Edit tour

Windows Analysis Report
midyear_statement.exe

Overview

General Information

Sample name:	midyear_statement.exe
Analysis ID:	1417020
MD5:	ef19e2ec305d4ff526c21594f958bd44
SHA1:	42cbf54d4f5d02af0f67fe996e07a67b6d073148
SHA256:	e20122b472fb07ec6dddd3a60ba1e1206802418bad07a591ab78176383d96846
Tags:	exe

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected potential crypto function

Found potential string decryption / allocating functions

PE file does not import any functions

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

midyear_statement.exe (PID: 6192 cmdline: "C:\Users\user\Desktop\midyear_statement.exe" MD5: EF19E2EC305D4FF526C21594F958BD44)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: midyear_statement.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00402140		0_2_00402140
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00434AA0		0_2_00434AA0

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: String function: 004047FC appears 95 times
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: String function: 004069EC appears 49 times

Source: midyear_statement.exe

Static PE information: No import functions for PE file found

Source: midyear_statement.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: clean3.winEXE@1/0@0/0

Source: midyear_statement.exe

Static file information: File size 1265664 > 1048576

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0042E108 push 0042E134h; ret	0_2_0042E12C
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041A18C push ecx; mov dword ptr [esp], edx	0_2_0041A18E
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041122A push 004112A2h; ret	0_2_0041129A
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041122C push 004112A2h; ret	0_2_0041129A
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0042D2E8 push 0042D32Bh; ret	0_2_0042D323
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00426280 push 00426350h; ret	0_2_00426348
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041D3C8 push 0041D3F4h; ret	0_2_0041D3EC
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00407384 push 004073C6h; ret	0_2_004073BE
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041354C push ecx; mov dword ptr [esp], edx	0_2_00413551
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00403584 push eax; ret	0_2_004035C0
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0042C598 push 0042C5D0h; ret	0_2_0042C5C8
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00406666 push 004066C3h; ret	0_2_004066BB
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00406668 push 004066C3h; ret	0_2_004066BB
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0042D618 push 0042D644h; ret	0_2_0042D63C
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00435620 push 0043568Bh; ret	0_2_00435683
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0040D7DC push ecx; mov dword ptr [esp], edx	0_2_0040D7E1
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_004137A8 push ecx; mov dword ptr [esp], edx	0_2_004137AD
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041E854 push 0041E897h; ret	0_2_0041E88F
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041B85A push 0041B907h; ret	0_2_0041B8FF
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041B85C push 0041B907h; ret	0_2_0041B8FF
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_004138C8 push ecx; mov dword ptr [esp], edx	0_2_004138CD
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0040E8E4 push 0040E910h; ret	0_2_0040E908
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041390C push ecx; mov dword ptr [esp], edx	0_2_00413911
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041AB24 push ecx; mov dword ptr [esp], edx	0_2_0041AB29
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00411BDC push 00411C29h; ret	0_2_00411C21
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0042EBBC push 0042EC08h; ret	0_2_0042EC00
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0041CC44 push 0041CC82h; ret	0_2_0041CC7A
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0042DC60 push 0042DCBAh; ret	0_2_0042DCB2
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0040DCCC push 0040E122h; ret	0_2_0040E11A
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_0042DCBC push 0042DCF4h; ret	0_2_0042DCEC
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_00416D14 push ecx; mov dword ptr [esp], edx	0_2_00416D16

