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F66C,00000704), ref: 005355E4
__vbaExitProc.MSVBVM60 ref: 00535641

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresultNew2$#598ErrorExitProc
String ID:
API String ID: 1698778303-0
Opcode ID: 30ad1e63654f9ef50089bf1bd9d007ac83dd18d40671f89ca7440d3ad29e0cb1
Instruction ID: 240c7b0fe3a953633284c694fd9dbcd6f41221502decd1798a80dd8556971721
Opcode Fuzzy Hash: 30ad1e63654f9ef50089bf1bd9d007ac83dd18d40671f89ca7440d3ad29e0cb1
Instruction Fuzzy Hash: F54189B0A41754EBCB00DF59C949A9EBFF9FF94711F20802AF406A72A1D7759842CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00535690 Relevance: 13.6, APIs: 9, Instructions: 122COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 005356EB
__vbaNew2.MSVBVM60(00406138,005560EC), ref: 00535703
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F63C,000001B8), ref: 0053572E
__vbaNew2.MSVBVM60(00406138,005560EC), ref: 00535750
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F63C,000002B0), ref: 005357B7
#598.MSVBVM60 ref: 005357BD
__vbaNew2.MSVBVM60(00406138,005560EC), ref: 005357D5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041F66C,00000700,?,0040BF34,0040BF34,0040BF34), ref: 00535811
__vbaExitProc.MSVBVM60(?,0040BF34,0040BF34,0040BF34), ref: 0053586E

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresultNew2$#598ErrorExitProc
String ID:
API String ID: 1698778303-0
Opcode ID: 527df5131a2e2130d7f47396bb2aaed583b5d32ba2c7342fdf3c4fbe9d723ed1
Instruction ID: 0313066e6f3664192a6fb1325518c8ba6d874c2e7ed3492b8da991105f4d4ec9
Opcode Fuzzy Hash: 527df5131a2e2130d7f47396bb2aaed583b5d32ba2c7342fdf3c4fbe9d723ed1
Instruction Fuzzy Hash: B5418A70A41754EBCB00DF59C949A9ABFF8FF98750F20806AF405E72A1D3759842CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 005471F0 Relevance: 13.6, APIs: 9, Instructions: 120COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00547258
__vbaStrToAnsi.MSVBVM60(?,0040BC48,00000000,0000003F,?,?,?), ref: 005472B5
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000), ref: 005472C1
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 005472CF
__vbaStrToUnicode.MSVBVM60(?,?), ref: 005472DD
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 005472F8
__vbaExitProc.MSVBVM60 ref: 0054736E
__vbaFreeStr.MSVBVM60(005473A0), ref: 00547398
__vbaFreeStr.MSVBVM60 ref: 0054739D

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$AnsiError$ExitListProcSystemUnicode
String ID:
API String ID: 1412996767-0
Opcode ID: b778dbbdd0372e104cd22674775da30a2d682d03f4da37897b9bbf747de6cafa
Instruction ID: 8eff304dcca85e98a19620e44489408509f5a548d28d90f084feb027bc0d482d
Opcode Fuzzy Hash: b778dbbdd0372e104cd22674775da30a2d682d03f4da37897b9bbf747de6cafa
Instruction Fuzzy Hash: F741C4B2D10228ABCB14DFD8D9849EEBBB8FF48B00F14461EF512A7294D7745A45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00546460 Relevance: 13.6, APIs: 9, Instructions: 66COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005464C9
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005464D1
__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005464D5
__vbaObjSet.MSVBVM60(?,00000000), ref: 005464F2
__vbaLateIdCall.MSVBVM60(00000000), ref: 005464F9
__vbaFreeObj.MSVBVM60 ref: 00546505
__vbaExitProc.MSVBVM60 ref: 00546562
__vbaFreeStr.MSVBVM60(0054659D), ref: 00546595
__vbaFreeStr.MSVBVM60 ref: 0054659A

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$Copy$CallErrorExitLateProc
String ID:
API String ID: 3914876874-0
Opcode ID: d1dcdbba63d962968d805147ab278609f5224a54c58ea149f617926b954f5813
Instruction ID: 92330deb985dc9ef9e9f0a82a561b3b978e56675429dff5987c0ce46f174c112
Opcode Fuzzy Hash: d1dcdbba63d962968d805147ab278609f5224a54c58ea149f617926b954f5813
Instruction Fuzzy Hash: 882128B1C00219ABCB00DF99DE85ADEFBB8FF59700F10412AE901B36A0D7B46941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00522410 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__vbaVarDup.MSVBVM60(6D02D8B1,00000000,00000000), ref: 00522469
#660.MSVBVM60(?,?,?,?,?), ref: 0052248C
__vbaVarCat.MSVBVM60(?,?,?), ref: 0052249E
__vbaStrVarMove.MSVBVM60(00000000), ref: 005224A5
__vbaStrMove.MSVBVM60 ref: 005224B0
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 005224C4

