Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan-Downloader.8862.17468.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan-Downloader.8862.17468.exe
Analysis ID:1417315
MD5:99e6eb18c870372dd39f1f3e491f91b1
SHA1:3248418514e5a21f66cb43b8eef1be5925177bde
SHA256:34a1b86d7355b5effffa36faa80c432a86f4ba6b3164cb35f5abe0d65cfbfa4d
Tags:exe
Infos:

Detection

Score:24
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Machine Learning detection for sample
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
PE file contains more sections than normal
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan-Downloader.8862.17468.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exe" MD5: 99E6EB18C870372DD39F1F3E491F91B1)
    • conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Machine Learning detection for sample
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeJoe Sandbox ML: detected
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeCode function: 0_2_00403740 FindFirstFileA,_errno,GetLastError,_errno,_errno,_errno,_errno,_errno,0_2_00403740
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: Number of sections : 13 > 10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeSection loaded: apphelp.dllJump to behavior
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: sus24.winEXE@2/1@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeCode function: 0_2_00401340 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,atexit,0_2_00401340
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: section name: /4
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: section name: /14
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: section name: /29
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: section name: /41
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: section name: /55
Source: SecuriteInfo.com.Trojan-Downloader.8862.17468.exeStatic PE information: section name: /67
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeCode function: 0_2_00403740 FindFirstFileA,_errno,GetLastError,_errno,_errno,_errno,_errno,_errno,0_2_00403740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeAPI call chain: ExitProcess graph end nodegraph_0-2196
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeCode function: 0_2_00401340 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,atexit,0_2_00401340
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeCode function: 0_2_004011B0 SetUnhandledExceptionFilter,_iob,_setmode,_setmode,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,0_2_004011B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exeCode function: 0_2_00401A30 cpuid 0_2_00401A30

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
DLL Side-Loading		1
Process Injection		1
Process Injection		OS Credential Dumping1
File and Directory Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
DLL Side-Loading		LSASS Memory11
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Trojan-Downloader.8862.17468.exe8%ReversingLabs
SecuriteInfo.com.Trojan-Downloader.8862.17468.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1417315
Start date and time:2024-03-28 23:26:07 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 39s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:6
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:SecuriteInfo.com.Trojan-Downloader.8862.17468.exe
Detection:SUS
Classification:sus24.winEXE@2/1@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 10
  • Number of non-executed functions: 13
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: SecuriteInfo.com.Trojan-Downloader.8862.17468.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File
Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exe
File Type:ASCII text, with no line terminators
Category:dropped
Size (bytes):31
Entropy (8bit):3.6277635530073993
Encrypted:false
SSDEEP:3:ORy+itAfKDFEFCn:OgQCn
MD5:964EFF64A51AF8DB20BECE26DD2B39F3
SHA1:A2612CEF7266E3F1C380B1A9FDECAB5F00CE6073
SHA-256:9D3441098B428BE6F44D4233972274F95243D28B16AAD5FEE03F74282EE8BAFC
SHA-512:E4CDDB2C3BE983319831C7405C265BBC1D1FFF46CA782178D391C34C9E7D4B102EEC68505E648A2932C889FEC2BF368C0FAD73A1BADCB6ECFACF3E6E152CA676
Malicious:false
Reputation:low
Preview:Enter the element of matrix A:

Static File Info

General

File type:PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):5.4934523510370195
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.96%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • VXD Driver (31/22) 0.00%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:SecuriteInfo.com.Trojan-Downloader.8862.17468.exe
File size:42'131 bytes
MD5:99e6eb18c870372dd39f1f3e491f91b1
SHA1:3248418514e5a21f66cb43b8eef1be5925177bde
SHA256:34a1b86d7355b5effffa36faa80c432a86f4ba6b3164cb35f5abe0d65cfbfa4d
SHA512:a6aa188f57679fb8f9f4bd411439d4d213a6b7b3dd4164ca10a6d5133b97aceb4188340c62514ddb1307702a2b70faea21eb9d377988085750af9db3941eadc6
SSDEEP:768:3YOEz+OJApuvBkBsMPP3lLuzZPKqhLJrMb9Lqp1m:33OQ0MPP3lLuBZh94bMp1m
TLSH:03132959BE254CFBE652533E84E7C7762B3CF1814A235B73BB30B7305B236922099256
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..e.t...................J...............@....@.................................;......... ............................

File Icon

Icon Hash:90cececece8e8eb0

Static PE Info

General

Entrypoint:0x4012e0
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows cui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:0x65C4A823 [Thu Feb 8 10:08:35 2024 UTC]
TLS Callbacks:0x401c30, 0x401be0
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:56c331205a2e6363b4ccdec1da40351f

Entrypoint Preview

Instruction
sub esp, 1Ch
mov dword ptr [esp], 00000001h
call dword ptr [004081A4h]
call 00007F280D067A40h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
sub esp, 1Ch
mov dword ptr [esp], 00000002h
call dword ptr [004081A4h]
call 00007F280D067A20h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
jmp dword ptr [004081D0h]
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
jmp dword ptr [004081C0h]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 10h
mov dword ptr [esp], 00405000h
call 00007F280D06A579h
sub esp, 04h
test eax, eax
je 00007F280D067C37h
mov dword ptr [esp], 00405000h
mov ebx, eax
call 00007F280D06A540h
sub esp, 04h
mov dword ptr [0040706Ch], eax
mov dword ptr [esp+04h], 00405013h
mov dword ptr [esp], ebx
call 00007F280D06A540h
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 00405029h
mov dword ptr [esp], ebx
call 00007F280D06A52Bh
sub esp, 08h
mov dword ptr [00404000h], eax
test esi, esi
je 00007F280D067B93h
mov dword ptr [eax+eax+00h], 00000000h

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x80000x610.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0xa0040x18.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x81380xe8.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x2dd40x2e005cbe7e759756a71f646c0fcf1e05ce36False0.5927309782608695data6.1538599317700875IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x40000x1c0x200d89f9efdf44dfc0fef0f600a751cae91False0.06640625data0.22238947047324953IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata0x50000x3340x4001f6c8c301177286fa2ea6e6996103a5dFalse0.287109375data4.3307263094543105IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
/40x60000x9a40xa002ef5bb8b8d5d8f69a9f4d2a746a02ebdFalse0.40234375data4.737333206976317IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss0x70000x700x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata0x80000x6100x8004683f9bb6e8c63dd4e8f793abfb8b73eFalse0.3466796875data3.852133765200072IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT0x90000x180x20017d084ee7451e1c529b6e85ffe0e484eFalse0.046875data0.11836963125913882IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls0xa0000x200x200f7a419142b47f1a6560b6d595ae80d75False0.05859375data0.22482003450968063IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/140xb0000x380x2005fd56bc0994aea5b06b96c32ceb28153False0.068359375Matlab v4 mat-file (little endian) *, rows 2, columns 2621440.2162069074398449IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/290xc0000x1cff0x1e009dd3ed288bbcdbfc9f8a3e8efe1d4937False0.458984375data5.767661662979606IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/410xe0000x12f0x2000f209b8eeedb4402bcc92889fdf74aaaFalse0.361328125data3.0440842995585107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/550xf0000x1c80x2003ad1a8bd3879141b28ddd7918aebccb9False0.462890625data4.31030910283884IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/670x100000x380x200be5fe801bf243a22e4111b7e3e8a7fe3False0.1171875data0.6745765448489234IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLLImport
KERNEL32.dllDeleteCriticalSection, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileA, FindNextFileA, FreeLibrary, GetCommandLineA, GetLastError, GetModuleHandleA, GetProcAddress, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, SetUnhandledExceptionFilter, TlsGetValue, VirtualProtect, VirtualQuery
msvcrt.dll_getch, _strdup, _stricoll
msvcrt.dll__getmainargs, __mb_cur_max, __p__environ, __p__fmode, __set_app_type, _cexit, _errno, _fpreset, _fullpath, _iob, _isctype, _onexit, _pctype, _setmode, abort, atexit, calloc, free, fwrite, malloc, mbstowcs, memcpy, printf, putchar, puts, realloc, scanf, setlocale, signal, strcoll, strlen, tolower, vfprintf, wcstombs

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:23:26:54
Start date:28/03/2024
Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Downloader.8862.17468.exe"
Imagebase:0x400000
File size:42'131 bytes
MD5 hash:99E6EB18C870372DD39F1F3E491F91B1
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:false

General

Target ID:1
Start time:23:26:54
Start date:28/03/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff7699e0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:false