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	System Service Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417020
Start date and time:	2024-03-28 14:03:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	midyear_statement.exe
Detection:	CLEAN
Classification:	clean3.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target midyear_statement.exe, PID 6192 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	1.7803286795648312
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	midyear_statement.exe
File size:	1'265'664 bytes
MD5:	ef19e2ec305d4ff526c21594f958bd44
SHA1:	42cbf54d4f5d02af0f67fe996e07a67b6d073148
SHA256:	e20122b472fb07ec6dddd3a60ba1e1206802418bad07a591ab78176383d96846
SHA512:	af286ffdd9b0216e0eff14aac808e30f222fb0bc2dbcf24c737fbf29f9ac20477a9b2248fac9f3af4c455a807f2b4af37cd4a9d2e26d7d9afa9f5b80faee203f
SSDEEP:	3072:nmdqpevG/s52cCRHfsEvNi1REIMtS1klUwqKaz8Kb2Gd7SER+zrIw0BVWsfiNoNz:nm8evGkzCRHfsci4cA9Mp7SHkCoNzIq
TLSH:	F6455D72B5A14533D2235979CE4BD6A8B811BE211D18688A7FFA4E8CDF3E7C13529093
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46174c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x105000	0x254e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x111000	0x2d600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10a000	0x6da4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x109000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1056f8	0x5cc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5f0bc	0x5f200	de3ff1db51a9012b6f177235bf84388f	False	0.32041516097240474	data	4.680938891477852	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x61000	0x794	0x800	c99a74c555371a433d121f551d6c6398	False	0.01123046875	data	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x62000	0x9e57c	0x9e600	73a9c963ee9785a6fcb12f5a74432816	False	0.001003539364640884	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x101000	0x3670	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x105000	0x254e	0x2600	a162f87d777e2631927c2ead8ba75cf1	False	0.003289473684210526	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x108000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x109000	0x18	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10a000	0x6da4	0x6e00	cf26b39e7e03767333e01134b2429010	False	0.0017755681818181818	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x111000	0x2d600	0x2d600	78e78900e441476a988389ae05503fd9	False	0.0010922434573002755	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: midyear_statement.exePID: 6192, Parent PID: 2580

General

Target ID:	0
Start time:	14:03:53
Start date:	28/03/2024
Path:	C:\Users\user\Desktop\midyear_statement.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\midyear_statement.exe"
Imagebase:	0x400000
File size:	1'265'664 bytes
MD5 hash:	EF19E2EC305D4FF526C21594F958BD44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: midyear_statement.exePID: 6192, Parent PID: 2580COMMON

Non-executed Functions

Function 00434AA0 Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

X[C, xrefs: 00434D4E, 00434E76

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: X[C
API String ID: 0-729035439
Opcode ID: e8c006c8e217e8848de49f8e710b8ba2a60301fc2b1d491fbfcd5effd6870f1a
Instruction ID: b0cf7bc366b54017fe6cc9be602eec156ea6577eb7a79cac89799561f5345eef
Opcode Fuzzy Hash: e8c006c8e217e8848de49f8e710b8ba2a60301fc2b1d491fbfcd5effd6870f1a
Instruction Fuzzy Hash: 87E13634A046099BCB10DFAAC4819AEF7F5EF9C304F2595AAE815A7361C738FD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402140 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Uniqueness