Strings

000, xrefs: 0052245F

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$#660FreeList
String ID: 000
API String ID: 1966154216-582302429
Opcode ID: c22075f59c71c18b68e2d4d7947a716ddfc8c7de22edcba9d28313de5b8345fd
Instruction ID: 4b7b9ef0775ae58f69bf9f71b5382a3dac87e0d150288035f5b1c55055d99006
Opcode Fuzzy Hash: c22075f59c71c18b68e2d4d7947a716ddfc8c7de22edcba9d28313de5b8345fd
Instruction Fuzzy Hash: 1F21E2B5C00249AFDB00DFE4D989AEEBFB8FF48700F10452AE506A6690E7745189CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00406DF5 Relevance: 12.1, APIs: 8, Instructions: 85COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,00000000), ref: 0052F1A5
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 0052F1E1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041FA3C,00000064,?,?,00000000), ref: 0052F203
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 0052F212
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 0052F287
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041FA3C,0000005C,?,?,00000000), ref: 0052F2A6
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 0052F2AF
__vbaExitProc.MSVBVM60(?,?,00000000), ref: 0052F2B1

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckFreeHresult$ErrorExitProc
String ID:
API String ID: 68195822-0
Opcode ID: 8aedb125b6bcc2b50c25a2164165a2d06543abfa35cab7a135af8ea6ee83c36b
Instruction ID: 45214d5161470a369805c649a16823a090bd73aa7533284ddc2d629beeba2b1d
Opcode Fuzzy Hash: 8aedb125b6bcc2b50c25a2164165a2d06543abfa35cab7a135af8ea6ee83c36b
Instruction Fuzzy Hash: F4318B75901214EBC710EFA8EE88A9EBFB4BF0A700F60453AF506B3290C7749545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005462F0 Relevance: 12.1, APIs: 8, Instructions: 74COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054634C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00546369
__vbaLateIdCall.MSVBVM60(00000000), ref: 0054636C
__vbaFreeObj.MSVBVM60 ref: 00546378
__vbaObjSet.MSVBVM60(?,00000000), ref: 005463A9
__vbaLateIdSt.MSVBVM60(00000000), ref: 005463AC
__vbaFreeObj.MSVBVM60 ref: 005463B5
__vbaExitProc.MSVBVM60 ref: 00546412

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$FreeLate$CallErrorExitProc
String ID:
API String ID: 2406348268-0
Opcode ID: 0cb10d4d2c8f2e526497a8a4e3b4a0826e108500fefecb35191e0d15347f8e59
Instruction ID: bdbb49738d7666fa9c481513a462ede447de41453ed74e95e2aea4b45a51c254
Opcode Fuzzy Hash: 0cb10d4d2c8f2e526497a8a4e3b4a0826e108500fefecb35191e0d15347f8e59
Instruction Fuzzy Hash: 932127B1D00208ABCB00DFA9C989ADEFFB8FF59704F10812AE905A7260D77559418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0051B170 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D0F595C,00000000,6D01E251), ref: 0051B1B2
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0051B1C8
__vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051B1D5
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 0051B1DD
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0051B1EE
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0051B1F5
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0051B24D
__vbaExitProc.MSVBVM60 ref: 0051B256

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AnsiErrorUnicode$ExitFreeListProcSystem
String ID:
API String ID: 3485265434-0
Opcode ID: 4f6cfce1da0a1206bb26c3af59a8143fd0524bd3b419a89ecb47b8786c2fac11
Instruction ID: e1a716f1664531049dcc67b632a7a34c17cbfac8157b26507113cc99e6c709b9
Opcode Fuzzy Hash: 4f6cfce1da0a1206bb26c3af59a8143fd0524bd3b419a89ecb47b8786c2fac11
Instruction Fuzzy Hash: DE11C4B5800218AFDB04EFA9CD45EDEBBB8FB4C700F14466AE905F3650D774A9448BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00525F50 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00525FD1
__vbaCopyBytes.MSVBVM60(00000018,?,?,?,00556068), ref: 00526017

Part of subcall function 00529100: __vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 00529288
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 005292B0
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000080,?,?), ref: 005292DC
Part of subcall function 00529100: __vbaFpI4.MSVBVM60(?,?), ref: 005292FD
Part of subcall function 00529100: __vbaFreeObj.MSVBVM60(?,?), ref: 00529308
Part of subcall function 00529100: __vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 00529321
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 00529349
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000088,?,?), ref: 00529375
Part of subcall function 00529100: __vbaFpI4.MSVBVM60(?,?), ref: 00529396
Part of subcall function 00529100: __vbaFreeObj.MSVBVM60(?,?), ref: 005293A1
Part of subcall function 00529100: __vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 005293BA

__vbaCopyBytes.MSVBVM60(00000018,?,?,?,?), ref: 00526036
__vbaSetSystemError.MSVBVM60(00000000,?), ref: 005260B7
__vbaExitProc.MSVBVM60 ref: 005260BD

Part of subcall function 00529100: __vbaOnError.MSVBVM60(?,?,6D0527C2,6D116A18), ref: 0052919C
Part of subcall function 00529100: __vbaSetSystemError.MSVBVM60(?,?), ref: 005291B7
Part of subcall function 00529100: __vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 005291DB
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 00529209
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000088,?,?), ref: 0052923D
Part of subcall function 00529100: __vbaFpI4.MSVBVM60(?,?), ref: 00529264
Part of subcall function 00529100: __vbaFreeObj.MSVBVM60(?,?), ref: 0052926F

__vbaExitProc.MSVBVM60 ref: 0052611F
__vbaErrorOverflow.MSVBVM60 ref: 00526157

Part of subcall function 005296E0: __vbaOnError.MSVBVM60(?,?,?,00000000), ref: 00529602