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:6.7%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:6.4%
    Total number of Nodes:535
    Total number of Limit Nodes:16
    execution_graph 2164 403740 FindFirstFileA 2165 4037be _errno GetLastError 2164->2165 2170 403764 2164->2170 2166 4037d1 _errno 2165->2166 2167 403802 _errno 2165->2167 2168 4037f5 _errno 2166->2168 2169 4037de _errno 2166->2169 2167->2170 2168->2170 2169->2170 2171 4037e8 _errno 2169->2171 2171->2170 2435 401340 GetModuleHandleA 2436 4013a2 2435->2436 2437 40135f LoadLibraryA GetProcAddress GetProcAddress 2435->2437 2438 4013c0 GetModuleHandleA 2436->2438 2439 4013fa atexit 2436->2439 2437->2436 2440 4013d8 GetProcAddress 2438->2440 2441 4013ed 2438->2441 2440->2441 2441->2439 2542 401000 2543 401060 2542->2543 2544 401012 2542->2544 2545 4010b0 signal 2543->2545 2546 401067 2543->2546 2547 401079 signal 2544->2547 2548 401019 2544->2548 2549 4010c9 signal 2545->2549 2558 401041 2545->2558 2550 401072 2546->2550 2551 4010fb signal 2546->2551 2552 401143 signal 2547->2552 2547->2558 2553 4010f0 2548->2553 2554 401024 signal 2548->2554 2549->2558 2550->2547 2550->2558 2555 40116d signal 2551->2555 2551->2558 2557 402250 _fpreset 2552->2557 2553->2551 2553->2558 2556 401189 signal 2554->2556 2554->2558 2555->2558 2556->2558 2557->2558 2442 401d49 2443 401d50 calloc 2442->2443 2444 401d6a EnterCriticalSection LeaveCriticalSection 2443->2444 2445 401d40 2443->2445 2445->2443 2559 402609 2563 402411 2559->2563 2560 402483 2561 40262c tolower tolower 2561->2560 2561->2563 2562 40245e tolower tolower 2562->2560 2562->2563 2563->2560 2563->2561 2563->2562 2564 40250b tolower tolower 2563->2564 2564->2560 2564->2563 2446 40324c 2447 403250 2446->2447 2448 403255 strlen 2447->2448 2449 403239 2447->2449 2450 403271 2448->2450 2451 4032a8 _strdup 2450->2451 2451->2449 2452 4032c1 2451->2452 2453 4028b0 realloc 2452->2453 2453->2449 2458 40294c 2459 402950 2458->2459 2460 4028b0 realloc 2459->2460 2461 40292f 2460->2461 2462 40293d free 2461->2462 2463 402910 2 API calls 2461->2463 2463->2462 2464 40394c 2466 403950 2464->2466 2465 403a30 2466->2465 2467 4039aa malloc 2466->2467 2468 4039cb memcpy 2467->2468 2469 403a4f _errno 2467->2469 2471 403740 8 API calls 2468->2471 2470 4039f8 2469->2470 2472 4039ed 2471->2472 2472->2470 2473 403a6b free 2472->2473 2473->2470 2690 40198c 2691 401990 2690->2691 2694 4012a0 __getmainargs 2691->2694 2693 401995 2694->2693 2172 403810 FindNextFileA 2173 403892 GetLastError 2172->2173 2175 403833 2172->2175 2174 40389c _errno 2173->2174 2173->2175 2474 402157 2476 4020ac 2474->2476 2475 402150 2478 4021fb 2476->2478 2479 402115 2476->2479 2482 4020b8 2476->2482 2477 401f50 13 API calls 2477->2479 2480 401f00 13 API calls 2478->2480 2479->2475 2479->2477 2481 40220b 2480->2481 2482->2475 2483 401f50 13 API calls 2482->2483 2484 4020fd 2482->2484 2483->2482 2485 401f00 13 API calls 2484->2485 2485->2479 2695 402f97 2712 402ae9 2695->2712 2696 4028b0 realloc 2696->2712 2697 403a80 4 API calls 2697->2712 2698 403ad0 3 API calls 2698->2712 2699 402690 8 API calls 2699->2712 2700 402f6d free 2702 402fed free 2700->2702 2700->2712 2701 402910 2 API calls 2701->2700 2706 402cc3 2702->2706 2703 402fd6 2705 402fdc free 2703->2705 2705->2702 2705->2705 2707 403010 memcpy 2707->2712 2708 402b94 memcpy strlen 2708->2712 2709 4038c0 15 API calls 2709->2712 2710 402fbd free 2710->2702 2710->2703 2711 402b06 strlen 2711->2712 2712->2696 2712->2697 2712->2698 2712->2699 2712->2700 2712->2701 2712->2703 2712->2707 2712->2708 2712->2709 2712->2710 2712->2711 2713 4030b1 _errno 2712->2713 2714 402bf9 _strdup 2712->2714 2715 4030e5 malloc 2712->2715 2716 402c43 strcoll 2712->2716 2717 402c65 _stricoll 2712->2717 2718 402c79 malloc 2712->2718 2713->2712 2714->2712 2715->2712 2716->2712 2717->2712 2718->2712 2486 402a59 2488 402a60 2486->2488 2487 4030e5 malloc 2487->2488 2488->2487 2489 403a80 4 API calls 2488->2489 2490 402ffa free 2488->2490 2491 4038c0 15 API calls 2488->2491 2493 403ad0 3 API calls 2488->2493 2494 402690 8 API calls 2488->2494 2495 402f6d free 2488->2495 2496 402fbd free 2488->2496 2497 402b06 strlen 2488->2497 2498 402910 2 API calls 2488->2498 2500 402fd6 2488->2500 2501 4030b1 _errno 2488->2501 2503 403010 memcpy 2488->2503 2504 402b94 memcpy strlen 2488->2504 2505 4028b0 realloc 2488->2505 2506 402bf9 _strdup 2488->2506 2507 402c43 strcoll 2488->2507 2508 402c65 _stricoll 2488->2508 2509 402c79 malloc 2488->2509 2489->2488 2492 402cc3 2490->2492 2491->2488 2493->2488 2494->2488 2495->2488 2499 402fed 2495->2499 2496->2499 2496->2500 2497->2488 2498->2495 2499->2490 2502 402fdc free 2500->2502 2501->2488 2502->2499 2502->2502 2503->2488 2504->2488 2505->2488 2506->2488 2507->2488 2508->2488 2509->2488 2510 401059 2511 401060 2510->2511 2512 4010b0 signal 2511->2512 2513 401067 2511->2513 2514 4010c9 signal 2512->2514 2517 401050 2512->2517 2515 401072 2513->2515 2516 4010fb signal 2513->2516 2514->2517 2515->2517 2519 401079 signal 2515->2519 2516->2517 2518 40116d signal 2516->2518 2518->2517 2519->2517 2520 401143 signal 2519->2520 2521 402250 _fpreset 2520->2521 2521->2517 2634 4032d9 2635 403300 2634->2635 2636 4032f2 2634->2636 2637 403314 free 2635->2637 2638 40332d 2635->2638 2637->2637 2637->2638 2639 403bd9 2640 403be0 2639->2640 2641 403810 3 API calls 2640->2641 2642 403c04 2640->2642 2641->2640 2643 4027d9 2646 4026a9 2643->2646 2644 402740 2647 402690 8 API calls 2644->2647 2649 402732 2644->2649 2645 4023d0 6 API calls 2645->2646 2646->2644 2646->2645 2648 40270e tolower tolower 2646->2648 2646->2649 2647->2644 2648->2646 2650 401dd9 2651 401de0 EnterCriticalSection 2650->2651 2652 401e10 LeaveCriticalSection 2651->2652 2656 401df9 2651->2656 2653 401e1f 2652->2653 2654 401dff 2654->2653 2655 401e36 free LeaveCriticalSection 2654->2655 2655->2653 2656->2652 2656->2654 