Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Win32.647.23647.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Win32.647.23647.exe
Analysis ID:1417316
MD5:5da5d327d44645e0f3eb50b13a562927
SHA1:a75c81577273a8636241299f5f28af46e524250a
SHA256:aa2d947e869e13f0f09bc5762690f56967e03392f9720d83f03b67601958cd7b
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
PE file contains more sections than normal
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.Win32.647.23647.exe (PID: 4456 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exe" MD5: 5DA5D327D44645E0F3EB50B13A562927)
    • conhost.exe (PID: 2624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeReversingLabs: Detection: 18%
Machine Learning detection for sample
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeJoe Sandbox ML: detected
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeCode function: 0_2_004035C0 FindFirstFileA,_errno,GetLastError,_errno,_errno,_errno,_errno,_errno,0_2_004035C0
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: Number of sections : 13 > 10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeSection loaded: apphelp.dllJump to behavior
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal52.winEXE@2/1@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2624:120:WilError_03
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeReversingLabs: Detection: 18%
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeCode function: 0_2_00401340 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,atexit,0_2_00401340
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: section name: /4
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: section name: /14
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: section name: /29
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: section name: /41
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: section name: /55
Source: SecuriteInfo.com.Trojan.Win32.647.23647.exeStatic PE information: section name: /67
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeCode function: 0_2_004035C0 FindFirstFileA,_errno,GetLastError,_errno,_errno,_errno,_errno,_errno,0_2_004035C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeAPI call chain: ExitProcess graph end nodegraph_0-2179
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeCode function: 0_2_00401340 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,atexit,0_2_00401340
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeCode function: 0_2_004011B0 SetUnhandledExceptionFilter,_iob,_setmode,_setmode,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,0_2_004011B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exeCode function: 0_2_004018B0 cpuid 0_2_004018B0

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
DLL Side-Loading		1
Process Injection		1
Process Injection		OS Credential Dumping1
File and Directory Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
DLL Side-Loading		LSASS Memory11
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Trojan.Win32.647.23647.exe18%ReversingLabs
SecuriteInfo.com.Trojan.Win32.647.23647.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1417316
Start date and time:2024-03-28 23:26:08 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:SecuriteInfo.com.Trojan.Win32.647.23647.exe
Detection:MAL
Classification:mal52.winEXE@2/1@0/0
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 10
  • Number of non-executed functions: 13
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: SecuriteInfo.com.Trojan.Win32.647.23647.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File
Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exe
File Type:ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):21
Entropy (8bit):3.7849418274376423
Encrypted:false
SSDEEP:3:ORyKX5lFov:OgKJfy
MD5:F4480AD20ADAD31BFF18944B191D437D
SHA1:E5C31ABBC0C9209E4C1E033EE2FC674F83DFC7B4
SHA-256:A788B23643C585A49C9CCB466602AD480D621FDBA38E8F848AF6B0AEFF4B35A7
SHA-512:52373444EC6D59152D9CE069E771AE87266F150A42D42D8275ED6AC474E7B42400EC9A23F5FEB311C20BA7B4BBD13CE48455F48C5C5A7521C8EE0B0D7F271B18
Malicious:false
Reputation:low
Preview:Enter Your marks : ..

Static File Info

General

File type:PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):5.503082078649661
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.96%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • VXD Driver (31/22) 0.00%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:SecuriteInfo.com.Trojan.Win32.647.23647.exe
File size:41'532 bytes
MD5:5da5d327d44645e0f3eb50b13a562927
SHA1:a75c81577273a8636241299f5f28af46e524250a
SHA256:aa2d947e869e13f0f09bc5762690f56967e03392f9720d83f03b67601958cd7b
SHA512:155974b1aabe9a1f1381bf0f01e10c7c08e5b37a52900440b862d2dfabc70f4272aeabbb059f25e779c3cdd9fd72bfe8d6d25bb6ddc8654dc3bcc07832b787a3
SSDEEP:768:T9yEQ+O9qhwfJPP3lLuzZPKqfgSpo7TEpOm:TNO7fJPP3lLuBZfvoMpOm
TLSH:0A132B59BE254CE7EA52533E90E7C7762B3CF1814A2357B3BB30F7345B236922099246
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....`Se.r...................H...............@....@..................................!........ ............................

File Icon

Icon Hash:00928e8e8686b000

Static PE Info

General

Entrypoint:0x4012e0
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows cui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:0x655360C1 [Tue Nov 14 11:57:53 2023 UTC]
TLS Callbacks:0x401ab0, 0x401a60
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:26b67a10d8c2bb0006e66dce8bce4de4

Entrypoint Preview

Instruction
sub esp, 1Ch
mov dword ptr [esp], 00000001h
call dword ptr [004081A0h]
call 00007FC67CC4BEE0h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
sub esp, 1Ch
mov dword ptr [esp], 00000002h
call dword ptr [004081A0h]
call 00007FC67CC4BEC0h
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
jmp dword ptr [004081CCh]
lea esi, dword ptr [esi+00h]
lea edi, dword ptr [edi+00000000h]
jmp dword ptr [004081BCh]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 10h
mov dword ptr [esp], 00405000h
call 00007FC67CC4E891h
sub esp, 04h
test eax, eax
je 00007FC67CC4C0D7h
mov dword ptr [esp], 00405000h
mov ebx, eax
call 00007FC67CC4E858h
sub esp, 04h
mov dword ptr [0040706Ch], eax
mov dword ptr [esp+04h], 00405013h
mov dword ptr [esp], ebx
call 00007FC67CC4E858h
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 00405029h
mov dword ptr [esp], ebx
call 00007FC67CC4E843h
sub esp, 08h
mov dword ptr [00404000h], eax
test esi, esi
je 00007FC67CC4C033h
mov dword ptr [eax+eax+00h], 00000000h

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x80000x5fc.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0xa0040x18.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x81340xe4.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x2c440x2e007e44456434b13387b3cdd5516472f9d4False0.5824558423913043data6.056359577312629IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x40000x1c0x200aa0c67885995cb2f131fee901ab81215False0.064453125data0.2170088308205865IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata0x50000x3480x4005fec0274a0d878017b2ed5d1f6182432False0.2890625data4.427614253673753IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
/40x60000x9a40xa00a4c1816ef572f540837a6cfc50427d20False0.403125data4.7433180021581185IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss0x70000x700x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata0x80000x5fc0x6007dac5c2460eaadba57421c19881ec332False0.455078125data4.672867796055926IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT0x90000x180x200fce7bf42962f0498d618cd11fcfcd656False0.04296875data0.11446338125913882IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls0xa0000x200x200f7a419142b47f1a6560b6d595ae80d75False0.05859375data0.22482003450968063IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/140xb0000x380x200a034497a547445685ba164e554dc6554False0.068359375Matlab v4 mat-file (little endian) *, rows 2, columns 2621440.2162069074398449IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/290xc0000x1cff0x1e0053cb59d25d60be4bbfab895e53a06ba9False0.4591145833333333data5.766420282091756IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/410xe0000x12f0x2000f209b8eeedb4402bcc92889fdf74aaaFalse0.361328125data3.0440842995585107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/550xf0000x1c80x2006c09e0eb7c561a751ad2952f47d39462False0.466796875data4.317359181890475IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/670x100000x380x200734d11dce143bc9d2ed59f25f83dbd10False0.1171875data0.6745765448489234IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLLImport
KERNEL32.dllDeleteCriticalSection, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileA, FindNextFileA, FreeLibrary, GetCommandLineA, GetLastError, GetModuleHandleA, GetProcAddress, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, SetUnhandledExceptionFilter, TlsGetValue, VirtualProtect, VirtualQuery
msvcrt.dll_getch, _strdup, _stricoll
msvcrt.dll__getmainargs, __mb_cur_max, __p__environ, __p__fmode, __set_app_type, _cexit, _errno, _fpreset, _fullpath, _iob, _isctype, _onexit, _pctype, _setmode, abort, atexit, calloc, free, fwrite, malloc, mbstowcs, memcpy, printf, puts, realloc, scanf, setlocale, signal, strcoll, strlen, tolower, vfprintf, wcstombs

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:23:26:55
Start date:28/03/2024
Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win32.647.23647.exe"
Imagebase:0x400000
File size:41'532 bytes
MD5 hash:5DA5D327D44645E0F3EB50B13A562927
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:false

General

Target ID:1
Start time:23:26:55
Start date:28/03/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:false