Part of subcall function 005296E0: __vbaOnError.MSVBVM60(?,?,?,00000000), ref: 0052974F
Part of subcall function 005296E0: __vbaSetSystemError.MSVBVM60 ref: 00529763
Part of subcall function 005296E0: __vbaSetSystemError.MSVBVM60(?,000000F0,?,?), ref: 00529789

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$CheckHresult$New2System$Free$BytesCopyExitProc$Overflow
String ID:
API String ID: 3180018006-0
Opcode ID: c25539098ef0aa81af0300fe62ef681351a20ad55337a68ca4b5fbedd484bfcd
Instruction ID: a97a54be4c9b696df61fd3e51725d6de047c512319985c95f3c66eb4cd26e19d
Opcode Fuzzy Hash: c25539098ef0aa81af0300fe62ef681351a20ad55337a68ca4b5fbedd484bfcd
Instruction Fuzzy Hash: 79417271D102299BCF04DFA8DD49ADDBBB9BF49700F54811AB106B7690DBB46A04CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0054AD70 Relevance: 10.6, APIs: 7, Instructions: 87COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 0054ADC7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,0000001C), ref: 0054ADF8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00423D04,00000700), ref: 0054AE31
__vbaExitProc.MSVBVM60 ref: 0054AE9B
__vbaFreeStr.MSVBVM60(0054AED2), ref: 0054AEC5
__vbaFreeStr.MSVBVM60 ref: 0054AECA
__vbaFreeStr.MSVBVM60 ref: 0054AECF

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CheckHresult$ErrorExitProc
String ID:
API String ID: 120088924-0
Opcode ID: 17778e79e277e82f97240c36db69f317cdd96f602ec5611284e5aeefbfc59ace
Instruction ID: 4266cb71d19d62ba851691bb97c23924b9573dcadfadb13793e2e56dbcc5cb76
Opcode Fuzzy Hash: 17778e79e277e82f97240c36db69f317cdd96f602ec5611284e5aeefbfc59ace
Instruction Fuzzy Hash: A63108B1C40618ABCB10DF99D9889DEFBB8FF98710F14850AF512B71A0D7B46940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0054F810 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054F82E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054F875
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0054F899
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0054F8CC

Strings

_aslcont, xrefs: 0054F891
%..Pw_ STOREstore,,&(C2C*c2c) .. {-$- $-@-}, xrefs: 0054F8C4

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Copy$ChkstkError
String ID: %..Pw_ STOREstore,,&(C2C*c2c) .. {-$- $-@-}$_aslcont
API String ID: 1771118016-1961025572
Opcode ID: ec085329523f7a9252f6c7f602d34909012892d6a285a8d97482bbcbf46419a6
Instruction ID: b9a536379b7beff10dc94c0d9cf24d07291e2a2d31d4ab9c7c3cdcd473ba860f
Opcode Fuzzy Hash: ec085329523f7a9252f6c7f602d34909012892d6a285a8d97482bbcbf46419a6
Instruction Fuzzy Hash: 23216075900249EFCB00DF58C944B9EBBB1FF49314F208269F9156B390C779AA40CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004066C9 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,?,?,004047D6), ref: 0054F4AE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004047D6), ref: 0054F4E7
#593.MSVBVM60(0000000A), ref: 0054F506
__vbaR8IntI2.MSVBVM60 ref: 0054F528
__vbaFreeVar.MSVBVM60 ref: 0054F535
__vbaStrI2.MSVBVM60(0000000A), ref: 0054F555
__vbaStrMove.MSVBVM60 ref: 0054F560
#516.MSVBVM60(004091F4), ref: 0054F574
#608.MSVBVM60(0000000A), ref: 0054F591
__vbaStrVarMove.MSVBVM60(0000000A), ref: 0054F59B
__vbaStrMove.MSVBVM60 ref: 0054F5A6
__vbaFreeVar.MSVBVM60 ref: 0054F5AF

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Move$Free$#516#593#608ChkstkError
String ID:
API String ID: 2982081227-0
Opcode ID: 939f6248d0277650a2612114a6e8043267e4f0616772e48898363c3df7e2cbba
Instruction ID: c2251855f3a8e73ec2c103165fef0c18c96a1c000de9364e5b4f2dff17158c0a
Opcode Fuzzy Hash: 939f6248d0277650a2612114a6e8043267e4f0616772e48898363c3df7e2cbba
Instruction Fuzzy Hash: 59215CB4801208EBDB00DF94DA497DEBFB4FF45709F108569E511776A0C7B80A84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00517750 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00517792
__vbaStrCat.MSVBVM60(DetGroup.On,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177A6
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177B1

Part of subcall function 0052ACA0: __vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0052ACDA
Part of subcall function 0052ACA0: __vbaSetSystemError.MSVBVM60(00000000), ref: 0052ACE8
Part of subcall function 0052ACA0: __vbaStrToUnicode.MSVBVM60(?,00000000), ref: 0052ACF3
Part of subcall function 0052ACA0: __vbaFreeStr.MSVBVM60 ref: 0052ACFC

__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D2
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005177D8

Strings

DetGroup.On, xrefs: 005177A1

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ErrorFree$AnsiExitMoveProcSystemUnicode
String ID: DetGroup.On
API String ID: 3544525798-2209319497
Opcode ID: c91ce4188514d51564b13c9fdd863045810641f4a7f5a8f4e05ca05536210843
Instruction ID: 0c83bca2d8d2d4865ed4ee116996a9114e37820882ce0fb86a25add0e5e394bb
Opcode Fuzzy Hash: c91ce4188514d51564b13c9fdd863045810641f4a7f5a8f4e05ca05536210843
Instruction Fuzzy Hash: E7113974D10219AFCB40DFB8CD49AEDBBB4FB1CB01F00822AE805F26A0E77404448F65