2719 403499 2720 4034a0 2719->2720 2721 40350b wcstombs realloc wcstombs 2720->2721 2726 403580 wcstombs 2720->2726 2722 403630 setlocale free 2721->2722 2723 403648 2722->2723 2725 40362c 2725->2722 2726->2722 2726->2725 2176 4012e0 __set_app_type 2181 4011b0 2176->2181 2182 4011c0 2181->2182 2183 4011dc SetUnhandledExceptionFilter 2181->2183 2182->2183 2184 4011f0 2183->2184 2197 402250 2184->2197 2188 401202 2189 40120b _setmode _setmode _setmode 2188->2189 2190 40124d __p__fmode 2188->2190 2189->2190 2212 402040 2190->2212 2192 40125f 2227 401bc0 2192->2227 2194 401267 __p__environ 2231 401460 2194->2231 2196 401288 _cexit ExitProcess 2198 402264 2197->2198 2199 4011fd 2197->2199 2198->2199 2200 4022ad _fpreset 2198->2200 2201 401690 2199->2201 2200->2199 2202 401986 2201->2202 2203 4016a6 GetCommandLineA strlen 2201->2203 2259 4012a0 __getmainargs 2202->2259 2207 4016c7 2203->2207 2205 401995 2205->2188 2206 40177c 2209 4017af 2206->2209 2245 4031f0 2206->2245 2207->2206 2207->2209 2210 401870 _isctype 2207->2210 2211 4031f0 75 API calls 2207->2211 2209->2188 2210->2207 2211->2207 2213 402049 2212->2213 2217 402050 2212->2217 2213->2192 2214 402115 2215 402150 2214->2215 2216 402122 2214->2216 2215->2192 2216->2215 2414 401f50 VirtualQuery 2216->2414 2217->2213 2217->2214 2219 4021fb 2217->2219 2222 4020b8 2217->2222 2220 401f00 13 API calls 2219->2220 2221 40220b 2220->2221 2222->2215 2224 4020fd 2222->2224 2226 40218c 2222->2226 2223 401f50 13 API calls 2223->2226 2392 401f00 fwrite vfprintf abort 2224->2392 2226->2222 2226->2223 2228 401b70 atexit 2227->2228 2229 401bc9 2227->2229 2228->2194 2229->2194 2232 401bc0 atexit 2231->2232 2233 401471 printf 2232->2233 2235 40148a 2233->2235 2234 4014ed printf 2236 401506 2234->2236 2235->2234 2237 401497 scanf 2235->2237 2239 401513 scanf 2236->2239 2240 401566 puts 2236->2240 2237->2235 2239->2236 2241 401614 2240->2241 2242 40167b _getch 2241->2242 2243 401621 printf 2241->2243 2244 40165d putchar 2241->2244 2242->2196 2243->2241 2244->2241 2248 403206 2245->2248 2246 403223 2260 402960 2246->2260 2247 403216 2314 402360 2247->2314 2248->2246 2248->2247 2251 403232 2248->2251 2253 403255 strlen 2251->2253 2254 403239 2251->2254 2252 40321d 2252->2246 2255 403271 2253->2255 2254->2202 2256 4032a8 _strdup 2255->2256 2256->2254 2257 4032c1 2256->2257 2318 4028b0 realloc 2257->2318 2259->2205 2261 402cd0 strlen 2260->2261 2262 40297a strlen 2260->2262 2268 402ce9 2261->2268 2320 402210 2262->2320 2266 4029b4 2267 402360 malloc 2266->2267 2270 4029c8 2267->2270 2269 402d8c 2268->2269 2279 402960 51 API calls 2268->2279 2269->2251 2271 4029e7 2270->2271 2272 402ebe strlen 2270->2272 2280 402cb6 2270->2280 2273 402960 51 API calls 2271->2273 2275 402ed9 2272->2275 2274 4029fc 2273->2274 2276 402a12 2274->2276 2277 402a2b strlen 2274->2277 2274->2280 2278 402f0d _strdup 2275->2278 2276->2277 2282 402f36 2276->2282 2285 402f27 2277->2285 2312 402a40 2277->2312 2278->2280 2281 402f1f 2278->2281 2279->2268 2280->2251 2284 4028b0 realloc 2281->2284 2288 40312f strlen 2282->2288 2282->2312 2283 40319e 2283->2251 2284->2285 2285->2268 2286 402ffa free 2286->2280 2292 403147 2288->2292 2289 4030e5 malloc 2289->2312 2290 402fbd free 2293 402fd6 2290->2293 2294 402fed 2290->2294 2291 402b06 strlen 2300 402b30 2291->2300 2298 40316e _strdup 2292->2298 2299 402fdc free 2293->2299 2294->2286 2296 4030b1 _errno 2296->2312 2297 402f6d free 2297->2294 2297->2312 2298->2294 2301 403180 2298->2301 2299->2294 2299->2299 2300->2312 2341 403a80 2300->2341 2346 403ad0 2300->2346 2301->2294 2304 4028b0 realloc 2301->2304 2304->2294 2306 403010 memcpy 2306->2312 2307 402b94 memcpy strlen 2307->2312 2308 4028b0 realloc 2308->2312 2309 402bf9 _strdup 2309->2312 2310 402c43 strcoll 2310->2312 2311 402c65 _stricoll 2311->2312 2312->2283 2312->2286 2312->2289 2312->2290 2312->2291 2312->2293 2312->2296 2312->2297 2312->2300 2312->2306 2312->2307 2312->2308 2312->2309 2312->2310 2312->2311 2313 402c79 malloc 2312->2313 2351 4038c0 2312->2351 2365 402690 2312->2365 2372 402910 2312->2372 2313->2312 2315 4023c0 2314->2315 2316 402364 malloc 2314->2316 2315->2252 2317 40238e 2316->2317 2317->2252 2319 4028da 2318->2319 2319->2254 2321 40221d memcpy 2320->2321 2322 403340 setlocale 2321->2322 2323 403363 _strdup 2322->2323 2324 40336d setlocale 2322->2324 2323->2324 2325 403390 wcstombs realloc wcstombs setlocale free 2324->2325 2326 403388 2324->2326 2325->2266 2326->2325 2327 403401 mbstowcs 2326->2327 2328 402210 2327->2328 2329 403430 mbstowcs 2328->2329 2330 403475 2329->2330 2331 403461 2329->2331 2332 40356e 2330->2332 2335 40348d 2330->2335 2331->2330 2333 4036a0 setlocale free 2331->2333 2332->2325 2334 403648 2333->2334 2334->2266 2336 40350b wcstombs realloc wcstombs 2335->2336 2340 403580 wcstombs 2335->2340 2337 403630 setlocale free 2336->2337 2337->2334 2339 40362c 2339->2337 2340->2337 2340->2339 2342 403ab7 _errno 2341->2342 2343 403a8c 2341->2343 2344 403aac 2342->2344 2343->2344 2380 403810 FindNextFileA 2343->2380 2344->2300 2347 403b00 _errno 2346->2347 2348 403adc FindClose 2346->2348 2350 403afb 2347->2350 2348->2347 2349 403af1 free 2348->2349 2349->2350 2350->2312 2352 4038d9 2351->2352 2353 403a5c _errno 2351->2353 2354 403a40 _errno 2352->2354 2355 4038e2 _fullpath 2352->2355 2363 4039f8 2353->2363 2354->2363 2356 403903 2355->2356 2357 403a30 2356->2357 2358 4039aa malloc 2356->2358 2357->2312 2359 4039cb memcpy 2358->2359 2360 403a4f _errno 2358->2360 2384 403740 FindFirstFileA 2359->2384 2360->2363 2363->2312 2364 403a6b free 2364->2363 2367 4026a9 2365->2367 2366 4023d0 6 API calls 2366->2367 2367->2366 2368 402740 2367->2368 2370 40270e tolower tolower 2367->2370 2371 402732 2367->2371 2369 402690 6 API calls 2368->2369 2368->2371 2369->2368 2370->2367 2371->2312 2373 402924 2372->2373 2374 40291f 2372->2374 2378 4028b0 realloc 2373->2378 2379 40292f 