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:6.3%
    Dynamic/Decrypted Code Coverage:0%
    Signature Coverage:6.5%
    Total number of Nodes:525
    Total number of Limit Nodes:17
    execution_graph 2151 4035c0 FindFirstFileA 2152 40363e _errno GetLastError 2151->2152 2157 4035e4 2151->2157 2153 403651 _errno 2152->2153 2154 403682 _errno 2152->2154 2155 403675 _errno 2153->2155 2156 40365e _errno 2153->2156 2154->2157 2155->2157 2156->2157 2158 403668 _errno 2156->2158 2158->2157 2417 401340 GetModuleHandleA 2418 4013a2 2417->2418 2419 40135f LoadLibraryA GetProcAddress GetProcAddress 2417->2419 2420 4013c0 GetModuleHandleA 2418->2420 2421 4013fa atexit 2418->2421 2419->2418 2422 4013d8 GetProcAddress 2420->2422 2423 4013ed 2420->2423 2422->2423 2423->2421 2509 401000 2510 401060 2509->2510 2511 401012 2509->2511 2514 4010b0 signal 2510->2514 2515 401067 2510->2515 2512 401079 signal 2511->2512 2513 401019 2511->2513 2521 401143 signal 2512->2521 2522 401041 2512->2522 2517 4010f0 2513->2517 2518 401024 signal 2513->2518 2516 4010c9 signal 2514->2516 2514->2522 2519 401072 2515->2519 2520 4010fb signal 2515->2520 2516->2522 2517->2520 2517->2522 2518->2522 2523 401189 signal 2518->2523 2519->2512 2519->2522 2520->2522 2524 40116d signal 2520->2524 2525 4020d0 _fpreset 2521->2525 2523->2522 2524->2522 2525->2522 2609 401bc9 2610 401bd0 calloc 2609->2610 2611 401bea EnterCriticalSection LeaveCriticalSection 2610->2611 2612 401bc0 2610->2612 2612->2610 2701 402489 2703 402291 2701->2703 2702 4024ac tolower tolower 2702->2703 2705 402303 2702->2705 2703->2702 2704 4022de tolower tolower 2703->2704 2703->2705 2706 40238b tolower tolower 2703->2706 2704->2703 2704->2705 2706->2703 2706->2705 2526 40180c 2527 401810 2526->2527 2530 4012a0 __getmainargs 2527->2530 2529 401815 2530->2529 2613 4030cc 2614 4030d0 2613->2614 2615 4030d5 strlen 2614->2615 2620 4030b9 2614->2620 2616 4030f1 2615->2616 2617 403128 _strdup 2616->2617 2618 403141 2617->2618 2617->2620 2619 402730 realloc 2618->2619 2619->2620 2625 4027cc 2626 4027d0 2625->2626 2627 402730 realloc 2626->2627 2628 4027af 2627->2628 2629 4027bd free 2628->2629 2630 402790 2 API calls 2628->2630 2630->2629 2631 4037cc 2632 4037d0 malloc 2631->2632 2634 40384b memcpy 2632->2634 2635 4038cf _errno 2632->2635 2636 4035c0 8 API calls 2634->2636 2637 403878 2635->2637 2638 40386d 2636->2638 2638->2637 2639 4038eb free 2638->2639 2639->2637 2413 403690 FindNextFileA 2414 403712 GetLastError 2413->2414 2416 4036b3 2413->2416 2415 40371c _errno 2414->2415 2414->2416 2531 402e17 2553 402969 2531->2553 2532 402730 realloc 2532->2553 2533 403900 4 API calls 2533->2553 2534 403950 3 API calls 2534->2553 2535 402510 8 API calls 2535->2553 2536 402ded free 2537 402e6d free 2536->2537 2536->2553 2542 402b43 2537->2542 2538 402790 2 API calls 2538->2536 2539 402e56 2541 402e5c free 2539->2541 2541->2537 2541->2541 2543 403740 15 API calls 2543->2553 2544 402e90 memcpy 2544->2553 2545 402a14 memcpy strlen 2545->2553 2546 402e3d free 2546->2537 2546->2539 2547 402986 strlen 2547->2553 2548 402f31 _errno 2548->2553 2549 402a79 _strdup 2549->2553 2550 402f65 malloc 2550->2553 2551 402ac3 strcoll 2551->2553 2552 402ae5 _stricoll 2552->2553 2553->2532 2553->2533 2553->2534 2553->2535 2553->2536 2553->2538 2553->2539 2553->2543 2553->2544 2553->2545 2553->2546 2553->2547 2553->2548 2553->2549 2553->2550 2553->2551 2553->2552 2554 402af9 malloc 2553->2554 2554->2553 2640 401fd7 2643 401f2c 2640->2643 2641 401f95 2642 401fd0 2641->2642 2644 401dd0 13 API calls 2641->2644 2643->2641 2645 40207b 2643->2645 2648 401f38 2643->2648 2644->2641 2646 401d80 13 API calls 2645->2646 2647 40208b 2646->2647 2648->2642 2649 401f7d 2648->2649 2651 401dd0 13 API calls 2648->2651 2650 401d80 13 API calls 2649->2650 2650->2641 2651->2648 2431 403a59 2432 403a60 2431->2432 2433 403690 3 API calls 2432->2433 2434 403a84 2432->2434 2433->2432 2435 401059 2436 401060 2435->2436 2437 4010b0 signal 2436->2437 2438 401067 2436->2438 2439 4010c9 signal 2437->2439 2442 401050 2437->2442 2440 401072 2438->2440 2441 4010fb signal 2438->2441 2439->2442 2440->2442 2444 401079 signal 2440->2444 2441->2442 2443 40116d signal 2441->2443 2443->2442 2444->2442 2445 401143 signal 2444->2445 2446 4020d0 _fpreset 2445->2446 2446->2442 2447 401c59 2448 401c60 EnterCriticalSection 2447->2448 2449 401c90 LeaveCriticalSection 2448->2449 2451 401c79 2448->2451 2450 401c9f 2449->2450 2451->2449 2452 401c7f free LeaveCriticalSection 2451->2452 2452->2450 2454 402659 2456 402529 2454->2456 2455 402250 6 API calls 2455->2456 2456->2455 2457 4025c0 2456->2457 2459 40258e tolower tolower 2456->2459 2460 4025b2 2456->2460 2458 402510 8 API calls 2457->2458 2457->2460 2458->2457 2459->2456 2461 403159 2462 403180 2461->2462 2463 403172 2461->2463 2464 403194 free 2462->2464 2465 4031ad 2462->2465 2464->2464 2464->2465 2555 403319 2556 403320 2555->2556 2557 40338b wcstombs realloc wcstombs 2556->2557 2562 403400 wcstombs 2556->2562 2558 4034b0 setlocale free 2557->2558 2559 4034c8 2558->2559 2561 4034ac 2561->2558 2562->2558 2562->2561 2652 4028d9 2672 4028e0 2652->2672 2653 402f65 malloc 2653->2672 2654 403900 4 API calls 2654->2672 2655 402e7a free 2657 402b43 2655->2657 2656 403740 15 API calls 2656->2672 2658 403950 3 API calls 2658->2672 2659 402510 8 API calls 2659->2672 2660 402e3d free 2663 402e6d 2660->2663 2664 402e56 2660->2664 2661 402986 strlen 2661->2672 2662 402ded free 2662->2663 2662->2672 2663->2655 2667 402e5c free 2664->2667 2665 402f31 _errno 2665->2672 2666 402790 2 API calls 2666->2662 2667->2663 2667->2667 2668 402e90 memcpy 2668->2672 2669 402a14 memcpy strlen 2669->2672 2670 402730 realloc 2670->2672 2671 402a79 _strdup 2671->2672 2672->2653 2672->2654 2672->2655 2672->2656 2672->2658 2672->2659 2672->2660 2672->2661 2672->2662 2672->2664 2672->2665 2672->2666 2672->2668 2672->2669 2672->2670 2672->2671 2673 402ac3 strcoll 2672->2673 2674 402ae5 _stricoll 2672->2674 2675 402af9 malloc 2672->2675 2673->2672 2674->2672 2675->2672 2159 4012e0 __set_app_type 2164 4011b0 2159->2164 2165 4011dc SetUnhandledExceptionFilter 2164->2165 2166 4011c0 2164->2166 2167 4011f0 2165->2167 2166->2165 2180 4020d0 2167->2180 2171 401202 2172 40120b _setmode _setmode _setmode 2171->2172 2173 40124d __p__fmode 2171->2173 2172->2173 2195 401ec0 2173->2195 2175 40125f 2210 401a40 2175->2210 2177 401267 __p__environ 2214 401460 2177->2214 2179 401288 _cexit ExitProcess 2182 4020e4 2180->2182 2183 4011fd 2180->2183 2181 40212d _fpreset 2181->2183 2182->2181 2182->2183 2184 401510 2183->2184 2185 401526 GetCommandLineA strlen 2184->2185 2192 401806 2184->2192 2190 401547 2185->2190 2187 401815 2187->2171 2188 4015fc 2189 40162f 2188->2189 2224 403070 2188->2224 2189->2171 2190->2188 2190->2189 2193 4016f0 _isctype 2190->2193 2194 403070 75 API calls 2190->2194 2238 4012a0 __getmainargs 2192->2238 2193->2190 2194->2190 2196 401ec9 2195->2196 2200 401ed0 2195->2200 2196->2175 2197 401f95 2198 401fd0 2197->2198 2199 401fa2 2197->2199 2198->2175 2199->2198 2392 401dd0 VirtualQuery 2199->2392 2200->2196 2200->2197 2202 401f38 2200->2202 2203 40207b 2200->2203 2202->2198 2207 401f7d 2202->2207 2209 40200c 2202->2209 2204 401d80 13 API calls 2203->2204 2205 40208b 2204->2205 2206 401dd0 13 API calls 2206->2209 2370 401d80 fwrite vfprintf abort 2207->2370 2209->2202 2209->2206 2211 401a49 2210->2211 2213 4019f0 atexit 2210->2213 2211->2177 2213->2177 2215 401a40 atexit 2214->2215 2216 40146e puts scanf 2215->2216 2217 401497 printf 2216->2217 2218 4014ad 2216->2218 2219 4014ff _getch 2217->2219 2220 4014b6 printf 2218->2220 2221 4014cc 2218->2221 2219->2179 2220->2219 2222 4014d5 printf 2221->2222 2223 4014eb printf 2221->2223 2222->2219 2223->2219 2225 403086 2224->2225 2226 4030a3 2225->2226 2227 403096 2225->2227 2239 4027e0 2226->2239 2293 4021e0 2227->2293 2231 4030b2 2232 4030b9 2231->2232 2233 4030d5 strlen 2231->2233 2232->2192 2234 4030f1 2233->2234 2235 403128 _strdup 2234->2235 2235->2232 2236 403141 2235->2236 2296 402730 realloc 2236->2296 2238->2187 2240 402b50 strlen 2239->2240 2241 4027fa strlen 2239->2241 2253 402b69 2240->2253 2298 402090 2241->2298 2245 402834 2246 4021e0 malloc 2245->2246 2248 402848 2246->2248 2247 402b36 2247->2231 2248->2247 2249 402867 2248->2249 2250 402d3e strlen 2248->2250 2251 4027e0 51 API calls 2249->2251 2258 402d59 2250->2258 2252 40287c 2251->2252 2252->2247 2254 402892 2252->2254 2255 4028ab strlen 2252->2255 2256 402c0c 2253->2256 2264 4027e0 51 API calls 2253->2264 2254->2255 2261 402db6 2254->2261 2260 402da7 2255->2260 2291 4028c0 2255->2291 2256->2231 2257 402d8d _strdup 2257->2247 2259 402d9f 2257->2259 2258->2257 2262 402730 