Uniqueness

Uniqueness Score: -1.00%

Function 00527520 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527565
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527573

Part of subcall function 0051AF40: __vbaOnError.MSVBVM60(?), ref: 0051AF88
Part of subcall function 0051AF40: __vbaStrToAnsi.MSVBVM60(?,0040BC48,00000000), ref: 0051AF9E
Part of subcall function 0051AF40: __vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051AFAB
Part of subcall function 0051AF40: __vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 0051AFB5
Part of subcall function 0051AF40: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0051AFC0
Part of subcall function 0051AF40: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 0051AFD3
Part of subcall function 0051AF40: #525.MSVBVM60(00000000), ref: 0051AFE5
Part of subcall function 0051AF40: __vbaStrMove.MSVBVM60 ref: 0051AFF0
Part of subcall function 0051AF40: __vbaLenBstr.MSVBVM60(?), ref: 0051B000
Part of subcall function 0051AF40: __vbaStrToAnsi.MSVBVM60(?,?,00000000), ref: 0051B00B
Part of subcall function 0051AF40: __vbaStrToAnsi.MSVBVM60(?,00000000,00000000), ref: 0051B015
Part of subcall function 0051AF40: __vbaSetSystemError.MSVBVM60(00000000), ref: 0051B01F
Part of subcall function 0051AF40: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B030
Part of subcall function 0051AF40: __vbaStrToUnicode.MSVBVM60(?,?), ref: 0051B03A

__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527587
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527590
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00527596

Strings

ImcExeRunningPath, xrefs: 0052756B

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AnsiError$Unicode$FreeMoveSystem$#525BstrCopyExitListProc
String ID: ImcExeRunningPath
API String ID: 2732686413-4023986263
Opcode ID: 5f1fe1df71fafb95a1d20d54d613325184941ef60c5eec20947f9bf459c0552a
Instruction ID: ca1bea1806a85ada67535a660e588a6a88bb2a386f7db7fa6b03c53e14d69dcb
Opcode Fuzzy Hash: 5f1fe1df71fafb95a1d20d54d613325184941ef60c5eec20947f9bf459c0552a
Instruction Fuzzy Hash: D601E5B5D00209AFCB40EFB8DA49ADEBBF4FB0C700F10417AE405F26A0E7745A048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00548710 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00548770
__vbaStrCmp.MSVBVM60(0040BC48,?), ref: 005487DB
__vbaFreeStr.MSVBVM60 ref: 005487FE
__vbaExitProc.MSVBVM60 ref: 00548872
__vbaFreeStr.MSVBVM60(005488A4), ref: 0054889C
__vbaFreeStr.MSVBVM60 ref: 005488A1

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$ErrorExitProc
String ID:
API String ID: 363817667-0
Opcode ID: 7a8938002166dca2f4af7dcf12932ced8a5d17525880a3becccd6c5f9ccb466f
Instruction ID: d10b626050b699b08d42661f35c0fe91aa2936df07dd8599de1549cf22e0c853
Opcode Fuzzy Hash: 7a8938002166dca2f4af7dcf12932ced8a5d17525880a3becccd6c5f9ccb466f
Instruction Fuzzy Hash: B841A2B1C00218AFCB14DF99D9849EEFBF9FF98700F14851AE512B7250D7B0AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004057AF Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00548302
__vbaStrCopy.MSVBVM60 ref: 00548310
__vbaStrMove.MSVBVM60 ref: 00548395
__vbaExitProc.MSVBVM60 ref: 005483FC
__vbaFreeStr.MSVBVM60(0054843D), ref: 00548435
__vbaFreeStr.MSVBVM60 ref: 0054843A

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Free$CopyErrorExitMoveProc
String ID:
API String ID: 2049797770-0
Opcode ID: 5834337c340af98226cc03b49e9f60b64f68cb76566edd586fe00e510c5aa6b4
Instruction ID: ee73decae6f9d12b4d510a337c6fb85c29348923fa3cd77a9ba7ce80ee1f4886
Opcode Fuzzy Hash: 5834337c340af98226cc03b49e9f60b64f68cb76566edd586fe00e510c5aa6b4
Instruction Fuzzy Hash: E341C5B5C00219EFCB14DF99D9848DEFBB8FF98700F14855AE512A3264DBB06A45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 005488D0 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00548918
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?), ref: 0054893E
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,?,?), ref: 00548952
__vbaStrToUnicode.MSVBVM60(00403FF8,?,?,00000000,?,00000000,?,?), ref: 0054895D
__vbaFreeStr.MSVBVM60(?,00000000,?,00000000,?,?), ref: 00548971
__vbaExitProc.MSVBVM60(?,00000000,?,00000000,?,?), ref: 00548982

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$AnsiExitFreeProcSystemUnicode
String ID:
API String ID: 2910957264-0
Opcode ID: 2e59496ade5fad68e2f80e50ddd521c669d0efaeb1a8c671e9d0017f7d0ea959
Instruction ID: dae42042b56a28846e07754b626b2953181a6be2574a02986243e199c29c1d68
Opcode Fuzzy Hash: 2e59496ade5fad68e2f80e50ddd521c669d0efaeb1a8c671e9d0017f7d0ea959
Instruction Fuzzy Hash: F42104B6D00218AFCB00DFA9D9859EEBBB8FB0C700F50816EF915B3650D77499408F64