Uniqueness Score: -1.00%

Function 00426680 Relevance: 60.3, Strings: 48, Instructions: 266COMMON

Download Yara Rule

Strings

GetThemeColor, xrefs: 004267D4
GetThemePropertyOrigin, xrefs: 0042689A
uxtheme.dll, xrefs: 004266B1
GetThemeIntList, xrefs: 00426888
EnableThemeDialogTexture, xrefs: 00426984
GetThemeTextExtent, xrefs: 00426744
HitTestThemeBackground, xrefs: 0042677A
GetThemePartSize, xrefs: 00426732
GetThemeSysColorBrush, xrefs: 004268E2
GetThemeSysSize, xrefs: 00426906
GetThemeSysString, xrefs: 0042692A
GetThemePosition, xrefs: 00426840
OpenThemeData, xrefs: 004266C6
GetThemeSysFont, xrefs: 00426918
DrawThemeEdge, xrefs: 0042678C
EnableTheming, xrefs: 00426A02
GetThemeSysColor, xrefs: 004268D0
GetWindowTheme, xrefs: 00426972
DrawThemeText, xrefs: 004266FC
GetThemeInt, xrefs: 0042681C
IsThemePartDefined, xrefs: 004267B0
DrawThemeParentBackground, xrefs: 004269F0
CloseThemeData, xrefs: 004266D8
GetThemeBackgroundRegion, xrefs: 00426768
IsThemeBackgroundPartiallyTransparent, xrefs: 004267C2
GetThemeTextMetrics, xrefs: 00426756
GetThemeFilename, xrefs: 004268BE
GetThemeFont, xrefs: 00426852
GetThemeBool, xrefs: 0042680A
DrawThemeIcon, xrefs: 0042679E
IsAppThemed, xrefs: 00426960
GetThemeDocumentationProperty, xrefs: 004269DE
GetCurrentThemeName, xrefs: 004269CC
GetThemeRect, xrefs: 00426864
hDP, xrefs: 00426685
GetThemeString, xrefs: 004267F8
GetThemeMetric, xrefs: 004267E6
IsThemeActive, xrefs: 0042694E
DrawThemeBackground, xrefs: 004266EA
GetThemeEnumValue, xrefs: 0042682E
GetThemeSysInt, xrefs: 0042693C
IsThemeDialogTextureEnabled, xrefs: 00426996
SetWindowTheme, xrefs: 004268AC
GetThemeSysBool, xrefs: 004268F4
SetThemeAppProperties, xrefs: 004269BA
GetThemeMargins, xrefs: 00426876
GetThemeAppProperties, xrefs: 004269A8
GetThemeBackgroundContentRect, xrefs: 0042670E, 00426720

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$hDP$uxtheme.dll
API String ID: 0-2584878946
Opcode ID: bdc6418e2a5c2ff1da97ee3fe0233c86d2698230b0101d6bb42f044568b91849
Instruction ID: 3a981f3910e031de8fe79d03ea75a89788f1b3c20cd23abb52ac4c7bdf44d5f6
Opcode Fuzzy Hash: bdc6418e2a5c2ff1da97ee3fe0233c86d2698230b0101d6bb42f044568b91849
Instruction Fuzzy Hash: CBA113F0B40220EFDB00EFA5EC82B2A37ACEB15704392096AB591DF695D679D814CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5D8 Relevance: 28.9, Strings: 23, Instructions: 141COMMON

Download Yara Rule

Strings

VariantChangeTypeEx, xrefs: 0040E5EF
VarAnd, xrefs: 0040E6B5
VarXor, xrefs: 0040E6E1
VarSub, xrefs: 0040E647
VarNot, xrefs: 0040E61B
VarCyFromStr, xrefs: 0040E765
VarR8FromStr, xrefs: 0040E739
VarBstrFromCy, xrefs: 0040E791
VarBstrFromBool, xrefs: 0040E7BD
VarDateFromStr, xrefs: 0040E74F
VarBoolFromStr, xrefs: 0040E77B
VarIdiv, xrefs: 0040E689
oleaut32.dll, xrefs: 0040E5DC
VarCmp, xrefs: 0040E6F7
VarR4FromStr, xrefs: 0040E723
VarDiv, xrefs: 0040E673
VarMul, xrefs: 0040E65D
VarNeg, xrefs: 0040E605
VarAdd, xrefs: 0040E631
VarBstrFromDate, xrefs: 0040E7A7
VarOr, xrefs: 0040E6CB
VarI4FromStr, xrefs: 0040E70D
VarMod, xrefs: 0040E69F

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 0-1918263038
Opcode ID: d3d4425b83976bfe2e4b2c44f08f3c5ec11db684b266b2c8c0df076557d453f5
Instruction ID: 14f1156b974727ee12a0e585917a3dc304ad64e3746967299298ba2df4d3078e
Opcode Fuzzy Hash: d3d4425b83976bfe2e4b2c44f08f3c5ec11db684b266b2c8c0df076557d453f5
Instruction Fuzzy Hash: 364141B16062052BD3047BAB7C0141BB798D794714364CC3FB500BB2E1EB3CA865EE2E