realloc 2259->2262 2260->2253 2267 402faf strlen 2261->2267 2261->2291 2262->2260 2263 40301e 2263->2231 2264->2253 2265 402e7a free 2265->2247 2276 402fc7 2267->2276 2268 402f65 malloc 2268->2291 2269 402e3d free 2272 402e56 2269->2272 2273 402e6d 2269->2273 2270 402986 strlen 2279 4029b0 2270->2279 2277 402e5c free 2272->2277 2273->2265 2274 402f31 _errno 2274->2291 2275 402ded free 2275->2273 2275->2291 2278 402fee _strdup 2276->2278 2277->2273 2277->2277 2278->2273 2280 403000 2278->2280 2279->2291 2319 403900 2279->2319 2324 403950 2279->2324 2280->2273 2283 402730 realloc 2280->2283 2283->2273 2284 402730 realloc 2284->2291 2286 402e90 memcpy 2286->2291 2287 402a14 memcpy strlen 2287->2291 2288 402a79 _strdup 2288->2291 2289 402ac3 strcoll 2289->2291 2290 402ae5 _stricoll 2290->2291 2291->2263 2291->2265 2291->2268 2291->2269 2291->2270 2291->2272 2291->2274 2291->2275 2291->2279 2291->2284 2291->2286 2291->2287 2291->2288 2291->2289 2291->2290 2292 402af9 malloc 2291->2292 2329 403740 2291->2329 2343 402510 2291->2343 2350 402790 2291->2350 2292->2291 2294 4021e4 malloc 2293->2294 2295 40220e 2293->2295 2294->2295 2295->2226 2297 40275a 2296->2297 2297->2232 2299 40209d memcpy 2298->2299 2300 4031c0 setlocale 2299->2300 2301 4031e3 _strdup 2300->2301 2302 4031ed setlocale 2300->2302 2301->2302 2303 403210 wcstombs realloc wcstombs setlocale free 2302->2303 2304 403208 2302->2304 2303->2245 2304->2303 2305 403281 mbstowcs 2304->2305 2306 402090 2305->2306 2307 4032b0 mbstowcs 2306->2307 2308 4032f5 2307->2308 2309 4032e1 2307->2309 2310 4033ee 2308->2310 2313 40330d 2308->2313 2309->2308 2311 403520 setlocale free 2309->2311 2310->2303 2312 4034c8 2311->2312 2312->2245 2314 40338b wcstombs realloc wcstombs 2313->2314 2318 403400 wcstombs 2313->2318 2315 4034b0 setlocale free 2314->2315 2315->2312 2317 4034ac 2317->2315 2318->2315 2318->2317 2320 403937 _errno 2319->2320 2321 40390c 2319->2321 2323 40392c 2320->2323 2321->2323 2358 403690 FindNextFileA 2321->2358 2323->2279 2325 403980 _errno 2324->2325 2326 40395c FindClose 2324->2326 2327 40397b 2325->2327 2326->2325 2328 403971 free 2326->2328 2327->2291 2328->2327 2330 403759 2329->2330 2331 4038dc _errno 2329->2331 2332 4038c0 _errno 2330->2332 2333 403762 _fullpath 2330->2333 2334 403878 2331->2334 2332->2334 2336 403783 2333->2336 2334->2291 2335 4038b0 2335->2291 2336->2335 2337 40382a malloc 2336->2337 2338 40384b memcpy 2337->2338 2339 4038cf _errno 2337->2339 2362 4035c0 FindFirstFileA 2338->2362 2339->2334 2342 4038eb free 2342->2334 2345 402529 2343->2345 2344 402250 6 API calls 2344->2345 2345->2344 2346 4025c0 2345->2346 2348 40258e tolower tolower 2345->2348 2349 4025b2 2345->2349 2347 402510 6 API calls 2346->2347 2346->2349 2347->2346 2348->2345 2349->2291 2351 40279f 2350->2351 2353 4027a4 2350->2353 2352 402790 realloc 2351->2352 2352->2353 2354 4027af 2353->2354 2356 402730 realloc 2353->2356 2355 4027bd free 2354->2355 2357 402790 realloc 2354->2357 2355->2275 2356->2354 2357->2355 2359 403712 GetLastError 2358->2359 2361 4036b3 2358->2361 2360 40371c _errno 2359->2360 2359->2361 2360->2323 2361->2323 2363 40363e _errno GetLastError 2362->2363 2368 4035e4 2362->2368 2364 403651 _errno 2363->2364 2365 403682 _errno 2363->2365 2366 403675 _errno 2364->2366 2367 40365e _errno 2364->2367 2365->2368 2366->2368 2367->2368 2369 403668 _errno 2367->2369 2368->2334 2368->2342 2369->2368 2371 401dd0 VirtualQuery 2370->2371 2372 401e00 2371->2372 2373 401ea8 2371->2373 2374 401e0e memcpy 2372->2374 2376 401e30 VirtualProtect memcpy 2372->2376 2375 401d80 5 API calls 2373->2375 2381 401ec0 2373->2381 2377 401e1e 2374->2377 2375->2381 2376->2377 2379 401e78 2376->2379 2377->2197 2378 401ec9 2378->2197 2379->2377 2380 401e7d VirtualProtect 2379->2380 2380->2197 2381->2378 2384 40207b 2381->2384 2385 401f95 2381->2385 2388 401f38 2381->2388 2382 401fd0 2382->2197 2383 401dd0 5 API calls 2383->2385 2386 401d80 5 API calls 2384->2386 2385->2382 2385->2383 2387 40208b 2386->2387 2388->2382 2389 401f7d 2388->2389 2390 401dd0 VirtualQuery memcpy VirtualProtect memcpy VirtualProtect 2388->2390 2391 401d80 5 API calls 2389->2391 2390->2388 2391->2385 2393 401e00 2392->2393 2394 401ea8 2392->2394 2395 401e0e memcpy 2393->2395 2397 401e30 VirtualProtect memcpy 2393->2397 2396 401d80 8 API calls 2394->2396 2402 401ec0 2394->2402 2398 401e1e 2395->2398 2396->2402 2397->2398 2400 401e78 2397->2400 2398->2199 2399 401ec9 2399->2199 2400->2398 2401 401e7d VirtualProtect 2400->2401 2401->2199 2402->2399 2405 40207b 2402->2405 2406 401f95 2402->2406 2409 401f38 2402->2409 2403 401fd0 2403->2199 2404 401dd0 8 API calls 2404->2406 2407 401d80 8 API calls 2405->2407 2406->2403 2406->2404 2408 40208b 2407->2408 2409->2403 2410 401dd0 8 API calls 2409->2410 2411 401f7d 2409->2411 2410->2409 2412 401d80 8 API calls 2411->2412 2412->2406 2466 401a60 2467 401a6c 2466->2467 2468 401a70 2467->2468 2471 401ce0 2467->2471 2470 401a98 2472 401d33 2471->2472 2476 401cec 2471->2476 2473 401d50 InitializeCriticalSection 2472->2473 2474 401d3c 2472->2474 2473->2474 2474->2470 2475 401cfc 2475->2470 2476->2475 2481 401d05 2476->2481 2482 401b50 EnterCriticalSection 2476->2482 2477 401d18 DeleteCriticalSection 2477->2475 2478 401b50 4 API calls 2480 401d0e 2478->2480 2480->2475 2480->2477 2481->2475 2481->2478 2481->2480 2483 401b9b LeaveCriticalSection 2482->2483 2485 401b6e 2482->2485 2483->2481 2484 401b70 TlsGetValue GetLastError 2484->2485 2485->2483 2485->2484 2567 403a27 2568 403a90 _errno 2567->2568 2569 403a41 2567->2569 2574 4039a0 2569->2574 2571 403a84 2572 403a49 2572->2571 2573 403690 3 API calls 2572->2573 2573->2572 2575 4039c1 _errno 2574->2575 2576 4039ac FindClose 2574->2576 2578 4039cc 2575->2578 2576->2575 2577 4039d1 2576->2577 2579 4035c0 8 API calls 2577->2579 2578->2572 2579->2578 2676 4010e7 2677 4010f0 2676->2677 2678 401050 2677->2678 2679 4010fb signal 2677->2679 2679->2678 2680 40116d signal 2679->2680 2680->2678 2486 402d69 2487 402d70 _strdup 2486->2487 2489 402b36 2487->2489 2490 402d9f 2487->2490 2491 402730 realloc 2490->2491 2493 402bc5 2491->2493 2492 402c0c 2493->2492 2494 4027e0 73 API calls 2493->2494 2494->2493 2495 401d69 2496 401d70 2495->2496 2497 401b50 4 API calls 2496->2497 2498 401d0e 2497->2498 2499 401d18 DeleteCriticalSection 2498->2499 2500 401cfc 2498->2500 2499->2500 2580 401e29 2581 401e30 VirtualProtect memcpy 2580->2581 2582 401e78 2581->2582 2583 401e1e 2581->2583 2582->2583 2584 401e7d VirtualProtect 2582->2584 2585 401329 _onexit 2718 401aa9 2719 401ac2 2718->2719 2720 401ce0 6 API calls 2719->2720 2721 401ad6 2719->2721 2720->2721 2722 401ca9 2723 401cb0 free LeaveCriticalSection 2722->2723 2725 401c9f 2723->2725 2681 4019ec 2683 4019f0 atexit 2681->2683 2726 4016ac 2729 401580 2726->2729 2727 4015fc 2728 40162f 2727->2728 2730 403070 75 API calls 2727->2730 2729->2727 2729->2728 2733 4016f0 _isctype 2729->2733 2735 403070 75 API calls 2729->2735 2731 401806 2730->2731 2736 4012a0 __getmainargs 2731->2736 2733->2729 2734 401815 2735->2729 2736->2734 2586 401430 2587 40143f 2586->2587 2588 401451 FreeLibrary 2587->2588 2589 40145c 2587->2589 2588->2589 2737 401bb0 2738 401bd0 calloc 2737->2738 2739 401bc0 2737->2739 2738->2739 2740 401bea EnterCriticalSection LeaveCriticalSection 2738->2740 2739->2738 2590 401c32 2591 401c60 EnterCriticalSection 2590->2591 2592 401c51 2590->2592 2593 401c90 LeaveCriticalSection 2591->2593 2595 401c79 2591->2595 2592->2591 2594 401c9f 2593->2594 2595->2593 2597 401c7f free LeaveCriticalSection 2595->2597 2597->2594 2501 403179 2502 403180 2501->2502 2503 403194 free 2502->2503 2504 4031ad 2502->2504 2503->2503 2503->2504 2684 4033f9 2689 403400 wcstombs 2684->2689 2686 4034b0 setlocale free 2688 4034c8 2686->2688 2687 4034ac 2687->2686 2689->2686 2689->2687 2690 401ff9 2692 401f38 2690->2692 2691 401fd0 2692->2691 2693 401f7d 2692->2693 2694 401dd0 13 API calls 2692->2694 2695 401d80 13 API calls 2693->2695 2694->2692 2697 401f95 2695->2697 2696 401dd0 13 API calls 2696->2697 2697->2691 2697->2696 2698 4039f9 2699 403a15 _errno 2698->2699 2700 403a0b 2698->2700 2699->2700 2505 401a7c 2506 401a80 2505->2506 2507 401ce0 6 API calls 2506->2507 2508 401a98 2507->2508 2598 40183c 2607 401580 2598->2607 2599 403070 75 API calls 2599->2607 2600 4015fc 2600->2600 2601 40162f 2600->2601 2602 403070 75 API calls 2600->2602 2603 401806 2602->2603 2608 4012a0 __getmainargs 2603->2608 2605 4016f0 _isctype 2605->2607 2606 401815 2607->2599 2607->2600 2607->2601 2607->2605 2608->2606 2741 4038bc 2742 4038c0 _errno 2741->2742 2743 403891 2742->2743 2744 402bbc 2747 402bc0 2744->2747 2745 402c0c 2746 4027e0 73 API calls 2746->2747 2747->2745 2747->2746