Uniqueness

Uniqueness Score: -1.00%

Function 0054FBC0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054FBDE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054FC25
__vbaCastObj.MSVBVM60(00000000,00426048,?,?,?,?,004047D6), ref: 0054FC39
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,004047D6), ref: 0054FC44
__vbaHresultCheckObj.MSVBVM60(00000000,?,004253C8,0000005C), ref: 0054FC71
__vbaFreeObj.MSVBVM60 ref: 0054FC86

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CastCheckChkstkErrorFreeHresult
String ID:
API String ID: 3973976014-0
Opcode ID: d03edd750c2a88ea3e3eeac768c6dac417c85ff418573082c8d3dae0c7ab0d4f
Instruction ID: b7fd6f0552f34b35f14add6156a8c03739d6d9c20da9ccfa4032fc1a96f28e7f
Opcode Fuzzy Hash: d03edd750c2a88ea3e3eeac768c6dac417c85ff418573082c8d3dae0c7ab0d4f
Instruction Fuzzy Hash: 9F21FAB5900608EFDB14DF98C989BDE7FB4FB48755F108519F905AB290C7B8AA40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0054F900 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054F91E
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0054F962
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054F971
#717.MSVBVM60(?,00004008,00000080,00000000), ref: 0054F9AA
__vbaVargVarMove.MSVBVM60 ref: 0054F9B6
__vbaFreeStr.MSVBVM60(0054F9ED,?,?,?,?,004047D6), ref: 0054F9E6

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$#717ChkstkCopyErrorFreeMoveVarg
String ID:
API String ID: 534005448-0
Opcode ID: 6fe250f7bccd54fddc073429d475cd65a20492671292868b903ece75565cea5f
Instruction ID: 946b18c4df4119c1b11aceccf0e3b762f767f46802ba0e3c63f54a317b32140e
Opcode Fuzzy Hash: 6fe250f7bccd54fddc073429d475cd65a20492671292868b903ece75565cea5f
Instruction Fuzzy Hash: BB213CB1901209EFDB14DF94CA49BDEBBB4FF44304F208169F915AB290C774AA44CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0054BDD0 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BE29
__vbaCastObj.MSVBVM60(00000000,004253C8,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BE35
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BE40
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BE4B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BE54
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054BEB1

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AddrefCastErrorExitFreeProc
String ID:
API String ID: 1221941477-0
Opcode ID: 4ad4afc912120e489c19e7ae1b41521d71c77e9cda56b7f38dae9fe4e8192ea2
Instruction ID: 7198b2af31bf2e54bf4e8eb2696aca6046a619d284cc8cb7bf1bfd0efa24c528
Opcode Fuzzy Hash: 4ad4afc912120e489c19e7ae1b41521d71c77e9cda56b7f38dae9fe4e8192ea2
Instruction Fuzzy Hash: 36112AB5C40218ABCB009FA9CD49ADEFFBCFF98711F10811AF901B62A0D7B855418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0054F730 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004047D6), ref: 0054F74E
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0054F792
__vbaStrCopy.MSVBVM60(?,?,?,?,004047D6), ref: 0054F79E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004047D6), ref: 0054F7AD
__vbaFreeStr.MSVBVM60(0054F7E2,?,?,?,?,004047D6), ref: 0054F7D2
__vbaFreeStr.MSVBVM60(?,?,?,?,004047D6), ref: 0054F7DB

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CopyFree$ChkstkError
String ID:
API String ID: 2618516211-0
Opcode ID: 4fccb2a660a852466f7eba4a6c437e334aff90eb16415e576f91e5748b9f0c31
Instruction ID: ec59c9ed47320bfb361aa674424c2fb44e3826287a12f5b57208def4b8ffc0e0
Opcode Fuzzy Hash: 4fccb2a660a852466f7eba4a6c437e334aff90eb16415e576f91e5748b9f0c31
Instruction Fuzzy Hash: 63112B75900209DFCB04DF94C989BDDBBB4FF44714F108269F811AB2A0C7B4AA45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0054FCD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0054FD12
__vbaHresultCheckObj.MSVBVM60(00000000,?,00426048,000001B4,?,SFX50-NKB8U-KHADD-G4AA,?), ref: 0054FD41
__vbaExitProc.MSVBVM60(?,00426048,000001B4,?,SFX50-NKB8U-KHADD-G4AA,?), ref: 0054FD47
__vbaExitProc.MSVBVM60(?,SFX50-NKB8U-KHADD-G4AA,?), ref: 0054FDA9

Strings

SFX50-NKB8U-KHADD-G4AA, xrefs: 0054FD23

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ExitProc$CheckErrorHresult
String ID: SFX50-NKB8U-KHADD-G4AA
API String ID: 2222841469-3288868320
Opcode ID: 04dd68473182b5df420a46e0c790d0935ce70b3d0d2ff4b39b235795ab65339f
Instruction ID: 15b5d2f480939291b93db9d2965c0ff2ad9e3e766674fb377fb990a20a8e295d
Opcode Fuzzy Hash: 04dd68473182b5df420a46e0c790d0935ce70b3d0d2ff4b39b235795ab65339f
Instruction Fuzzy Hash: 55011BB4D40654ABC7009F99C949ADEFFB8FF94704F10842BF901B76A0C3B455008FA5