2373->2379 2375 402910 realloc 2374->2375 2375->2373 2376 40293d free 2376->2297 2377 402910 realloc 2377->2376 2378->2379 2379->2376 2379->2377 2381 403892 GetLastError 2380->2381 2383 403833 2380->2383 2382 40389c _errno 2381->2382 2381->2383 2382->2344 2383->2344 2385 4037be _errno GetLastError 2384->2385 2390 403764 2384->2390 2386 4037d1 _errno 2385->2386 2387 403802 _errno 2385->2387 2388 4037f5 _errno 2386->2388 2389 4037de _errno 2386->2389 2387->2390 2388->2390 2389->2390 2391 4037e8 _errno 2389->2391 2390->2363 2390->2364 2391->2390 2393 401f50 VirtualQuery 2392->2393 2394 401f80 2393->2394 2395 402028 2393->2395 2397 401f8e memcpy 2394->2397 2400 401fb0 VirtualProtect memcpy 2394->2400 2396 401f00 5 API calls 2395->2396 2403 402040 2395->2403 2396->2403 2398 401f9e 2397->2398 2398->2214 2399 402049 2399->2214 2400->2398 2401 401ff8 2400->2401 2401->2398 2402 401ffd VirtualProtect 2401->2402 2402->2214 2403->2399 2405 402115 2403->2405 2407 4021fb 2403->2407 2411 4020b8 2403->2411 2404 402150 2404->2214 2405->2404 2406 401f50 5 API calls 2405->2406 2406->2405 2408 401f00 5 API calls 2407->2408 2409 40220b 2408->2409 2410 401f50 VirtualQuery memcpy VirtualProtect memcpy VirtualProtect 2410->2411 2411->2404 2411->2410 2412 4020fd 2411->2412 2413 401f00 5 API calls 2412->2413 2413->2405 2415 401f80 2414->2415 2416 402028 2414->2416 2418 401f8e memcpy 2415->2418 2421 401fb0 VirtualProtect memcpy 2415->2421 2417 401f00 8 API calls 2416->2417 2424 402040 2416->2424 2417->2424 2419 401f9e 2418->2419 2419->2216 2420 402049 2420->2216 2421->2419 2422 401ff8 2421->2422 2422->2419 2423 401ffd VirtualProtect 2422->2423 2423->2216 2424->2420 2427 4021fb 2424->2427 2428 402115 2424->2428 2431 4020b8 2424->2431 2425 402150 2425->2216 2426 401f50 8 API calls 2426->2428 2429 401f00 8 API calls 2427->2429 2428->2425 2428->2426 2430 40220b 2429->2430 2431->2425 2432 4020fd 2431->2432 2434 401f50 8 API calls 2431->2434 2433 401f00 8 API calls 2432->2433 2433->2428 2434->2431 2657 401be0 2658 401bec 2657->2658 2659 401bf0 2658->2659 2660 401e60 6 API calls 2658->2660 2661 401c18 2660->2661 2662 4010e7 2663 4010f0 2662->2663 2664 401050 2663->2664 2665 4010fb signal 2663->2665 2665->2664 2666 40116d signal 2665->2666 2666->2664 2731 403ba7 2732 403c10 _errno 2731->2732 2733 403bc1 2731->2733 2738 403b20 2733->2738 2735 403c04 2736 403bc9 2736->2735 2737 403810 3 API calls 2736->2737 2737->2736 2739 403b41 _errno 2738->2739 2740 403b2c FindClose 2738->2740 2742 403b4c 2739->2742 2740->2739 2741 403b51 2740->2741 2743 403740 8 API calls 2741->2743 2742->2736 2743->2742 2576 401e29 2577 401e30 free LeaveCriticalSection 2576->2577 2579 401e1f 2577->2579 2580 401c29 2581 401c42 2580->2581 2583 401c56 2581->2583 2584 401e60 2581->2584 2585 401eb3 2584->2585 2586 401e6c 2584->2586 2587 401ed0 InitializeCriticalSection 2585->2587 2588 401ebc 2585->2588 2589 401e85 2586->2589 2591 401e6e 2586->2591 2587->2588 2588->2583 2593 401cd0 4 API calls 2589->2593 2595 401e8e 2589->2595 2590 401e7c 2590->2583 2591->2590 2596 401cd0 EnterCriticalSection 2591->2596 2592 401e98 DeleteCriticalSection 2592->2590 2593->2595 2595->2590 2595->2592 2597 401d1b LeaveCriticalSection 2596->2597 2599 401cee 2596->2599 2597->2590 2598 401cf0 TlsGetValue GetLastError 2598->2599 2599->2597 2599->2598 2600 401329 _onexit 2667 402ee9 2668 402ef0 _strdup 2667->2668 2670 402cb6 2668->2670 2671 402f1f 2668->2671 2672 4028b0 realloc 2671->2672 2675 402d45 2672->2675 2673 402960 73 API calls 2673->2675 2674 402d8c 2675->2673 2675->2674 2676 401ee9 2677 401ef0 2676->2677 2678 401cd0 4 API calls 2677->2678 2679 401e8e 2678->2679 2680 401e98 DeleteCriticalSection 2679->2680 2681 401e7c 2679->2681 2680->2681 2744 401fa9 2745 401fb0 VirtualProtect memcpy 2744->2745 2746 401ff8 2745->2746 2747 401f9e 2745->2747 2746->2747 2748 401ffd VirtualProtect 2746->2748 2522 401b6c 2524 401b70 atexit 2522->2524 2601 40182c 2605 401700 2601->2605 2602 40177c 2602->2602 2603 4031f0 75 API calls 2602->2603 2604 4017af 2602->2604 2606 401986 2603->2606 2605->2602 2605->2604 2609 401870 _isctype 2605->2609 2610 4031f0 75 API calls 2605->2610 2611 4012a0 __getmainargs 2606->2611 2608 401995 2609->2605 2610->2605 2611->2608 2612 401430 2613 40143f 2612->2613 2614 401451 FreeLibrary 2613->2614 2615 40145c 2613->2615 2614->2615 2616 401d30 2617 401d50 calloc 2616->2617 2619 401d40 2616->2619 2618 401d6a EnterCriticalSection LeaveCriticalSection 2617->2618 2617->2619 2619->2617 2749 401db2 2750 401de0 EnterCriticalSection 2749->2750 2751 401dd1 2749->2751 2752 401e10 LeaveCriticalSection 2750->2752 2754 401df9 2750->2754 2751->2750 2753 401e1f 2752->2753 2754->2752 2756 401dff 2754->2756 2755 401e36 free LeaveCriticalSection 2755->2753 2756->2753 2756->2755 2525 403579 2530 403580 wcstombs 2525->2530 2527 403630 setlocale free 2529 403648 2527->2529 2528 40362c 2528->2527 2530->2527 2530->2528 2531 402179 2536 4020b8 2531->2536 2532 401f50 13 API calls 2532->2536 2533 402150 2534 4020fd 2535 401f00 13 API calls 2534->2535 2538 402115 2535->2538 2536->2532 2536->2533 2536->2534 2537 401f50 13 API calls 2537->2538 2538->2533 2538->2537 2539 403b79 2540 403b95 _errno 2539->2540 2541 403b8b 2539->2541 2540->2541 2682 4032f9 2683 403300 2682->2683 2684 403314 free 2683->2684 2685 40332d 2683->2685 2684->2684 2684->2685 2620 403a3c 2621 403a40 _errno 2620->2621 2622 403a11 2621->2622 2623 402d3c 2625 402d40 2623->2625 2624 402d8c 2625->2624 2626 402960 73 API calls 2625->2626 2626->2625 2686 401bfc 2687 401c00 2686->2687 2688 401e60 6 API calls 2687->2688 2689 401c18 2688->2689 2757 4019bc 2760 401700 2757->2760 2758 4031f0 75 API calls 2758->2760 2759 40177c 2761 4031f0 75 API calls 2759->2761 2762 4017af 2759->2762 2760->2758 2760->2759 2760->2762 2766 401870 _isctype 2760->2766 2763 401986 2761->2763 2767 4012a0 __getmainargs 2763->2767 2765 401995 2766->2760 2767->2765