    Executed Functions

    Function 004035C0 Relevance: 12.1, APIs: 8, Instructions: 64fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 345 4035c0-4035e2 FindFirstFileA 346 4035e4-4035ef 345->346 347 40363e-40364f _errno GetLastError 345->347 350 403603-40360f 346->350 348 403651-40365c _errno 347->348 349 403682-40368d _errno 347->349 353 403675-403680 _errno 348->353 354 40365e-403666 _errno 348->354 355 403623-40362d 349->355 351 4035f1-403600 350->351 352 403611-40361a 350->352 351->350 356 403630-40363d 352->356 357 40361c 352->357 353->355 354->355 358 403668-403673 _errno 354->358 357->355 358->355
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _errno$ErrorFileFindFirstLast
    • String ID:
    • API String ID: 2068755524-0
    • Opcode ID: 669f1757dc3b3fc43b26ff937e4f10940cf2c93c3446a07653364a7d88f5781a
    • Instruction ID: 371098f65dc1a003ad173e09b32eff5aa51a7c338e23a89b072d8afb899e72e3
    • Opcode Fuzzy Hash: 669f1757dc3b3fc43b26ff937e4f10940cf2c93c3446a07653364a7d88f5781a
    • Instruction Fuzzy Hash: BC11C370504281AADB20AF6598813A67FA89F0230AF14497BE455EF3C2D23D8A45C77A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004011B0 Relevance: 12.1, APIs: 8, Instructions: 59COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _setmode$ExceptionExitFilterProcessUnhandled__p__environ__p__fmode_cexit
    • String ID:
    • API String ID: 3476844589-0
    • Opcode ID: 53db8dd73e4143d63e2a8ba2970246ce225b7af6a3196907f6d323f87185455c
    • Instruction ID: d72e2ffdaedad33e1947e8f101b4d3e94a853f7d9ce34c840223ef1d40754608
    • Opcode Fuzzy Hash: 53db8dd73e4143d63e2a8ba2970246ce225b7af6a3196907f6d323f87185455c
    • Instruction Fuzzy Hash: 6621BEB49083009FC700FF79D58571A7BF4BB44749F01893EF984A73A2D638E9408B5A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004027E0 Relevance: 40.9, APIs: 22, Strings: 1, Instructions: 645stringCOMMON
    Download Yara Rule
    APIs
    • strlen.MSVCRT ref: 00402800
    • memcpy.MSVCRT ref: 00402827
      • Part of subcall function 004031C0: setlocale.MSVCRT ref: 004031D8
      • Part of subcall function 004031C0: _strdup.MSVCRT ref: 004031E6
      • Part of subcall function 004031C0: setlocale.MSVCRT ref: 004031FC
      • Part of subcall function 004031C0: wcstombs.MSVCRT ref: 00403227
      • Part of subcall function 004031C0: realloc.MSVCRT ref: 0040323B
      • Part of subcall function 004031C0: wcstombs.MSVCRT ref: 00403254
      • Part of subcall function 004031C0: setlocale.MSVCRT ref: 00403264
      • Part of subcall function 004031C0: free.MSVCRT ref: 0040326C
      • Part of subcall function 004021E0: malloc.MSVCRT ref: 004021FB
    • strlen.MSVCRT ref: 00402B56
    • strlen.MSVCRT ref: 00402D46
    • _strdup.MSVCRT ref: 00402D90
      • Part of subcall function 004027E0: strlen.MSVCRT ref: 004028B1
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: strlen$setlocale$_strdupwcstombs$freemallocmemcpyrealloc
    • String ID: \
    • API String ID: 3818432545-2967466578
    • Opcode ID: bf2e9a33ee385246a5e726968e2670ed68b512822a645633e983a226808f4b2c
    • Instruction ID: f7c4d56a1def01e487e18b97462b6953fd953782c94f2c8c6698f02ec31ec9fb
    • Opcode Fuzzy Hash: bf2e9a33ee385246a5e726968e2670ed68b512822a645633e983a226808f4b2c
    • Instruction Fuzzy Hash: 1342A070E082598FDB10DF69C6883AEBBF1AF45304F18807BD885BB3C1D6B89946DB55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004031C0 Relevance: 27.3, APIs: 18, Instructions: 272COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 194 4031c0-4031e1 setlocale 195 4031e3-4031eb _strdup 194->195 196 4031ed-403206 setlocale 194->196 195->196 197 403210-403280 wcstombs realloc wcstombs setlocale free 196->197 198 403208-40320e 196->198 198->197 199 403281-4032df mbstowcs call 402090 mbstowcs 198->199 202 403300-403307 199->202 203 4032e1-4032e5 199->203 206 40330d-403314 202->206 207 4033ee-4033f1 202->207 204 403507-40350f 203->204 205 4032eb-4032ef 203->205 204->202 208 403515-40351a 204->208 205->204 209 4032f5-4032fa 205->209 210 403320-403326 206->210 211 403334-403338 206->211 207->197 208->202 213 403520-40353b setlocale free 208->213 209->202 214 40354f-40355d 209->214 212 40333a-403343 210->212 215 403328-403332 210->215 211->210 211->212 216 403351-403355 212->216 217 403345-40334f 212->217 218 4034c8-4034d4 213->218 214->202 215->211 219 40336a-40336d 215->219 216->217 220 403357-40335a 216->220 217->216 217->217 221 403400-403406 219->221 222 403373-40337b 219->222 220->219 223 40335c-403368 220->223 224 40340c-403416 221->224 225 40356d 221->225 226 403381-403385 222->226 227 403562-403565 222->227 223->211 223->219 224->221 228 403418-40341c 224->228 229 403573-40357b 225->229 230 40341e-40342d 225->230 226->227 231 40338b-4033e9 wcstombs realloc wcstombs 226->231 227->225 228->221 228->230 232 403587-40358f 229->232 233 40357d-403581 229->233 234 403440-40344a 230->234 235 40342f-403433 230->235 236 4034b0-4034c3 setlocale free 231->236 232->230 239 403595-40359d 232->239 233->230 233->232 234->234 240 40344c-403450 234->240 237 403439 235->237 238 40353d-403541 235->238 236->218 237->234 241 403547-40354a 238->241 242 40345f 238->242 239->230 243 4035a3-4035a7 239->243 240->234 244 403452-403459 240->244 245 403461 241->245 242->245 243->230 246 4035ad-4035af 243->246 244->238 244->242 247 403463-403466 245->247 246->230 248 403468-403473 247->248 249 403489-4034aa wcstombs 247->249 250 403475-40347c 248->250 251 4034d7-4034de 248->251 249->236 252 4034ac 249->252 253 4034d5 250->253 254 40347e-403487 250->254 255 4034f0-4034fa 251->255 256 4034e0-4034e4 251->256 252->236 253->251 254->248 254->249 255->255 258 4034fc-403500 255->258 256->247 257 4034ea 256->257 257->255 258->255 259 403502 258->259 259->247
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: setlocalewcstombs$free$mbstowcsrealloc$_strdup
    • String ID:
    • API String ID: 2891164732-0
    • Opcode ID: a5c146f895751ce46dd296d5b494c651f26ac00f9944b822d7e0999137e2a235
    • Instruction ID: 40adb021d158c18649ece7a37feb0e941fc87d5bd5ad69d9897163f11d1d1676
    • Opcode Fuzzy Hash: a5c146f895751ce46dd296d5b494c651f26ac00f9944b822d7e0999137e2a235
    • Instruction Fuzzy Hash: 79B192709042119ACB20AF69C04527BFFF9EF54746F45843FE884AB395D37C9A81CB8A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401460 Relevance: 21.0, APIs: 7, Strings: 5, Instructions: 43COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 260 401460-401495 call 401a40 puts scanf 263 401497-4014ab printf 260->263 264 4014ad-4014b4 260->264 265 4014ff-40150a _getch 263->265 266 4014b6-4014ca printf 264->266 267 4014cc-4014d3 264->267 266->265 268 4014d5-4014e9 printf 267->268 269 4014eb-4014fa printf 267->269 268->265 269->265