Uniqueness

Uniqueness Score: -1.00%

Function 005277D0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,00000000), ref: 00527848

Part of subcall function 005286B0: __vbaChkstk.MSVBVM60(00000000,004047D6,?,?,?,00527857,?), ref: 005286CE
Part of subcall function 005286B0: __vbaOnError.MSVBVM60(?,?,00000000,?,00000000,004047D6), ref: 005286FE
Part of subcall function 005286B0: __vbaOnError.MSVBVM60(000000FF,?,00000000,004047D6), ref: 0052870D
Part of subcall function 005286B0: __vbaSetSystemError.MSVBVM60(?,00000002,?,00000000,004047D6), ref: 0052872A
Part of subcall function 005286B0: #685.MSVBVM60(?,00000002,?,00000000,004047D6), ref: 0052873D
Part of subcall function 005286B0: __vbaObjSet.MSVBVM60(?,00000000,?,00000002,?,00000000,004047D6), ref: 00528748
Part of subcall function 005286B0: __vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000001C), ref: 0052877B
Part of subcall function 005286B0: __vbaFreeObj.MSVBVM60 ref: 00528796
Part of subcall function 005286B0: __vbaOnError.MSVBVM60(?), ref: 005287A5
Part of subcall function 005286B0: __vbaExitProc.MSVBVM60 ref: 00528836

Part of subcall function 005279F0: __vbaChkstk.MSVBVM60(?,004047D6,?,0052786A,?,?,?), ref: 00527A0E
Part of subcall function 005279F0: __vbaOnError.MSVBVM60(?,?,00000000,?,?,004047D6), ref: 00527A3E
Part of subcall function 005279F0: __vbaOnError.MSVBVM60(000000FF), ref: 00527A5B
Part of subcall function 005279F0: __vbaSetSystemError.MSVBVM60(?,00000028), ref: 00527A7D
Part of subcall function 005279F0: #685.MSVBVM60(?,00000028), ref: 00527A96
Part of subcall function 005279F0: __vbaObjSet.MSVBVM60(?,00000000,?,00000028), ref: 00527AA4
Part of subcall function 005279F0: __vbaHresultCheckObj.MSVBVM60(00000000,?,004145C8,0000001C), ref: 00527AEF
Part of subcall function 005279F0: __vbaFreeObj.MSVBVM60 ref: 00527B16
Part of subcall function 005279F0: __vbaOnError.MSVBVM60(?), ref: 00527B25
Part of subcall function 005279F0: __vbaNew2.MSVBVM60(004105F0,00557168), ref: 00527B63

__vbaCopyBytes.MSVBVM60(00000034,?,?,?,?,?), ref: 0052787D

Part of subcall function 00529100: __vbaOnError.MSVBVM60(?,?,6D0527C2,6D116A18), ref: 0052919C
Part of subcall function 00529100: __vbaSetSystemError.MSVBVM60(?,?), ref: 005291B7
Part of subcall function 00529100: __vbaNew2.MSVBVM60(004105F0,00557168,?,?), ref: 005291DB
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?), ref: 00529209
Part of subcall function 00529100: __vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,00000088,?,?), ref: 0052923D
Part of subcall function 00529100: __vbaFpI4.MSVBVM60(?,?), ref: 00529264
Part of subcall function 00529100: __vbaFreeObj.MSVBVM60(?,?), ref: 0052926F

__vbaCopyBytes.MSVBVM60(00000018,?,?,?,?), ref: 00527899
__vbaExitProc.MSVBVM60(?,?), ref: 00527953

Part of subcall function 00529DE0: __vbaOnError.MSVBVM60(?,?,6D0FC834,?,?,?,?,?,?,?,?,?,004047D6,005278CD), ref: 00529E22
Part of subcall function 00529DE0: __vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,004047D6,005278CD), ref: 00529E58

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$CheckHresult$ExitFreeProcSystem$#685BytesChkstkCopyNew2
String ID:
API String ID: 4014096844-0
Opcode ID: 0d6a584961c3d23edb0e9a393cd626865f2e35fa56c835326817188a57edfc5b
Instruction ID: 41c2cb74845cff9b2897f4b33021d42c41a54efa7fc28d4a2967aabb73ee4aff
Opcode Fuzzy Hash: 0d6a584961c3d23edb0e9a393cd626865f2e35fa56c835326817188a57edfc5b
Instruction Fuzzy Hash: 3951FD72D0021DABDF15DFE4D985DEEBBBABF89300F10851AE105B7191EB746A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0052DA20 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004105F0,00557168,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052DA77
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00414108,00000018,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052DA9C
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,004047D6), ref: 0052DAA9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00415308,0000007C,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052DAC3
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,004047D6), ref: 0052DACC

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 8803340ed4d2eb8563ef00814e54a4508a8a21a9095c244bcc107775220ca5d9
Instruction ID: c135c78ab822bb8a9fd20de7433a4e18509ae14d8963635b185afb6d24a1a5ac
Opcode Fuzzy Hash: 8803340ed4d2eb8563ef00814e54a4508a8a21a9095c244bcc107775220ca5d9
Instruction Fuzzy Hash: 09214A74A44608EBCB00DF64DD8AE9E7FB8FF59741F10446AF505E72A1C7745884CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 005468B0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546909
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546920
__vbaLateIdCall.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546927
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546933
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546990