Uniqueness

Uniqueness Score: -1.00%

Function 004025AC Relevance: 12.8, Strings: 10, Instructions: 254COMMON

Download Yara Rule

Strings

7, xrefs: 0040271D
B F, xrefs: 00402727
Unknown, xrefs: 00402808
Unexpected Memory Leak, xrefs: 0040293C
The unexpected small block leaks are:, xrefs: 00402783
bytes: , xrefs: 004027D9
, xrefs: 00402890
String, xrefs: 0040281D
The sizes of unexpected leaked medium and large blocks are: , xrefs: 004028C5
An unexpected memory leak has occurred. , xrefs: 0040270C

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $B F$String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 0-2672380811
Opcode ID: 4c1a720017f2f1dbde87f64368e4dd0a8bf105a4eda63b8e4fbfd2f00143a593
Instruction ID: cce52526926208a85db4bcb38dff60bad8ec8563648c73b1b545a3dea91f3073
Opcode Fuzzy Hash: 4c1a720017f2f1dbde87f64368e4dd0a8bf105a4eda63b8e4fbfd2f00143a593
Instruction Fuzzy Hash: E8A1EC30B043548BDF21AA2CC98879976E4EB09714F1441FAE549BB3C2DBFD89C5CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCCC Relevance: 11.6, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

)F, xrefs: 0040DD08
8P, xrefs: 0040E01D
BP, xrefs: 0040DFB9
((F, xrefs: 0040E0CE
$8P, xrefs: 0040E027
,8P, xrefs: 0040E03B
(8P, xrefs: 0040E031
\8P, xrefs: 0040E050
H)F, xrefs: 0040E0F8

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: 8P$ BP$$8P$((F$(8P$)F$,8P$H)F$\8P
API String ID: 0-3405494647
Opcode ID: 55b1c8f66354ecd70f4725bd8f874ef096d8a1c863807d42c5a3faadc24c2897
Instruction ID: 6e7cc08d19c8920a54cd973201c30edb59065e96ec4bad3926a2a65905be8e1f
Opcode Fuzzy Hash: 55b1c8f66354ecd70f4725bd8f874ef096d8a1c863807d42c5a3faadc24c2897
Instruction Fuzzy Hash: 2AE136A044E7C05FC31397B55C655967FB4AE4321870E86EBE4C5CF9E3E26C884AC72A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D040 Relevance: 11.5, Strings: 9, Instructions: 201COMMON

Download Yara Rule

Strings

AMPM , xrefs: 0040D299
$8P, xrefs: 0040D2B1
8P, xrefs: 0040D1E8
:mm:ss, xrefs: 0040D2C6
(8P, xrefs: 0040D2CE
mmmm d, yyyy, xrefs: 0040D172
:mm, xrefs: 0040D2A9
m/d/yy, xrefs: 0040D145
AMPM, xrefs: 0040D28A

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: 8P$ AMPM$$8P$(8P$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 0-1276026478
Opcode ID: df48213f1a7dcc9bc488dfe40d9e06234b9ce118d2162c4879ea30100645e84e
Instruction ID: 1ca70b4ceaf33ad755841d2e3bd53e31e31da153feeb8cba658772cdf680b0c2
Opcode Fuzzy Hash: df48213f1a7dcc9bc488dfe40d9e06234b9ce118d2162c4879ea30100645e84e
Instruction Fuzzy Hash: 8F614F70B011485BD700FBE5D841A9F76AAEF88304F10D47BB641BB6C6CA3DD909979D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F7C Relevance: 11.4, Strings: 9, Instructions: 110COMMON