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: printf$_getchputsscanf
    • String ID: Congratulations You Score B$Congratulations You Scored A$Congratulations You Scored A+$Enter Your marks : $You Score
    • API String ID: 2115921670-2025592187
    • Opcode ID: b932db7c7a7741f3e8838323fa253a3ec55f060c6d651820103ab23b3ea54cd4
    • Instruction ID: 42c9d011f56b38aebb2e94b059ef6975df2774cab68e3f7eeea72dc63eafc9e5
    • Opcode Fuzzy Hash: b932db7c7a7741f3e8838323fa253a3ec55f060c6d651820103ab23b3ea54cd4
    • Instruction Fuzzy Hash: 5E0163B45086018FC310FF69818251EBAE9AF84704F11883FF5D4E7392D778E9459B5B
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401510 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 257stringCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 270 401510-401520 271 401810-40181c call 4012a0 270->271 272 401526-401579 GetCommandLineA strlen call 402090 270->272 277 401580-40158b 272->277 278 401600-401602 277->278 279 40158d-401590 277->279 280 4018a1 278->280 281 401608-40160a 278->281 282 401723-401728 279->282 283 401596 279->283 294 4018a8 280->294 284 401610-401619 281->284 287 40187c-40188c 282->287 288 40172e-40173e 282->288 285 401650-401653 283->285 286 40159c-40159f 283->286 284->284 289 40161b-40161e 284->289 290 401743-401747 285->290 291 401659-40165c 285->291 292 401755-40175c 286->292 293 4015a5-4015a8 286->293 298 401893 287->298 295 401680-401689 288->295 296 4017e2-401801 call 403070 289->296 297 401624-401629 289->297 302 401831-401837 290->302 303 40174d-401750 290->303 291->282 299 401662-401665 291->299 304 4016c0-4016c5 292->304 305 401762-401766 292->305 293->282 300 4015ae-4015b1 293->300 301 401690-401699 295->301 318 401806 296->318 297->296 308 40162f-401649 297->308 315 40189a 298->315 299->304 309 401667-40166e 299->309 300->304 310 4015b7-4015bb 300->310 301->301 312 40169b-40169d 301->312 302->277 303->277 304->298 307 4016cb-4016cc 304->307 305->294 306 40176c-40176e 305->306 313 401770-401779 306->313 314 4016d0-4016d9 307->314 309->282 316 401674-40167e 309->316 310->315 317 4015c1 310->317 319 4016b0 312->319 320 40169f-4016a6 312->320 313->313 322 40177b-40177f 313->322 314->314 323 4016db-4016e0 314->323 315->280 316->295 321 4016b2-4016b8 316->321 324 4015c3-4015cc 317->324 318->271 319->321 320->277 321->320 325 401785-401787 322->325 326 40181d-40182c 322->326 327 4016e2-4016ea 323->327 328 401717-40171e 323->328 324->324 329 4015ce-4015d2 324->329 325->326 330 40178d-40179c 325->330 326->277 331 4016f0-401705 _isctype 327->331 332 4017b5-4017c0 327->332 328->277 333 4017a1-4017b0 329->333 334 4015d8-4015da 329->334 330->277 335 4017c6-4017c9 331->335 336 40170b 331->336 332->335 337 40170e-401711 332->337 333->277 334->333 338 4015e0-4015fa 334->338 339 401840-401877 call 403070 335->339 340 4017cb-4017d0 335->340 336->337 337->328 337->335 338->279 341 4015fc 338->341 339->277 340->339 343 4017d2-4017dd 340->343 341->278 343->277
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CommandLinestrlen
    • String ID: "$'$'$*$?$@$[$\
    • API String ID: 3702654222-871974141
    • Opcode ID: 54248f7eee61f554d6b1e29ceea7301c96936e32eabb161f69548cf2e2d0d1d5
    • Instruction ID: 649cefbd34846f052767c5fe26fc9bc87414e0295a4b6ecd7b0744b1a0c35929
    • Opcode Fuzzy Hash: 54248f7eee61f554d6b1e29ceea7301c96936e32eabb161f69548cf2e2d0d1d5
    • Instruction Fuzzy Hash: 89A1B131A153059FDB14CF68C8447AEBBE5BB84344F18893BE805BB3E1E73DA8458B59
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 377 403070-403084 378 403086-40308c 377->378 379 40308e-403094 377->379 378->379 380 4030c3-4030ca 378->380 381 4030a3-4030ad call 4027e0 379->381 382 403096-40309d call 4021e0 379->382 380->379 386 4030b2-4030b7 381->386 382->381 387 4030d0-4030d3 386->387 388 4030b9-4030c2 386->388 387->388 389 4030d5-4030fc strlen call 402090 387->389 392 40310d-403112 389->392 393 403100-40310b 392->393 394 403114-403126 392->394 393->392 395 403128-40313b _strdup 393->395 394->392 394->395 395->388 396 403141-40314e call 402730 395->396 396->388
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID: glob-1.0-mingw32
    • API String ID: 0-3253302226
    • Opcode ID: 91db1f21d5caf0d1092b715b71575d704ead6d3f3ef464a9053aa9f2822a6975
    • Instruction ID: 0bf6c4ba439b1e656da5ce24ac592a0af884758246d5de274d7322822dc00290
    • Opcode Fuzzy Hash: 91db1f21d5caf0d1092b715b71575d704ead6d3f3ef464a9053aa9f2822a6975
    • Instruction Fuzzy Hash: 4A2192B1E053148BCB109F65D8412AFBFA9EB84345F04457FD8817B385D77D9A01CB9A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403690 Relevance: 4.6, APIs: 3, Instructions: 53fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 399 403690-4036b1 FindNextFileA 400 403712-40371a GetLastError 399->400 401 4036b3-4036be 399->401 403 40371c-403731 _errno 400->403 404 4036ee-4036f8 400->404 402 4036d2-4036de 401->402 405 4036c0-4036cf 402->405 406 4036e0-4036e9 402->406 407 403700-403711 404->407 405->402 406->407 408 4036eb 406->408 408->404
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: ErrorFileFindLastNext_errno
    • String ID:
    • API String ID: 2804278807-0
    • Opcode ID: 919dca5208603c892f2dbd29dad48e6ee4ea88f39cc7174e3d1124df62c65a3b
    • Instruction ID: 2948ca51cbe3ba5848bda780a5274403fb83759a178190ed3841c296b90d70ed
    • Opcode Fuzzy Hash: 919dca5208603c892f2dbd29dad48e6ee4ea88f39cc7174e3d1124df62c65a3b
    • Instruction Fuzzy Hash: 9701CCB11142508BDF20AF69AC813A6BBA4AB41316F048877E854CF386D13DC948C3A5
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403950 Relevance: 4.5, APIs: 3, Instructions: 21COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 409 403950-40395a 410 403980-403990 _errno 409->410 411 40395c-40396f FindClose 409->411 412 40397b-40397f 410->412 411->410 413 403971-403979 free 411->413 413->412
    APIs
    • FindClose.KERNEL32(?,?,?,?,?,00402DDB), ref: 00403965
    • free.MSVCRT(?,?,?,?,?,?,00402DDB), ref: 00403974
    • _errno.MSVCRT ref: 00403980
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CloseFind_errnofree
    • String ID:
    • API String ID: 1660445202-0
    • Opcode ID: ebdf78731baae18c225b6199ab28957a3a1a6b78532bce2a1df12eb213fd9001
    • Instruction ID: fffb0495af5d0f490038b68a1280320a6fee90704095772e495875c0c9d0a5c4
    • Opcode Fuzzy Hash: ebdf78731baae18c225b6199ab28957a3a1a6b78532bce2a1df12eb213fd9001
    • Instruction Fuzzy Hash: E3E04FB06002005BC7007F75888262A7AAC6B00319F500A7EEC90AB3C3E67DD6448796
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004012E0 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
    Download Yara Rule