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CallErrorExitFreeLateProc
String ID:
API String ID: 201240282-0
Opcode ID: 0eb69821eeb2598b24cc4eace918db3824dea5e0398af771125fdd02b0438766
Instruction ID: feec823d5c53b2e214e7620876d74ee8dfe22851a25891d3a9ae7f59085b13e7
Opcode Fuzzy Hash: 0eb69821eeb2598b24cc4eace918db3824dea5e0398af771125fdd02b0438766
Instruction Fuzzy Hash: 89113AB5C00218ABCB009F99CE49ACEFFB8FF59700F10411AF941A62A0D7B45640CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00527410 Relevance: 7.5, APIs: 5, Instructions: 42COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,6D02D8B1,00000000,00000000,?,?,?,?,?,?,?,00000000,004047D6), ref: 00527452
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,?,?,00000000,004047D6), ref: 00527467
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,?,?,00000000,004047D6), ref: 0052747C
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,00000000,004047D6), ref: 00527482

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$System$ExitProc
String ID:
API String ID: 1616901545-0
Opcode ID: e3420d4be53c9e4e8672f6768c6db54098e549638ab7f48223c1b3310247eaa6
Instruction ID: 321bf3e73b240cc0ea60f4097de924e1783a516843222e61a9d62611f54b4aac
Opcode Fuzzy Hash: e3420d4be53c9e4e8672f6768c6db54098e549638ab7f48223c1b3310247eaa6
Instruction Fuzzy Hash: ED0100B0D142789BCB11EFE99A4998DBFB8FB0DB01F50452BF501F2A91D3B455408BE5

Uniqueness

Uniqueness Score: -1.00%

Function 00545600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?), ref: 00545659
__vbaRaiseEvent.MSVBVM60(?,?,?), ref: 00545688
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 005456EE

Strings

`<@, xrefs: 00545691

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$ErrorEventExitProcRaise
String ID: `<@
API String ID: 2408738116-2998479453
Opcode ID: 3a95f539cf3f2e394103bbe58d89eb7e3f414df7e07cf968c3487c94180b2ed3
Instruction ID: 0f42a532702fb4a6a5a04fb0fb34d390a5607574bc8c40cd9a5beae1f5f37218
Opcode Fuzzy Hash: 3a95f539cf3f2e394103bbe58d89eb7e3f414df7e07cf968c3487c94180b2ed3
Instruction Fuzzy Hash: AA2147B0D00618ABCB00DF59C94569EFFB4FF48704F50816AE805AB391D3B49940CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00529DE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,6D0FC834,?,?,?,?,?,?,?,?,?,004047D6,005278CD), ref: 00529E22
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,004047D6,005278CD), ref: 00529E58
__vbaErrorOverflow.MSVBVM60(?,?,?,?,?,?,?,?,?,004047D6,005278CD), ref: 00529EEF

Strings

$@, xrefs: 00529E33

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$Error$ExitOverflowProc
String ID: $@
API String ID: 3328922952-1661285546
Opcode ID: 50a969e0b7f143a09b8ee981f32ebfc272acf67f035c78557aef4a875aeb6cd7
Instruction ID: bc9e519b5b7049066a56782405625c1d01452fa6a19cfdaf6e22c76d3acd9602
Opcode Fuzzy Hash: 50a969e0b7f143a09b8ee981f32ebfc272acf67f035c78557aef4a875aeb6cd7
Instruction Fuzzy Hash: 14112AB4900204DFC744DF68D945A9ABFF4FF49710F11C5AAE809A7361E3749500CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0052E600 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,004047D6), ref: 0052E640
__vbaHresultCheckObj.MSVBVM60(00000000,p(@,0041F66C,00000700,?,?,?,?,?,?,004047D6), ref: 0052E672
__vbaFreeStr.MSVBVM60(0052E687,?,?,?,?,?,?,004047D6), ref: 0052E680

Strings

p(@, xrefs: 0052E62E, 0052E631, 0052E65B, 0052E670

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckCopyFreeHresult
String ID: p(@
API String ID: 1296052212-2150719096
Opcode ID: de9be814cae7454839e22b83f05681df8e008e7895938ee08749ba49c1a0db06
Instruction ID: 48950f3f6eeb13888e6a34dec2c5dff2783ee3be7f35286651617b2377d99712
Opcode Fuzzy Hash: de9be814cae7454839e22b83f05681df8e008e7895938ee08749ba49c1a0db06
Instruction Fuzzy Hash: D0011E74941605EBDB00DF55CD8AEAABFB8FF54B10F20416AF505B32D0C7B86945CE98

Uniqueness

Uniqueness Score: -1.00%

Function 005465C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546616
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546624
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00546681

Strings

127.0.0.1, xrefs: 0054661C

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CopyErrorExitProc
String ID: 127.0.0.1
API String ID: 2453799891-3619153832
Opcode ID: cc9d34be936479fe1e2f22b0b002ca981d077984a3acabd4ba5e95875f00d246
Instruction ID: 3541dab5d887b699331bd234b60eb65b1de353659eeeb7297544379e352677f8
Opcode Fuzzy Hash: cc9d34be936479fe1e2f22b0b002ca981d077984a3acabd4ba5e95875f00d246
Instruction Fuzzy Hash: 8C015EB5D00618ABCB009F9AC9456CEFFF8FF99704F11811AE841B3660C3B459408F95