    Executed Functions

    Function 00403740 Relevance: 12.1, APIs: 8, Instructions: 64fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 362 403740-403762 FindFirstFileA 363 403764-40376f 362->363 364 4037be-4037cf _errno GetLastError 362->364 367 403783-40378f 363->367 365 4037d1-4037dc _errno 364->365 366 403802-40380d _errno 364->366 368 4037f5-403800 _errno 365->368 369 4037de-4037e6 _errno 365->369 370 4037a3-4037ad 366->370 371 403771-403780 367->371 372 403791-40379a 367->372 368->370 369->370 375 4037e8-4037f3 _errno 369->375 371->367 373 4037b0-4037bd 372->373 374 40379c 372->374 374->370 375->370
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _errno$ErrorFileFindFirstLast
    • String ID:
    • API String ID: 2068755524-0
    • Opcode ID: 6065e16887977d959ba446ceeb7a6ab7c81ace2f1ae18caa5962314715c5d684
    • Instruction ID: 1d17b7681d177df455f3f1dc273843f1f50ae7a7502d0f7e8a06dd6acde50feb
    • Opcode Fuzzy Hash: 6065e16887977d959ba446ceeb7a6ab7c81ace2f1ae18caa5962314715c5d684
    • Instruction Fuzzy Hash: 6C110DF51082108AEB10AF75D8813A67F98AF41346F14847BE451EF3C2D27D8645C3B6
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004011B0 Relevance: 12.1, APIs: 8, Instructions: 59COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _setmode$ExceptionExitFilterProcessUnhandled__p__environ__p__fmode_cexit
    • String ID:
    • API String ID: 3476844589-0
    • Opcode ID: bc8c1e66f09b0931d7dd195dcaa60a323bbe3d20910e0d7d1c1d24e5f5cbd8eb
    • Instruction ID: cc34db2bdfaa55d26d79c29d544db5e231f1e39a8984247bbb583bf4e851bc86
    • Opcode Fuzzy Hash: bc8c1e66f09b0931d7dd195dcaa60a323bbe3d20910e0d7d1c1d24e5f5cbd8eb
    • Instruction Fuzzy Hash: 6121FAB59087009FD700FF79D58560A7BE4BF49748F00893EF984F73A2D638A9408B5A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00402960 Relevance: 40.9, APIs: 22, Strings: 1, Instructions: 645stringCOMMON
    Download Yara Rule
    APIs
    • strlen.MSVCRT ref: 00402980
    • memcpy.MSVCRT ref: 004029A7
      • Part of subcall function 00403340: setlocale.MSVCRT ref: 00403358
      • Part of subcall function 00403340: _strdup.MSVCRT ref: 00403366
      • Part of subcall function 00403340: setlocale.MSVCRT ref: 0040337C
      • Part of subcall function 00403340: wcstombs.MSVCRT ref: 004033A7
      • Part of subcall function 00403340: realloc.MSVCRT ref: 004033BB
      • Part of subcall function 00403340: wcstombs.MSVCRT ref: 004033D4
      • Part of subcall function 00403340: setlocale.MSVCRT ref: 004033E4
      • Part of subcall function 00403340: free.MSVCRT ref: 004033EC
      • Part of subcall function 00402360: malloc.MSVCRT ref: 0040237B
    • strlen.MSVCRT ref: 00402CD6
    • strlen.MSVCRT ref: 00402EC6
    • _strdup.MSVCRT ref: 00402F10
      • Part of subcall function 00402960: strlen.MSVCRT ref: 00402A31
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: strlen$setlocale$_strdupwcstombs$freemallocmemcpyrealloc
    • String ID: \
    • API String ID: 3818432545-2967466578
    • Opcode ID: d254b9f817a2bcdcc832043df61dec7398999cc28db53cc347704f5b257f651f
    • Instruction ID: 671ef5f6b5ae1afef096c624a78a6bef2a646ecf7b4523d2d9aec984ecb265f7
    • Opcode Fuzzy Hash: d254b9f817a2bcdcc832043df61dec7398999cc28db53cc347704f5b257f651f
    • Instruction Fuzzy Hash: EE42C171E082558FDB10DFA9C1883AEBBF1AF44304F18807BE885BB3C1D37999429B95
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403340 Relevance: 27.3, APIs: 18, Instructions: 272COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 194 403340-403361 setlocale 195 403363-40336b _strdup 194->195 196 40336d-403386 setlocale 194->196 195->196 197 403390-403400 wcstombs realloc wcstombs setlocale free 196->197 198 403388-40338e 196->198 198->197 199 403401-40345f mbstowcs call 402210 mbstowcs 198->199 202 403480-403487 199->202 203 403461-403465 199->203 206 40348d-403494 202->206 207 40356e-403571 202->207 204 403687-40368f 203->204 205 40346b-40346f 203->205 204->202 208 403695-40369a 204->208 205->204 209 403475-40347a 205->209 210 4034b4-4034b8 206->210 207->197 208->202 211 4036a0-4036bb setlocale free 208->211 209->202 212 4036cf-4036dd 209->212 213 4034a0-4034a6 210->213 214 4034ba-4034c3 210->214 217 403648-403654 211->217 212->202 213->214 218 4034a8-4034b2 213->218 215 4034d1-4034d5 214->215 216 4034c5-4034cf 214->216 215->216 219 4034d7-4034da 215->219 216->215 216->216 218->210 220 4034ea-4034ed 218->220 219->220 221 4034dc-4034e8 219->221 222 403580-403586 220->222 223 4034f3-4034fb 220->223 221->210 221->220 226 40358c-403596 222->226 227 4036ed 222->227 224 403501-403505 223->224 225 4036e2-4036e5 223->225 224->225 228 40350b-403569 wcstombs realloc wcstombs 224->228 225->227 226->222 229 403598-40359c 226->229 230 4036f3-4036fb 227->230 231 40359e-4035ad 227->231 232 403630-403643 setlocale free 228->232 229->222 229->231 233 403707-40370f 230->233 234 4036fd-403701 230->234 235 4035c0-4035ca 231->235 236 4035af-4035b3 231->236 232->217 233->231 240 403715-40371d 233->240 234->231 234->233 235->235 237 4035cc-4035d0 235->237 238 4035b9 236->238 239 4036bd-4036c1 236->239 237->235 242 4035d2-4035d9 237->242 238->235 243 4036c7-4036ca 239->243 244 4035df 239->244 240->231 241 403723-403727 240->241 241->231 245 40372d-40372f 241->245 242->239 242->244 246 4035e1 243->246 244->246 245->231 247 4035e3-4035e6 246->247 248 4035e8-4035f3 247->248 249 403609-40362a wcstombs 247->249 250 4035f5-4035fc 248->250 251 403657-40365e 248->251 249->232 252 40362c 249->252 253 403655 250->253 254 4035fe-403607 250->254 255 403670-40367a 251->255 256 403660-403664 251->256 252->232 253->251 254->248 254->249 255->255 257 40367c-403680 255->257 256->247 258 40366a 256->258 257->255 259 403682 257->259 258->255 259->247
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: setlocalewcstombs$free$mbstowcsrealloc$_strdup
    • String ID:
    • API String ID: 2891164732-0
    • Opcode ID: 842cec03313bb9a768754cf361a167b3bc9370abfea6f28439ccfa7d5dfaf393
    • Instruction ID: b8db9ef4120310223e4f0c8ba590ae7914f320c6de6de4b4764861e7f51f1b6e
    • Opcode Fuzzy Hash: 842cec03313bb9a768754cf361a167b3bc9370abfea6f28439ccfa7d5dfaf393
    • Instruction Fuzzy Hash: 3EB1C3709042259ACB24AF65C44527BFFF9EF54706F44843FE884BB391E3399A85C78A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401460 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 113COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 260 401460-401488 call 401bc0 printf 263 4014e3-4014eb 260->263 264 40148a-401495 263->264 265 4014ed-401504 printf 263->265 266 4014d1-4014d9 264->266 267 40155c-401564 265->267 268 401497-4014c9 scanf 266->268 269 4014db 266->269 270 401506-401511 267->270 271 401566-401571 267->271 268->266 269->263 273 40154a-401552 270->273 272 4015ed-4015f5 271->272 274 401573-40157e 272->274 275 4015fb-401612 puts 272->275 276 401513-401542 scanf 273->276 277 401554 273->277 278 4015db-4015e3 274->278 279 401671-401679 275->279 276->273 277->267 280 401580-4015d3 278->280 281 4015e5 278->281 282 401614-40161f 279->282 283 40167b-401686 _getch 279->283 280->278 281->272 284 401653-40165b 282->284 285 401621-40164b printf 284->285 286 40165d-401669 putchar 284->286 285->284 286->279
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: printf$_getchputcharputsscanf
    • String ID: %d$Addition of two matrices is$Enter the element of matrix A: $Enter the element of matrix B:
    • API String ID: 1626964533-1635575425
    • Opcode ID: 12d43d35ee0bd4b21a615cfa3b273a351d1a9835eff8d03e87a0fa7bb2d57a52
    • Instruction ID: 0f936875b1b060473c74d03a11f0d853f708935b9433a9e4fc109f0080084346