Download Yara Rule

Strings

", xrefs: 0040303C
", xrefs: 00402FD4
", xrefs: 00402F9E
", xrefs: 00402F99
, xrefs: 00402F94
, xrefs: 00403069
, xrefs: 00402FF8
", xrefs: 00402FB0
", xrefs: 0040300F

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: $ $ $"$"$"$"$"$"
API String ID: 0-3597982963
Opcode ID: 9e92d353961edc26f1e8e0601b03fd9c435e508d863d86532e2523dc971b4095
Instruction ID: e55d7107633b42d99702c125cc3dabdf4a1d396e71ceccebf79e39a8a4360fda
Opcode Fuzzy Hash: 9e92d353961edc26f1e8e0601b03fd9c435e508d863d86532e2523dc971b4095
Instruction Fuzzy Hash: 3831B6946483D22EEB3269B58DC832A7DD84B96395F1C05BB9141B73CBD5FC4841A31E

Uniqueness

Uniqueness Score: -1.00%

Function 004025AA Relevance: 10.2, Strings: 8, Instructions: 188COMMON

Download Yara Rule

Strings

7, xrefs: 0040271D
B F, xrefs: 00402727
Unexpected Memory Leak, xrefs: 0040293C
The unexpected small block leaks are:, xrefs: 00402783
bytes: , xrefs: 004027D9
, xrefs: 00402890
The sizes of unexpected leaked medium and large blocks are: , xrefs: 004028C5
An unexpected memory leak has occurred. , xrefs: 0040270C

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $B F$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-1373683114
Opcode ID: 855d05ccc88b59d7f55cc6f58059c8733248cb3223366e120394a9c8ba558b91
Instruction ID: 1266d57af3202c01b9c8298a414e2dbe2ade0aabf85314ce8ad2646b6a30113c
Opcode Fuzzy Hash: 855d05ccc88b59d7f55cc6f58059c8733248cb3223366e120394a9c8ba558b91
Instruction Fuzzy Hash: 8D71A730B042548BDB21AA2DC988BD9BAE4EB49704F1041FAE549F73C2DBB949C5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF9C Relevance: 10.1, Strings: 8, Instructions: 82COMMON

Download Yara Rule

Strings

8P, xrefs: 0040E01D
BP, xrefs: 0040DFB9
((F, xrefs: 0040E0CE
$8P, xrefs: 0040E027
,8P, xrefs: 0040E03B
(8P, xrefs: 0040E031
\8P, xrefs: 0040E050
H)F, xrefs: 0040E0F8

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: 8P$ BP$$8P$((F$(8P$,8P$H)F$\8P
API String ID: 0-2966014521
Opcode ID: 9479af239fa392355bf53fef52b3e1b73ed5b5d1eff87d7527518f84d8ca2153
Instruction ID: 18dd518be87a7dd6c0b667e06a862fdd379c45bf01f56b3a8fa512f6a0841134
Opcode Fuzzy Hash: 9479af239fa392355bf53fef52b3e1b73ed5b5d1eff87d7527518f84d8ca2153
Instruction Fuzzy Hash: 5B2130B07008449BD305B7AADA5261E3756FBC1348B10897EB600BFBF2CA7D9D015B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC0C Relevance: 6.4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

Strings

AAA, xrefs: 0040AD1C
A/P, xrefs: 0040AC52
AM/PM, xrefs: 0040AC16
AAAA, xrefs: 0040ACD6
AMPM, xrefs: 0040AC8E

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: A/P$AAA$AAAA$AM/PM$AMPM
API String ID: 0-3831542625
Opcode ID: d505ee4f74a06a5be738e5753cae388f673e75c2086abf7d75fd0f0eb6770942
Instruction ID: 82a8292711ed0633e5d29c90b981d9cf435e42829f8bef905cee9dc77d9dc233
Opcode Fuzzy Hash: d505ee4f74a06a5be738e5753cae388f673e75c2086abf7d75fd0f0eb6770942
Instruction Fuzzy Hash: 15418E717042069BEB00AB59D805B9E73A5AF54354F20803BF904AB2D2DB7CDDA1978F