    Control-flow Graph

    APIs
    • __set_app_type.MSVCRT ref: 004012EA
      • Part of subcall function 004011B0: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,004012F5), ref: 004011E3
      • Part of subcall function 004011B0: _setmode.MSVCRT ref: 00401220
      • Part of subcall function 004011B0: _setmode.MSVCRT ref: 00401234
      • Part of subcall function 004011B0: _setmode.MSVCRT ref: 00401248
      • Part of subcall function 004011B0: __p__fmode.MSVCRT ref: 0040124D
      • Part of subcall function 004011B0: __p__environ.MSVCRT ref: 00401267
      • Part of subcall function 004011B0: _cexit.MSVCRT ref: 0040128A
      • Part of subcall function 004011B0: ExitProcess.KERNEL32(?,?,?,?,?,004012F5), ref: 00401292
    • __set_app_type.MSVCRT ref: 0040130A
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _setmode$__set_app_type$ExceptionExitFilterProcessUnhandled__p__environ__p__fmode_cexit
    • String ID:
    • API String ID: 2461648636-0
    • Opcode ID: 2c9611c86d375737f3294eaaae10524f5bae7ae70e105ff36550091d33167dda
    • Instruction ID: bf46d9fc090ff86c76a88e5dd760ab8fd44dbb74fc9dad89e7279624f68ad66e
    • Opcode Fuzzy Hash: 2c9611c86d375737f3294eaaae10524f5bae7ae70e105ff36550091d33167dda
    • Instruction Fuzzy Hash: B7D04C314105118FD7047F64C905399B774BF04304F45062CD5953B051CBB835568BD5
    Uniqueness