    • Opcode Fuzzy Hash: 12d43d35ee0bd4b21a615cfa3b273a351d1a9835eff8d03e87a0fa7bb2d57a52
    • Instruction Fuzzy Hash: BD51E271708340DFD3749F49C84679BB6E1AFC6318F29C82E94C9E6290D67884898F5B
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401690 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 257stringCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 287 401690-4016a0 288 401990-40199c call 4012a0 287->288 289 4016a6-4016f9 GetCommandLineA strlen call 402210 287->289 294 401700-40170b 289->294 295 401780-401782 294->295 296 40170d-401710 294->296 297 401a21 295->297 298 401788-40178a 295->298 299 4018a3-4018a8 296->299 300 401716 296->300 308 401a28 297->308 301 401790-401799 298->301 302 4019fc-401a0c 299->302 303 4018ae-4018be 299->303 304 4017d0-4017d3 300->304 305 40171c-40171f 300->305 301->301 309 40179b-40179e 301->309 314 401a13 302->314 310 401800-401809 303->310 306 4018c3-4018c7 304->306 307 4017d9-4017dc 304->307 311 4018d5-4018dc 305->311 312 401725-401728 305->312 316 4019b1-4019b7 306->316 317 4018cd-4018d0 306->317 307->299 315 4017e2-4017e5 307->315 318 401962-401981 call 4031f0 309->318 319 4017a4-4017a9 309->319 320 401810-401819 310->320 321 401840-401845 311->321 322 4018e2-4018e6 311->322 312->299 313 40172e-401731 312->313 313->321 323 401737-40173b 313->323 332 401a1a 314->332 315->321 325 4017e7-4017ee 315->325 316->294 317->294 335 401986 318->335 319->318 327 4017af-4017c9 319->327 320->320 328 40181b-40181d 320->328 321->314 324 40184b-40184c 321->324 322->308 329 4018ec-4018ee 322->329 331 401741 323->331 323->332 333 401850-401859 324->333 325->299 334 4017f4-4017fe 325->334 336 401830 328->336 337 40181f-401826 328->337 330 4018f0-4018f9 329->330 330->330 338 4018fb-4018ff 330->338 340 401743-40174c 331->340 332->297 333->333 341 40185b-401860 333->341 334->310 339 401832-401838 334->339 335->288 336->339 337->294 342 401905-401907 338->342 343 40199d-4019ac 338->343 339->337 340->340 344 40174e-401752 340->344 345 401862-40186a 341->345 346 401897-40189e 341->346 342->343 347 40190d-40191c 342->347 343->294 348 401921-401930 344->348 349 401758-40175a 344->349 350 401870-401885 _isctype 345->350 351 401935-401940 345->351 346->294 347->294 348->294 349->348 352 401760-40177a 349->352 353 401946-401949 350->353 354 40188b 350->354 351->353 355 40188e-401891 351->355 352->296 356 40177c 352->356 357 4019c0-4019f7 call 4031f0 353->357 358 40194b-401950 353->358 354->355 355->346 355->353 356->295 357->294 358->357 360 401952-40195d 358->360 360->294
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CommandLinestrlen
    • String ID: "$'$'$*$?$@$[$\
    • API String ID: 3702654222-871974141
    • Opcode ID: 1630d56af8fe825cb52b746c05e3e4fb3716930e96fbea616a6e41b4f1dfe627
    • Instruction ID: 591ae76485eb7b8a5aae4190c7b4819bd8dd7253fb8f02e9b76f0748732428d7
    • Opcode Fuzzy Hash: 1630d56af8fe825cb52b746c05e3e4fb3716930e96fbea616a6e41b4f1dfe627
    • Instruction Fuzzy Hash: EAA1B071A18305CFDB15CF68C8447AEBBE2BB44344F18853AE845F73A1E7389945CB5A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004031F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 394 4031f0-403204 395 403206-40320c 394->395 396 40320e-403214 394->396 395->396 399 403243-40324a 395->399 397 403223-40322d call 402960 396->397 398 403216-40321d call 402360 396->398 404 403232-403237 397->404 398->397 399->396 402 403250-403253 399->402 405 403255-40327c strlen call 402210 402->405 406 403239-403242 402->406 404->402 404->406 409 40328d-403292 405->409 410 403280-40328b 409->410 411 403294-4032a6 409->411 410->409 412 4032a8-4032bb _strdup 410->412 411->409 411->412 412->406 413 4032c1-4032ce call 4028b0 412->413 413->406
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID: glob-1.0-mingw32
    • API String ID: 0-3253302226
    • Opcode ID: 680acc8efdb5f26930de6df637e7e16ccdffa9684d376cd8aa0efc8f562424ed
    • Instruction ID: 9b6625b1beadd874c166757b1fcabbc8dac9a67ed8a5df1ccf95d766dfdead67
    • Opcode Fuzzy Hash: 680acc8efdb5f26930de6df637e7e16ccdffa9684d376cd8aa0efc8f562424ed
    • Instruction Fuzzy Hash: D5219FB2E042148BCB109FA988452AEBFB9EF85301F0484BFD84177381D77C9A41CB99
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403810 Relevance: 4.6, APIs: 3, Instructions: 53fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 416 403810-403831 FindNextFileA 417 403892-40389a GetLastError 416->417 418 403833-40383e 416->418 419 40389c-4038b1 _errno 417->419 420 40386e-403878 417->420 421 403852-40385e 418->421 424 403880-403891 420->424 422 403840-40384f 421->422 423 403860-403869 421->423 422->421 423->424 425 40386b 423->425 425->420
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: ErrorFileFindLastNext_errno
    • String ID:
    • API String ID: 2804278807-0
    • Opcode ID: 14ada7d36821330d4adb80cf875026dcd964a13f817f57457775d3ee5a20c034
    • Instruction ID: 289a74dd08d723566d0560508b3de26646d88688c5a2a5ee1807a2dab1f2fb5c
    • Opcode Fuzzy Hash: 14ada7d36821330d4adb80cf875026dcd964a13f817f57457775d3ee5a20c034
    • Instruction Fuzzy Hash: 440188725042504BDF50AF79ACC12A6BBD4AF41756F08C8BBE858DE386E23DC948C3A5
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403AD0 Relevance: 4.5, APIs: 3, Instructions: 21COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 426 403ad0-403ada 427 403b00-403b10 _errno 426->427 428 403adc-403aef FindClose 426->428 430 403afb-403aff 427->430 428->427 429 403af1-403af9 free 428->429 429->430
    APIs
    • FindClose.KERNEL32(?,?,?,?,?,00402F5B), ref: 00403AE5
    • free.MSVCRT(?,?,?,?,?,?,00402F5B), ref: 00403AF4
    • _errno.MSVCRT ref: 00403B00
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CloseFind_errnofree
    • String ID:
    • API String ID: 1660445202-0
    • Opcode ID: eecca25b770a738e83ff0b1e74635ec2342580d001e20752e53b2817692bb7d4
    • Instruction ID: 17f20279e9d7b349f04075f4cc6b87f495ac3ef6c2a517f0ef329dcf35a79c67
    • Opcode Fuzzy Hash: eecca25b770a738e83ff0b1e74635ec2342580d001e20752e53b2817692bb7d4
    • Instruction Fuzzy Hash: C7E04F716042004BD7007F7588827173EA86F00319F000A7EE890AB2C3E77C96448696
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004012E0 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __set_app_type.MSVCRT ref: 004012EA
      • Part of subcall function 004011B0: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,004012F5), ref: 004011E3
      • Part of subcall function 004011B0: _setmode.MSVCRT ref: 00401220
      • Part of subcall function 004011B0: _setmode.MSVCRT ref: 00401234
      • Part of subcall function 004011B0: _setmode.MSVCRT ref: 00401248
      • Part of subcall function 004011B0: __p__fmode.MSVCRT ref: 0040124D
      • Part of subcall function 004011B0: __p__environ.MSVCRT ref: 00401267
      • Part of subcall function 004011B0: _cexit.MSVCRT ref: 0040128A
      • Part of subcall function 004011B0: ExitProcess.KERNEL32(?,?,?,?,?,004012F5), ref: 00401292
    • __set_app_type.MSVCRT ref: 0040130A
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _setmode$__set_app_type$ExceptionExitFilterProcessUnhandled__p__environ__p__fmode_cexit
    • String ID:
    • API String ID: 2461648636-0
    • Opcode ID: 4f2a6a6c2dbb4742eff141a9edd744cfa2f4a8b8e8b533109d40fc2ce58dc959
    • Instruction ID: 14ef5bbc4013a3bb529eb038fc4242e813a41595c16fb46b3ef901d9de0fdf76
    • Opcode Fuzzy Hash: 4f2a6a6c2dbb4742eff141a9edd744cfa2f4a8b8e8b533109d40fc2ce58dc959
    • Instruction Fuzzy Hash: E7D04C314005118FD7047F64CA06399B774BF04304F45062CD5953B051CBB835568BD9
    Uniqueness