Uniqueness

Uniqueness Score: -1.00%

Function 0040728C Relevance: 6.3, Strings: 5, Instructions: 61COMMON

Download Yara Rule

Strings

MouseZ, xrefs: 0040729F
MSH_WHEELSUPPORT_MSG, xrefs: 004072BA
MSWHEEL_ROLLMSG, xrefs: 004072AB
Magellan MSWHEEL, xrefs: 0040729A
MSH_SCROLL_LINES_MSG, xrefs: 004072C6

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 0-3736581797
Opcode ID: 3a3ebf2dc7c18080acec5792a07b0e7fb57bf5a9a3f3bad967fb6b2671d028d7
Instruction ID: bdfeb7787016887b4856b5b60f4496bbc189f0169c404d4ab8226f43d6c20b72
Opcode Fuzzy Hash: 3a3ebf2dc7c18080acec5792a07b0e7fb57bf5a9a3f3bad967fb6b2671d028d7
Instruction Fuzzy Hash: 99113A70A48301EFF3109F65CC82B66B7A8EF48750F20417ABD44AB2C1D6B96940DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 5.2, Strings: 4, Instructions: 190COMMON

Download Yara Rule

Strings

tiA, xrefs: 0041923C
[iA, xrefs: 00419335
tiA, xrefs: 004193E0
p-A, xrefs: 004192F4

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: [iA$p-A$tiA$tiA
API String ID: 0-3041835726
Opcode ID: f54abf7a6b04e17632ea53eec15a7ba9d002b033a144cf7130664922ab76a235
Instruction ID: 4102951e65d35b2fc1ce015be9a0374bf804defea2b5012b461d3926046fa813
Opcode Fuzzy Hash: f54abf7a6b04e17632ea53eec15a7ba9d002b033a144cf7130664922ab76a235
Instruction Fuzzy Hash: 2E81C174A00209EFCB04DF99C59199DBBF5FF48304B6185AAE810AB361D778EE81DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00410C24 Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

String, xrefs: 00410C76
Any, xrefs: 00410C8E
ByRef , xrefs: 00410D27
Array , xrefs: 00410D14

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: Any$Array $ByRef $String
API String ID: 0-2719049652
Opcode ID: 4188ee233aa17b52774650604d4d76dc0de4e67ff4490309fff78c6b0560fd20
Instruction ID: b731b3ba88d1ab1cbd5ad41dbbf9638ff50ad8056355f0346ecee3eb822d3da1
Opcode Fuzzy Hash: 4188ee233aa17b52774650604d4d76dc0de4e67ff4490309fff78c6b0560fd20
Instruction Fuzzy Hash: EB2128707041148BD724EE94E8417DA73B5EB88710F50857BBA44933D5DBBCADC18A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00433CA8 Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

HA, xrefs: 00433CD7
KbdLayerDescriptor, xrefs: 00433D58
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\, xrefs: 00433D15
Layout File, xrefs: 00433D2D

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: HA$KbdLayerDescriptor$Layout File$\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
API String ID: 0-3639782014
Opcode ID: a6b9fc0670b8eb88cfe639b112e5a739d23beb534a915dd6c2abd22cf6dddaf2
Instruction ID: 357bca56fb42761d91f4e34d5c6ab2f982f32428f7ce8180cbed5b1f152e676e
Opcode Fuzzy Hash: a6b9fc0670b8eb88cfe639b112e5a739d23beb534a915dd6c2abd22cf6dddaf2
Instruction Fuzzy Hash: 3821B674E00209AFCB01EFA6C8529DEB7B6FB4D704F51847AF400A7651D73DAA41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417264 Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