Uniqueness

Uniqueness Score: -1.00%

Function 00544CC0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544D0B
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544D22
__vbaHresultCheckObj.MSVBVM60(00000000,?,004229A8,00000174), ref: 00544D42
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00544DA9

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckErrorExitHresultProc
String ID:
API String ID: 639240215-0
Opcode ID: c2176c8bc135a714b250ca47019a11b06fa7cb9c9c6da039dc3fe04b6707f482
Instruction ID: 3ce7c3223ce7d96833eea55ba55cc2cf38a9c6c0fcecbb265f8691323daf3a92
Opcode Fuzzy Hash: c2176c8bc135a714b250ca47019a11b06fa7cb9c9c6da039dc3fe04b6707f482
Instruction Fuzzy Hash: FB115AB4D80714ABC7109FAACA48BDAFFF8FF58701F50451AF541A76A0C3B459408FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00544FC0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00545016
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 00545020
__vbaHresultCheckObj.MSVBVM60(00000000,?,004229A8,00000174), ref: 00545040
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0054509D

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckErrorExitHresultProc
String ID:
API String ID: 639240215-0
Opcode ID: fd6d216d516671f7396802a9bc02d45514747d1e8d42055d90ec4d4e2f54161c
Instruction ID: e19cc112663bbd9277fd3b95da65aa14e79f87f6786a5b8fe14d272820846065
Opcode Fuzzy Hash: fd6d216d516671f7396802a9bc02d45514747d1e8d42055d90ec4d4e2f54161c
Instruction Fuzzy Hash: D911A9B5940614ABCB009FA9CD49ACEFFF8FF58704F10411AF845B72A1D3B844408BE5

Uniqueness

Uniqueness Score: -1.00%

Function 00532A70 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

__vbaStrToAnsi.MSVBVM60(?), ref: 00532AAA
__vbaSetSystemError.MSVBVM60(00000000), ref: 00532AB8
__vbaStrToUnicode.MSVBVM60(004047D6,00000000), ref: 00532AC3
__vbaFreeStr.MSVBVM60 ref: 00532AD9

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: daa68dfed9cf410a07ad08fc3ec093615a02fb6a317c08d763cdfac2fa87150d
Instruction ID: 84221f22e08f05cd97ca75e4422a81f13c485ada7672c11a0abe83a68cb7b62a
Opcode Fuzzy Hash: daa68dfed9cf410a07ad08fc3ec093615a02fb6a317c08d763cdfac2fa87150d
Instruction Fuzzy Hash: AF0131B5800609ABCB10AFA4CD49AAF7BB8FB48710F504A69F902B3690D77859458BE5

Uniqueness

Uniqueness Score: -1.00%

Function 0052EC70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052ECD8
__vbaHresultCheckObj.MSVBVM60(00000000,(@,0041B34C,0000009C,?,?,?,?,?,?,?,?,?,?,004047D6), ref: 0052ECF8

Strings

(@, xrefs: 0052EC99, 0052ECA7, 0052ECDF, 0052ECF6

Memory Dump Source

Source File: 00000000.00000002.2096912756.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2096900713.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097004612.0000000000556000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2097019304.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INSIGNON.jbxd

Similarity

API ID: __vba$CheckHresult
String ID: (@
API String ID: 713191129-3484449702
Opcode ID: 2bd5ba2b4af464cbd77af0bebb1cfeda9cc71f8e020ea40001d0a60ad678ed40
Instruction ID: 65c3280f0dcf02d8fae99765c3829c858c806b83ca034d1e89da48f81b1a6436
Opcode Fuzzy Hash: 2bd5ba2b4af464cbd77af0bebb1cfeda9cc71f8e020ea40001d0a60ad678ed40
Instruction Fuzzy Hash: AB115E74D00618EBCB10DF99CD45A9EBFF9FF59710F20811AE844A7291C3B459408BA4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INSIGNON.EXE

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\ImcSys.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: INSIGNON.EXEPID: 1164, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: INSIGNON.EXEPID: 1164, Parent PID: 1028COMMON

Execution Graph

Windows Analysis Report
INSIGNON.EXE

Function 00524430 Relevance: 115.9, APIs: 60, Strings: 6, Instructions: 369
COMMON

Function 0051C330 Relevance: 398.9, APIs: 265, Instructions: 1376
COMMON

Function 0052B680 Relevance: 114.1, APIs: 58, Strings: 7, Instructions: 363
COMMON

Function 005266D0 Relevance: 102.0, APIs: 49, Strings: 9, Instructions: 477
COMMON

Function 0051BBF0 Relevance: 78.9, APIs: 24, Strings: 21, Instructions: 156
COMMON

Function 00524730 Relevance: 73.8, APIs: 39, Strings: 3, Instructions: 259
COMMON

Function 00526160 Relevance: 56.4, APIs: 31, Strings: 1, Instructions: 390
COMMON

Function 00527640 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 87
COMMON

Function 0051B6C0 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 68
COMMON

Function 00525E40 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 64
fileCOMMON

Function 0054FA10 Relevance: 16.6, APIs: 11, Instructions: 106
COMMON

Function 0052CD70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68
COMMON

Function 00405623 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59
COMMON

Function 00544490 Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Function 0054BCA0 Relevance: 9.0, APIs: 6, Instructions: 49
COMMON