    Uniqueness Score: -1.00%

    Non-executed Functions

    Function 00401340 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 58libraryloaderCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 436 401340-401359 GetModuleHandleA 437 401410-40141f 436->437 438 40135f-40139d LoadLibraryA GetProcAddress * 2 436->438 439 4013a2-4013a4 437->439 438->439 440 4013a6-4013ae 439->440 441 4013b7-4013be 439->441 440->441 442 4013c0-4013d6 GetModuleHandleA 441->442 443 4013fa-40140c atexit 441->443 444 4013d8-4013eb GetProcAddress 442->444 445 4013ed-4013ef 442->445 444->445 445->443 446 4013f1 445->446 446->443
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: AddressProc$HandleModule$LibraryLoadatexit
    • String ID: _Jv_RegisterClasses$__deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll$libgcj-16.dll
    • API String ID: 2016387483-548026336
    • Opcode ID: c704f1be39f1e37c1d383a94129219c5346b1fb09e334ada66df5bd6c05bddc1
    • Instruction ID: 6c7b7aa4c45bae774636915f4c02217523ef55571564832312475bcbfc6dd809
    • Opcode Fuzzy Hash: c704f1be39f1e37c1d383a94129219c5346b1fb09e334ada66df5bd6c05bddc1
    • Instruction Fuzzy Hash: 9C114CB18047008AD700BF79A95531FBEE8EF80748F41893FD9847B6A5E77C85489B9B
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401A30 Relevance: .1, Instructions: 78COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: c109b914e246866c18af00eae8f597a565d5c7776f425b395473f41a8873c9e7
    • Instruction ID: 52ef34c4338b48cac8443578fbfb313151a4eab097be7f4b1653fdafb6699387
    • Opcode Fuzzy Hash: c109b914e246866c18af00eae8f597a565d5c7776f425b395473f41a8873c9e7
    • Instruction Fuzzy Hash: 3921B438A1930206F375855D4984B9765A6A748314F148B3DDD48E23F5E7BDDC94D60C
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401F00 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 84memoryfileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 447 401f00-401f7a fwrite vfprintf abort VirtualQuery 449 401f80-401f87 447->449 450 402028-402034 447->450 453 401f89-401f8c 449->453 454 401f8e-401f99 memcpy 449->454 451 402040-402047 450->451 452 40203b call 401f00 450->452 456 402050-402067 451->456 457 402049 451->457 452->451 453->454 458 401fb0-401ff6 VirtualProtect memcpy 453->458 455 401f9e-401fa5 454->455 456->457 460 402069-402072 456->460 458->455 459 401ff8-401ffb 458->459 459->455 461 401ffd-402027 VirtualProtect 459->461 462 402160 460->462 463 402078-402080 460->463 466 402165-402169 462->466 464 402115 463->464 465 402086-40208e 463->465 467 40211a-402120 464->467 465->464 468 402094-4020a1 465->468 466->467 469 40216b-402170 466->469 470 402150-402156 467->470 471 402122-40214e call 401f50 467->471 468->466 472 4020a7 468->472 473 402176 469->473 474 4020ac-4020b2 469->474 471->470 472->474 473->467 476 4020b8-4020c1 474->476 477 4021fb-40220b call 401f00 474->477 476->470 480 4020c7-4020e5 476->480 482 402180-40218a 480->482 483 4020eb-4020ee 480->483 484 402192-4021a8 call 401f50 482->484 485 40218c 482->485 486 4021e0-4021f6 call 401f50 483->486 487 4020f4-4020f7 483->487 484->476 485->484 486->476 490 4021b0-4021b7 487->490 491 4020fd-402110 call 401f00 487->491 493 4021b9 490->493 494 4021bf-4021d5 call 401f50 490->494 491->464 493->494 494->476
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: Virtual$Protectmemcpy$Queryabortfwritevfprintf
    • String ID: @$Mingw runtime failure:
    • API String ID: 978211760-2549925133
    • Opcode ID: 63cb5d4d9c49b31943c7cabe371228aac632c333256667df449ee8983d4b2439
    • Instruction ID: 949fb00c6dd0f9b2eef533ffb8d5a47ea5e5b80155e9735439ee40d307d8d258
    • Opcode Fuzzy Hash: 63cb5d4d9c49b31943c7cabe371228aac632c333256667df449ee8983d4b2439
    • Instruction Fuzzy Hash: 7C31E2B5908301ABD300EF2AD18451FBFE8FF88758F51892EF488A7351D378D9448B86
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401000 Relevance: 12.1, APIs: 8, Instructions: 82COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 499 401000-401010 500 401060-401065 499->500 501 401012-401017 499->501 502 4010b0-4010c7 signal 500->502 503 401067-40106c 500->503 504 401079-401090 signal 501->504 505 401019-40101e 501->505 506 401096-401098 502->506 507 4010c9-4010e2 signal 502->507 508 401072-401077 503->508 509 4010fb-401112 signal 503->509 504->506 510 401143-401168 signal call 402250 504->510 511 4010f0-4010f5 505->511 512 401024-40103b signal 505->512 513 401050 506->513 514 40109a-4010a8 506->514 520 401052-401055 507->520 508->504 508->513 515 401114-401116 509->515 516 40116d-401184 signal 509->516 510->520 511->509 511->513 517 401041-401043 512->517 518 401189-4011a0 signal 512->518 513->520 514->520 515->513 521 40111c-40112a 515->521 516->520 522 401130-40113e 517->522 523 401049 517->523 518->520 521->520 522->520 523->513
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: signal
    • String ID:
    • API String ID: 1946981877-0
    • Opcode ID: 7a0068215a308f4732318d69c05a4b8ceef0cd86b93fb0489289c140bef6a384
    • Instruction ID: 6d751a4b22520b5f96daf2b980fc81a6c377f0741ed6e71d6ac997525177e5ce
    • Opcode Fuzzy Hash: 7a0068215a308f4732318d69c05a4b8ceef0cd86b93fb0489289c140bef6a384
    • Instruction Fuzzy Hash: 8531EC701082409AE7207F68854032F7AD4BF46368F114A2FE4E9E76E1C7BE89C49B5B
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004038C0 Relevance: 10.6, APIs: 7, Instructions: 121COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 528 4038c0-4038d3 529 4038d9-4038dc 528->529 530 403a5c-403a69 _errno 528->530 532 403a40-403a4d _errno 529->532 533 4038e2-403901 _fullpath 529->533 531 403a11-403a1d 530->531 532->531 534 403950-403965 533->534 535 403903-403918 533->535 534->534 536 403967-40396d 534->536 535->535 537 40391a-403920 535->537 538 403a20-403a26 536->538 539 403973-40397a 536->539 540 403a30-403a36 537->540 541 403926-403937 537->541 538->539 538->540 542 40397c-403983 539->542 541->542 543 403939-40393c 541->543 545 403987-40399b 542->545 543->542 544 40393e-40394a 543->544 544->534 544->542 545->545 546 40399d-4039a2 545->546 547 4039a4-4039a7 546->547 548 4039aa-4039c5 malloc 546->548 547->548 549 4039cb-4039f6 memcpy call 403740 548->549 550 403a4f-403a5a _errno 548->550 553 4039f8-403a0d 549->553 554 403a6b-403a75 free 549->554 550->531 553->531 554->531
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _errno$_fullpathmallocmemcpy
    • String ID:
    • API String ID: 3274612330-0
    • Opcode ID: 80bf99418ccf6c991d114150a8d08ad12fb6cfa4f4960c761e34034eb3845287
    • Instruction ID: 02b346d9af18bab043850609542a31bc54b8d4c529629321441929d5ac3935cd
    • Opcode Fuzzy Hash: 80bf99418ccf6c991d114150a8d08ad12fb6cfa4f4960c761e34034eb3845287
    • Instruction Fuzzy Hash: 1241B2712446008BE7149F29C8423ABBFD9EF81306F08457ED8C5E73D5D6BC9A49CB9A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00402A59 Relevance: 9.2, APIs: 6, Instructions: 173stringCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 555 402a59 556 402a60-402a69 555->556 557 4030da-4030dd 556->557 558 402a6f-402a72 556->558 561 4030e5-4030f3 malloc 557->561 558->557 559 402a78-402a7d 558->559 559->556 560 402a7f-402a8f 559->560 562 402a91-402a93 560->562 563 402a99-402aa0 560->563 564 4030f9-403109 561->564 565 402fab-402fae 561->565 562->563 566 40310b-403115 562->566 567 402aa4-402ab6 563->567 568 403093-403096 564->568 569 402b30-402b3c call 403a80 565->569 572 402ac6-402ae3 566->572 570 402aa2 567->570 571 402ab8-402ac3 567->571 568->565 577 402b42-402b47 569->577 578 402f53-402f60 call 403ad0 569->578 570->567 571->572 575 402ae9-402af5 call 4038c0 572->575 576 402ffa-403008 free 572->576 587 402fb3-402fb7 575->587 588 402afb-402b00 575->588 582 402b49-402b4d 577->582 583 402b4f-402b61 call 402690 577->583 589 402f62-402f68 call 402910 578->589 590 402f6d-402f83 free 578->590 582->569 582->583 583->569 599 402b63-402b8e call 402210 583->599 592 4030a6-4030ab 587->592 593 402fbd-402fd4 free 587->593 594 402b06-402b29 strlen 588->594 595 40307a 588->595 589->590 597 402f89-402f8d 590->597 598 40309b-4030a1 590->598 592->590 602 4030b1-4030c8 _errno 592->602 600 402fd6-402fd9 593->600 601 402fed-402ff7 593->601 594->569 605 403086-40308d 595->605 597->600 603 402f8f-402f92 597->603 598->576 610 403010-403038 memcpy 599->610 611 402b94-402bce memcpy strlen call 402210 599->611 606 402fdc-402feb free 600->606 601->576 602->590 609 4030ce-4030d3 602->609 603->575 605->565 605->568 606->601 606->606 609->557 612 403060-403063 610->612 613 40303a-40303c 610->613 618 402bdd-402be3 611->618 617 40306b-403075 call 4028b0 612->617 613->612 615 40303e-40304c 613->615 619 403054-40305b 615->619 617->565 621 402bd0-402bdb 618->621 622 402be5-402bf7 618->622 619->565 621->618 624 402bf9-402c07 _strdup 621->624 622->618 622->624 624->619 625 402c0d-402c26 624->625 626 402fa0-402fa5 625->626 627 402c2c-402c31 625->627 626->565 626->617 627->561 628 402c37-402c41 627->628 629 402c57-402c63 628->629 630 402c43-402c4f strcoll 629->630 631 402c65-402c71 _stricoll 629->631 632 402c51-402c53 630->632 633 402c73-402c77 630->633 631->632 631->633 634 402c55 632->634 635 402c79-402c8d malloc 632->635 633->634 633->635 634->629 635->565 636 402c93-402ca8 635->636 636->605 637 402cae-402cb1 636->637 637->565