>, xrefs: 004172E7
Owner, xrefs: 004172C4
-, xrefs: 004172E1
., xrefs: 004172DB

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: -$.$>$Owner
API String ID: 0-4224991809
Opcode ID: ab6cf766ab75c05f6c6bf8bc4aaa77b2d9621cd9c3980223201d271ff665eeff
Instruction ID: 6cab9f23460f79e9dc25259d94d0cefd2318d2d428cfebf26a27551d75bdfdb1
Opcode Fuzzy Hash: ab6cf766ab75c05f6c6bf8bc4aaa77b2d9621cd9c3980223201d271ff665eeff
Instruction Fuzzy Hash: 42112731D082985FDF228A65C8906EE7BF4EB46714F2841F7E851A7381C63C8D83D748

Uniqueness

Uniqueness Score: -1.00%

Function 00425DBC Relevance: 5.1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

Strings

Tahoma, xrefs: 00425E04
HA, xrefs: 00425E10
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 00425E38
MS Shell Dlg 2, xrefs: 00425E4C

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: HA$MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 0-1718180241
Opcode ID: 7db6dab8d90f9d0e6df97c248f93dd5c317219eccb63ba0ea8a8a4ff872a1152
Instruction ID: 7cc432ffc75b558b6064493309ff523f73fdc01d9a1b0d11294381ea0f198099
Opcode Fuzzy Hash: 7db6dab8d90f9d0e6df97c248f93dd5c317219eccb63ba0ea8a8a4ff872a1152
Instruction Fuzzy Hash: 96119070B00A14AFC700EFA6E84299E7BA4EB09704F9284B6F800A7691D7399E41CB18

Uniqueness

Uniqueness Score: -1.00%

Function 004187A0 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

True, xrefs: 0041882F
nil, xrefs: 0041883D
Null, xrefs: 0041884B
False, xrefs: 00418821

Memory Dump Source

Source File: 00000000.00000002.2872607307.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2872592284.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_midyear_statement.jbxd

Similarity

API ID:
String ID: False$Null$True$nil
API String ID: 0-1063864068
Opcode ID: ba8c88b39fbb0515cbd7cd0207c8be43315a3a46076560d5634d27bac8909c6c
Instruction ID: 9c1939206fb54fab5378a84b79b8da1b40bf3589a5a4409f31fe8328d79927ff
Opcode Fuzzy Hash: ba8c88b39fbb0515cbd7cd0207c8be43315a3a46076560d5634d27bac8909c6c
Instruction Fuzzy Hash: 030181A5B180A047C204726E18410E925968BC5704764CD7FB265D7397CD3CCC8266AF

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report midyear_statement.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: midyear_statement.exePID: 6192, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: midyear_statement.exePID: 6192, Parent PID: 2580COMMON

Non-executed Functions

Function 00434AA0 Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Function 00402140 Relevance: .1, Instructions: 94COMMON

Function 00426680 Relevance: 60.3, Strings: 48, Instructions: 266COMMON

Function 0040E5D8 Relevance: 28.9, Strings: 23, Instructions: 141COMMON

Function 004025AC Relevance: 12.8, Strings: 10, Instructions: 254COMMON

Function 0040DCCC Relevance: 11.6, Strings: 9, Instructions: 386COMMON

Function 0040D040 Relevance: 11.5, Strings: 9, Instructions: 201COMMON

Function 00402F7C Relevance: 11.4, Strings: 9, Instructions: 110COMMON

Function 004025AA Relevance: 10.2, Strings: 8, Instructions: 188COMMON

Function 0040DF9C Relevance: 10.1, Strings: 8, Instructions: 82COMMON

Function 0040AC0C Relevance: 6.4, Strings: 5, Instructions: 127COMMON

Function 0040728C Relevance: 6.3, Strings: 5, Instructions: 61COMMON

Function 004191D8 Relevance: 5.2, Strings: 4, Instructions: 190COMMON

Windows Analysis Report
midyear_statement.exe