    Uniqueness Score: -1.00%

    Non-executed Functions

    Function 00401340 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 58libraryloaderCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 419 401340-401359 GetModuleHandleA 420 401410-40141f 419->420 421 40135f-40139d LoadLibraryA GetProcAddress * 2 419->421 422 4013a2-4013a4 420->422 421->422 423 4013a6-4013ae 422->423 424 4013b7-4013be 422->424 423->424 425 4013c0-4013d6 GetModuleHandleA 424->425 426 4013fa-40140c atexit 424->426 427 4013d8-4013eb GetProcAddress 425->427 428 4013ed-4013ef 425->428 427->428 428->426 429 4013f1 428->429 429->426
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: AddressProc$HandleModule$LibraryLoadatexit
    • String ID: _Jv_RegisterClasses$__deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll$libgcj-16.dll
    • API String ID: 2016387483-548026336
    • Opcode ID: 0b8aade3fde43aa36ae309f32731af7b31cb5136b079e8ceea5029fc56d28762
    • Instruction ID: 3d7346ee2e00a71030f91a6f464cef648dbeafef80c9a26da859abf06b3d38f9
    • Opcode Fuzzy Hash: 0b8aade3fde43aa36ae309f32731af7b31cb5136b079e8ceea5029fc56d28762
    • Instruction Fuzzy Hash: 32114CB18146008AD3107F79A54531FBEE8EB80358F41C93FD984B76E6E77C95488B9B
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004018B0 Relevance: .1, Instructions: 78COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: c109b914e246866c18af00eae8f597a565d5c7776f425b395473f41a8873c9e7
    • Instruction ID: 3b19c15fdec688c81ddd56327c215687e0bc839a41b3c63a712ba846f9e5dd49
    • Opcode Fuzzy Hash: c109b914e246866c18af00eae8f597a565d5c7776f425b395473f41a8873c9e7
    • Instruction Fuzzy Hash: 8A21E9B891830206F375812D45A4B976596AB88314F14CF3EDD89F23F5E6BDCC84D25D
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401D80 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 84memoryfileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 430 401d80-401dfa fwrite vfprintf abort VirtualQuery 432 401e00-401e07 430->432 433 401ea8-401eb4 430->433 434 401e09-401e0c 432->434 435 401e0e-401e19 memcpy 432->435 436 401ec0-401ec7 433->436 437 401ebb call 401d80 433->437 434->435 438 401e30-401e76 VirtualProtect memcpy 434->438 439 401e1e-401e25 435->439 440 401ed0-401ee7 436->440 441 401ec9 436->441 437->436 438->439 443 401e78-401e7b 438->443 440->441 442 401ee9-401ef2 440->442 444 401fe0 442->444 445 401ef8-401f00 442->445 443->439 446 401e7d-401ea7 VirtualProtect 443->446 449 401fe5-401fe9 444->449 447 401f95 445->447 448 401f06-401f0e 445->448 450 401f9a-401fa0 447->450 448->447 451 401f14-401f21 448->451 449->450 452 401feb-401ff0 449->452 453 401fd0-401fd6 450->453 454 401fa2-401fce call 401dd0 450->454 451->449 455 401f27 451->455 456 401ff6 452->456 457 401f2c-401f32 452->457 454->453 455->457 456->450 459 401f38-401f41 457->459 460 40207b-40208b call 401d80 457->460 459->453 463 401f47-401f65 459->463 465 402000-40200a 463->465 466 401f6b-401f6e 463->466 469 402012-402028 call 401dd0 465->469 470 40200c 465->470 467 402060-402076 call 401dd0 466->467 468 401f74-401f77 466->468 467->459 472 402030-402037 468->472 473 401f7d-401f90 call 401d80 468->473 469->459 470->469 477 402039 472->477 478 40203f-402055 call 401dd0 472->478 473->447 477->478 478->459
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: Virtual$Protectmemcpy$Queryabortfwritevfprintf
    • String ID: @$Mingw runtime failure:
    • API String ID: 978211760-2549925133
    • Opcode ID: c895ff84ac444e6cb333387a194e1dbaee8a351f515177a3a79ebc2bdf5cba8d
    • Instruction ID: b07010e80c18f83a3b6a9e7b97a0af10a0527475b5fc3be1fb31c7d97c7871fc
    • Opcode Fuzzy Hash: c895ff84ac444e6cb333387a194e1dbaee8a351f515177a3a79ebc2bdf5cba8d
    • Instruction Fuzzy Hash: 1331D8B1908300ABD700EF29C18455EBFE4FB88758F54892EF888A7351D378E944CF86
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401000 Relevance: 12.1, APIs: 8, Instructions: 82COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 482 401000-401010 483 401060-401065 482->483 484 401012-401017 482->484 487 4010b0-4010c7 signal 483->487 488 401067-40106c 483->488 485 401079-401090 signal 484->485 486 401019-40101e 484->486 489 401096-401098 485->489 495 401143-401168 signal call 4020d0 485->495 491 4010f0-4010f5 486->491 492 401024-40103b signal 486->492 487->489 490 4010c9-4010e2 signal 487->490 493 401072-401077 488->493 494 4010fb-401112 signal 488->494 497 401050 489->497 502 40109a-4010a8 489->502 496 401052-401055 490->496 491->494 491->497 498 401041-401043 492->498 499 401189-4011a0 signal 492->499 493->485 493->497 500 401114-401116 494->500 501 40116d-401184 signal 494->501 495->496 497->496 504 401130-40113e 498->504 505 401049 498->505 499->496 500->497 506 40111c-40112a 500->506 501->496 502->496 504->496 505->497 506->496
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: signal
    • String ID:
    • API String ID: 1946981877-0
    • Opcode ID: de9cbfd1ef1e3ceb9d3ee9bd81d224a2f75af3acbc53af3d901795d048397e0b
    • Instruction ID: d891a4db85e30001896d3fbe297763bf09acc41f283bfb92fe67324157bb9c9e
    • Opcode Fuzzy Hash: de9cbfd1ef1e3ceb9d3ee9bd81d224a2f75af3acbc53af3d901795d048397e0b
    • Instruction Fuzzy Hash: EC31F0701042409AD7107F68C55032F76D4BF46328F114A2FE5EAA77E1C7BE99C49B5B
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403740 Relevance: 10.6, APIs: 7, Instructions: 121COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 511 403740-403753 512 403759-40375c 511->512 513 4038dc-4038e9 _errno 511->513 514 4038c0-4038cd _errno 512->514 515 403762-403781 _fullpath 512->515 516 403891-40389d 513->516 514->516 517 4037d0-4037e5 515->517 518 403783-403798 515->518 517->517 520 4037e7-4037ed 517->520 518->518 519 40379a-4037a0 518->519 521 4038b0-4038b6 519->521 522 4037a6-4037b7 519->522 523 4038a0-4038a6 520->523 524 4037f3-4037fa 520->524 525 4037b9-4037bc 522->525 526 4037fc-403803 522->526 523->524 524->526 525->526 527 4037be-4037ca 525->527 528 403807-40381b 526->528 527->526 528->528 529 40381d-403822 528->529 530 403824-403827 529->530 531 40382a-403845 malloc 529->531 530->531 532 40384b-403876 memcpy call 4035c0 531->532 533 4038cf-4038da _errno 531->533 536 403878-40388d 532->536 537 4038eb-4038f5 free 532->537 533->516 536->516 537->516
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _errno$_fullpathmallocmemcpy
    • String ID:
    • API String ID: 3274612330-0
    • Opcode ID: 7da50a46ac18c5c2f6b33e12b133f3965081750469ead042506ea48951c81455
    • Instruction ID: 4af33658bb00c89703334fbe9a8fdcefb4a966d9eed4752abe242e6eff333988
    • Opcode Fuzzy Hash: 7da50a46ac18c5c2f6b33e12b133f3965081750469ead042506ea48951c81455
    • Instruction Fuzzy Hash: 4341B9B12146048BE314AF29C8463ABBFE9EF8130AF08857FE484D73D5D67C9649C756
    Uniqueness