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: mallocstrlen$_strdup_stricollfreememcpystrcoll
    • String ID:
    • API String ID: 248952651-0
    • Opcode ID: d8754236ed8e364691b84d2c88c9f80e423247d17623405b245f4231c0212f30
    • Instruction ID: 08a0fd8c2e5ca12b7bdeaef617f604f1b7e7ee5ac1f6481a1200751a95de282c
    • Opcode Fuzzy Hash: d8754236ed8e364691b84d2c88c9f80e423247d17623405b245f4231c0212f30
    • Instruction Fuzzy Hash: 3F61AE71A046158FDB10DFA9C5887AEBBF5AF44344F08846AE884FB3C5E778E942CB45
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004023D0 Relevance: 7.7, APIs: 6, Instructions: 219COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 638 4023d0-4023e9 639 402550-402554 638->639 640 4023ef-4023f2 638->640 642 4025a5-4025af 639->642 643 402556-40255a 639->643 640->639 641 4023f8-40240f 640->641 644 40241e-402424 641->644 645 4025b0-4025b5 642->645 646 402562-402567 643->646 647 402544-40254d 644->647 648 40242a-40242d 644->648 649 4025e5-4025ef 645->649 650 4025b7-4025b9 645->650 655 402570-402574 646->655 651 4024c0-4024c7 648->651 652 402433-402435 648->652 653 4025d0-4025d2 650->653 654 4025bb-4025c0 650->654 651->646 656 4024cd-4024d2 651->656 652->647 659 40243b-40243e 652->659 657 4025e0-4025e3 653->657 658 4025d4-4025db 653->658 654->645 660 4025c2 654->660 655->659 661 402580-402582 655->661 656->647 662 4024d4-4024e3 656->662 657->645 658->654 659->647 663 402444-402447 659->663 660->647 667 402590-402598 661->667 668 402584-40258b 661->668 664 4025f8 662->664 665 4024e9-4024f1 662->665 663->647 666 40244d-40245c 663->666 664->659 669 4025fe-402604 664->669 670 402504-402509 665->670 673 402411-402419 666->673 674 40245e-402481 tolower * 2 666->674 671 402539-40253b 667->671 672 40259a-4025a4 667->672 675 40253d-402542 668->675 676 402610-402619 669->676 677 402625-40262a 669->677 680 4024f3-4024fc 670->680 681 40250b-402525 tolower * 2 670->681 671->661 671->675 678 402483-40248a 673->678 679 40241b 673->679 674->678 674->679 675->647 682 402532-402537 675->682 687 402648-402650 676->687 688 40261b-40261f 676->688 677->676 683 40262c-402646 tolower * 2 677->683 686 40249e-4024a1 678->686 679->644 684 402527-40252f 680->684 685 4024fe-402502 680->685 681->684 681->685 682->671 682->672 683->687 683->688 684->682 685->655 685->670 686->649 690 4024a7-4024aa 686->690 689 402653-402658 687->689 688->655 688->677 689->672 691 40265e-402660 689->691 692 402490-402495 690->692 693 4024ac-4024ae 690->693 696 402670-402672 691->696 697 402662-402667 691->697 692->647 698 40249b 692->698 694 4025f0-4025f3 693->694 695 4024b4-4024bb 693->695 694->698 695->692 700 402680-402683 696->700 701 402674-40267b 696->701 697->689 699 402669 697->699 698->686 699->647 700->689 701->697
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: tolower
    • String ID:
    • API String ID: 3025214199-0
    • Opcode ID: 6719ac4daa759019d79bfce8ce04f3372a78dc03506be0be376abf6b3b0c1063
    • Instruction ID: a81fc12b9ee1c7063405177c8739200d7760df72685fdf90ced3215254d2fe7a
    • Opcode Fuzzy Hash: 6719ac4daa759019d79bfce8ce04f3372a78dc03506be0be376abf6b3b0c1063
    • Instruction Fuzzy Hash: EE61497290C7715BC7208E199A98237B7D2AB95308F19053BDCD8B73C1E2BEDD06468E
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00402F97 Relevance: 7.6, APIs: 5, Instructions: 116stringCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _strdup_stricollmemcpystrlen
    • String ID:
    • API String ID: 2607129539-0
    • Opcode ID: 9018d6cf707ffdf8f07b661f52ffb291c681b2810a7b69c682a24e1c64297ada
    • Instruction ID: d71dd7615fda14a95ef3b29b4518fc98d20dfa3179d7bc44472367c9f757130e
    • Opcode Fuzzy Hash: 9018d6cf707ffdf8f07b661f52ffb291c681b2810a7b69c682a24e1c64297ada
    • Instruction Fuzzy Hash: 10419972A042168FEB10DF65C58476EBBF4AF84344F08843EE849E7385E7B8E9418B45
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403499 Relevance: 7.6, APIs: 5, Instructions: 72COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: wcstombs$freereallocsetlocale
    • String ID:
    • API String ID: 3931877334-0
    • Opcode ID: 95925751906ea966532d4c5daf27802f654785aaf8b3a49df95e5109afa0b982
    • Instruction ID: 01481f6565fbb979d07ef51ab7fce0d251f4b462bffd751db3137c099cdbb841
    • Opcode Fuzzy Hash: 95925751906ea966532d4c5daf27802f654785aaf8b3a49df95e5109afa0b982
    • Instruction Fuzzy Hash: 342191719042218AC724AF25C04127BFBF5EF54742F45847FD488BB395E33D4A45CB86
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401FA9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: ProtectVirtual$memcpy
    • String ID: @
    • API String ID: 1565840913-2766056989
    • Opcode ID: 8d252d25fe1c20e18a0e9059222ddfbadd53fe7b677d0296d521c2b5e1af80c6
    • Instruction ID: 1515267de7205155f00f6b89abbb6998ce5e0b3f8fe5bf111ce5678d567db4fa
    • Opcode Fuzzy Hash: 8d252d25fe1c20e18a0e9059222ddfbadd53fe7b677d0296d521c2b5e1af80c6
    • Instruction Fuzzy Hash: B2019EB5A09305AFD300EF29C18451EFBE4BBC8748F508D2EF498A3355D238EA448F86
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    • VirtualQuery failed for %d bytes at address %p, xrefs: 00402034
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: Virtual$Protectmemcpy$Query
    • String ID: VirtualQuery failed for %d bytes at address %p
    • API String ID: 228986436-2206166143
    • Opcode ID: f62dac0b9a3062a423fa3c163e80d535b95fe3e206b7b59b5cb10d34fba3f95c
    • Instruction ID: 34d4f9c65f6a2e62e0752d28737b077b0a2ff2b46a6ceaf3c835014f57e5dca2
    • Opcode Fuzzy Hash: f62dac0b9a3062a423fa3c163e80d535b95fe3e206b7b59b5cb10d34fba3f95c
    • Instruction Fuzzy Hash: 31F06DB15083019AE700AF2AD58461FBEE8AF85788F44883FF588E7390D778C844CA56
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401DB2 Relevance: 5.0, APIs: 4, Instructions: 48COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CriticalSection$EnterLeavefree
    • String ID:
    • API String ID: 4020351045-0
    • Opcode ID: ce89cf8867c83ee85bf93860b8b68e9c2f5707871ded9d6f50f470d8c8619972
    • Instruction ID: 8a1e2841a1e5dee81b6bf65f3e5ed8008b88dbbaf0e603b2087b64a219312124
    • Opcode Fuzzy Hash: ce89cf8867c83ee85bf93860b8b68e9c2f5707871ded9d6f50f470d8c8619972
    • Instruction Fuzzy Hash: 7F015EB1A082018BD700FF78C48161AB7E5BB40344F54467AE949B7392E738A9558BDB
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401CD0 Relevance: 5.0, APIs: 4, Instructions: 33COMMON
    Download Yara Rule
    APIs
    • EnterCriticalSection.KERNEL32(?,?,?,?,00401EF5,?,?,?,?,?,?,00401C18), ref: 00401CDC
    • TlsGetValue.KERNEL32(?,?,?,?,?,00401EF5,?,?,?,?,?,?,00401C18), ref: 00401CF5
    • GetLastError.KERNEL32(?,?,?,?,?,?,00401EF5,?,?,?,?,?,?,00401C18), ref: 00401CFF
    • LeaveCriticalSection.KERNEL32(?,?,?,?,?,00401EF5,?,?,?,?,?,?,00401C18), ref: 00401D22
    Memory Dump Source
    • Source File: 00000000.00000002.2865434871.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.2865422523.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865448416.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865461002.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.2865475171.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CriticalSection$EnterErrorLastLeaveValue
    • String ID:
    • API String ID: 682475483-0
    • Opcode ID: 09253a92432b929bdf472611891abed093f068ec65f6174facd7f73ca65bdbcd
    • Instruction ID: 967e7495848f225d727a210b3cb25ece8d10fa3814ced657effa8d026b94d064
    • Opcode Fuzzy Hash: 09253a92432b929bdf472611891abed093f068ec65f6174facd7f73ca65bdbcd
    • Instruction Fuzzy Hash: F7F0BEF19082505BDB00BFB995C261B7AA85E00304F05017EED807B397E73CEE04C6AB
    Uniqueness

    Uniqueness Score: -1.00%