    Uniqueness Score: -1.00%

    Function 004028D9 Relevance: 9.2, APIs: 6, Instructions: 173stringCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 538 4028d9 539 4028e0-4028e9 538->539 540 402f5a-402f5d 539->540 541 4028ef-4028f2 539->541 543 402f65-402f73 malloc 540->543 541->540 542 4028f8-4028fd 541->542 542->539 544 4028ff-40290f 542->544 545 402f79-402f89 543->545 546 402e2b-402e2e 543->546 547 402911-402913 544->547 548 402919-402920 544->548 549 402f13-402f16 545->549 550 4029b0-4029bc call 403900 546->550 547->548 551 402f8b-402f95 547->551 552 402924-402936 548->552 549->546 560 4029c2-4029c7 550->560 561 402dd3-402de0 call 403950 550->561 554 402946-402963 551->554 555 402922 552->555 556 402938-402943 552->556 558 402969-402975 call 403740 554->558 559 402e7a-402e88 free 554->559 555->552 556->554 568 402e33-402e37 558->568 569 40297b-402980 558->569 564 4029c9-4029cd 560->564 565 4029cf-4029e1 call 402510 560->565 577 402de2-402de8 call 402790 561->577 578 402ded-402e03 free 561->578 564->550 564->565 565->550 583 4029e3-402a0e call 402090 565->583 572 402f26-402f2b 568->572 573 402e3d-402e54 free 568->573 574 402986-4029a9 strlen 569->574 575 402efa 569->575 572->578 584 402f31-402f48 _errno 572->584 581 402e56-402e59 573->581 582 402e6d-402e77 573->582 574->550 587 402f06-402f0d 575->587 577->578 579 402e09-402e0d 578->579 580 402f1b-402f21 578->580 579->581 586 402e0f-402e12 579->586 580->559 588 402e5c-402e6b free 581->588 582->559 593 402e90-402eb8 memcpy 583->593 594 402a14-402a4e memcpy strlen call 402090 583->594 584->578 596 402f4e-402f53 584->596 586->558 590 402e20-402e25 586->590 587->546 587->549 588->582 588->588 590->546 595 402eeb-402ef5 call 402730 590->595 598 402ee0-402ee3 593->598 599 402eba-402ebc 593->599 604 402a5d-402a63 594->604 595->546 596->540 598->595 599->598 602 402ebe-402ecc 599->602 605 402ed4-402edb 602->605 606 402a50-402a5b 604->606 607 402a65-402a77 604->607 605->546 606->604 608 402a79-402a87 _strdup 606->608 607->604 607->608 608->605 609 402a8d-402aa6 608->609 609->590 610 402aac-402ab1 609->610 610->543 611 402ab7-402ac1 610->611 612 402ad7-402ae3 611->612 613 402ac3-402acf strcoll 612->613 614 402ae5-402af1 _stricoll 612->614 615 402ad1-402ad3 613->615 616 402af3-402af7 613->616 614->615 614->616 617 402ad5 615->617 618 402af9-402b0d malloc 615->618 616->617 616->618 617->612 618->546 619 402b13-402b28 618->619 619->587 620 402b2e-402b31 619->620 620->546
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: mallocstrlen$_strdup_stricollfreememcpystrcoll
    • String ID:
    • API String ID: 248952651-0
    • Opcode ID: 3f825d32b2822a0950214fdef15d9f8de30d188b35ae9da0f80d9bbbb2ce3ae4
    • Instruction ID: c940cda574fdb61d1a8ddc1332b5a3b6e04917dbaa72d05352c9d3370c8b57a5
    • Opcode Fuzzy Hash: 3f825d32b2822a0950214fdef15d9f8de30d188b35ae9da0f80d9bbbb2ce3ae4
    • Instruction Fuzzy Hash: 74615EB1E046158FDB10DFA9C5887AEBBF5AF44304F08806AD845BB3C1E7B89945CB55
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00402250 Relevance: 7.7, APIs: 6, Instructions: 219COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 621 402250-402269 622 4023d0-4023d4 621->622 623 40226f-402272 621->623 624 402425-40242f 622->624 625 4023d6-4023da 622->625 623->622 626 402278-40228f 623->626 627 402430-402435 624->627 633 4023e2-4023e7 625->633 628 40229e-4022a4 626->628 631 402465-40246f 627->631 632 402437-402439 627->632 629 4023c4-4023cd 628->629 630 4022aa-4022ad 628->630 634 402340-402347 630->634 635 4022b3-4022b5 630->635 636 402450-402452 632->636 637 40243b-402440 632->637 638 4023f0-4023f4 633->638 634->633 642 40234d-402352 634->642 635->629 641 4022bb-4022be 635->641 639 402460-402463 636->639 640 402454-40245b 636->640 637->627 643 402442 637->643 638->641 639->627 640->637 641->629 645 4022c4-4022c7 641->645 642->629 644 402354-402363 642->644 643->629 646 402478 644->646 647 402369-402371 644->647 645->629 648 4022cd-4022dc 645->648 646->641 652 40247e-402484 646->652 649 402384-402389 647->649 650 402291-402299 648->650 651 4022de-402301 tolower * 2 648->651 654 402373-40237c 649->654 655 40238b-4023a5 tolower * 2 649->655 656 402303-40230a 650->656 657 40229b 650->657 651->656 651->657 653 4024a5-4024aa 652->653 658 402490-402499 653->658 659 4024ac-4024c6 tolower * 2 653->659 660 4023a7-4023af 654->660 661 40237e-402382 654->661 655->660 655->661 662 40231e-402321 656->662 657->628 663 4024c8-4024d0 658->663 664 40249b-40249f 658->664 659->663 659->664 665 4023b2-4023b7 660->665 661->638 661->649 662->631 666 402327-40232a 662->666 667 4024d3-4024d8 663->667 664->638 664->653 668 4023b9-4023bb 665->668 669 40241a-402424 665->669 670 402310-402315 666->670 671 40232c-40232e 666->671 667->669 672 4024de-4024e0 667->672 673 402400-402402 668->673 674 4023bd-4023c2 668->674 670->629 675 40231b 670->675 676 402470-402473 671->676 677 402334-40233b 671->677 680 4024f0-4024f2 672->680 681 4024e2-4024e7 672->681 678 402410-402418 673->678 679 402404-40240b 673->679 674->629 674->665 675->662 676->675 677->670 678->668 678->669 679->674 683 402500-402503 680->683 684 4024f4-4024fb 680->684 681->667 682 4024e9 681->682 682->629 683->667 684->681
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: tolower
    • String ID:
    • API String ID: 3025214199-0
    • Opcode ID: 6719ac4daa759019d79bfce8ce04f3372a78dc03506be0be376abf6b3b0c1063
    • Instruction ID: 7938ae60ccf90282a35d1dece3e6afbd4eae6d6882d9831f8228313fa22bf4fa
    • Opcode Fuzzy Hash: 6719ac4daa759019d79bfce8ce04f3372a78dc03506be0be376abf6b3b0c1063
    • Instruction Fuzzy Hash: F8614B7290C3654BC7208E69528823BB7D6AA95308F29057FDCD8B73C1D2BDDD06478E
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00402E17 Relevance: 7.6, APIs: 5, Instructions: 116stringCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: _strdup_stricollmemcpystrlen
    • String ID:
    • API String ID: 2607129539-0
    • Opcode ID: 10194c166aab9f644bf78b6c4f5d2663e036dd8df70d3dc86c71cf3e5e2e0b27
    • Instruction ID: 9a6ffdb9edf4cdc698f360754d8511005578a5416c4149af5aa91ceb33d8cfc2
    • Opcode Fuzzy Hash: 10194c166aab9f644bf78b6c4f5d2663e036dd8df70d3dc86c71cf3e5e2e0b27
    • Instruction Fuzzy Hash: 074158B1A046158FEB20DF65C68476ABBE5AF84304F08803EE846E73C1E7B8D941CB95
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00403319 Relevance: 7.6, APIs: 5, Instructions: 72COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: wcstombs$freereallocsetlocale
    • String ID:
    • API String ID: 3931877334-0
    • Opcode ID: 49c059103394049b7c26c526e13725fb6568a3b4e1352e05fd0d844e3df41df5
    • Instruction ID: 9528a7c7e1963642edba6784e4b6eecba9cec4aa3d5e2047d2aa6cf195f73bac
    • Opcode Fuzzy Hash: 49c059103394049b7c26c526e13725fb6568a3b4e1352e05fd0d844e3df41df5
    • Instruction Fuzzy Hash: 92213D70A042128ACB14EF69C04126BFBF5EF54746F45C47FE888AB395E7395A41CB8A
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401E29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: ProtectVirtual$memcpy
    • String ID: @
    • API String ID: 1565840913-2766056989
    • Opcode ID: 37cc7b31f1e88f7fd985d33849442490a2727a97b4f80a0618785e668ac4f907
    • Instruction ID: 8ecbee79872c90a970716d8d7e8c2dbe2cee1077042f5dd3d471bcaa97f3a684
    • Opcode Fuzzy Hash: 37cc7b31f1e88f7fd985d33849442490a2727a97b4f80a0618785e668ac4f907
    • Instruction Fuzzy Hash: 850152B5608305AFD340EF29C18451EFBE0BBC8758F50892EF898A7355D234EA55CF86
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    • VirtualQuery failed for %d bytes at address %p, xrefs: 00401EB4
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: Virtual$Protectmemcpy$Query
    • String ID: VirtualQuery failed for %d bytes at address %p
    • API String ID: 228986436-2206166143
    • Opcode ID: 382b95ee4e5450d667b0a9e147f3505df596c4f3e4b51953a0c3a314b4e4836e
    • Instruction ID: ce1460d7593363e8c7c595ec3ed0f7062eb867f900c14c878a2e83a9b7478d98
    • Opcode Fuzzy Hash: 382b95ee4e5450d667b0a9e147f3505df596c4f3e4b51953a0c3a314b4e4836e
    • Instruction Fuzzy Hash: BEF01DB15043009AE700AF2AD58451FBEE8AF85794F44883FF888E73A1D778D8448B96
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401C32 Relevance: 5.0, APIs: 4, Instructions: 48COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CriticalSection$EnterLeavefree
    • String ID:
    • API String ID: 4020351045-0
    • Opcode ID: b28d79d2ae087a490513ab2c34ca23639612d7eeaa493a175103de9d073e0e60
    • Instruction ID: d8d8080e6f9e14dbceee176eddbba765e9271608f6b84d07801669502c1d6d9f
    • Opcode Fuzzy Hash: b28d79d2ae087a490513ab2c34ca23639612d7eeaa493a175103de9d073e0e60
    • Instruction Fuzzy Hash: 31011EB1A482018FE700FF74D48562ABBE5BB40304F15867EE945F7392E738E9519B8B
    Uniqueness

    Uniqueness Score: -1.00%

    Function 00401B50 Relevance: 5.0, APIs: 4, Instructions: 33COMMON
    Download Yara Rule
    APIs
    • EnterCriticalSection.KERNEL32(?,?,?,?,00401D75,?,?,?,?,?,?,00401A98), ref: 00401B5C
    • TlsGetValue.KERNEL32(?,?,?,?,?,00401D75,?,?,?,?,?,?,00401A98), ref: 00401B75
    • GetLastError.KERNEL32(?,?,?,?,?,?,00401D75,?,?,?,?,?,?,00401A98), ref: 00401B7F
    • LeaveCriticalSection.KERNEL32(?,?,?,?,?,00401D75,?,?,?,?,?,?,00401A98), ref: 00401BA2
    Memory Dump Source
    • Source File: 00000000.00000002.3225725879.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000000.00000002.3225687026.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225739462.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225753029.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
    • Associated: 00000000.00000002.3225778374.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
    Similarity
    • API ID: CriticalSection$EnterErrorLastLeaveValue
    • String ID:
    • API String ID: 682475483-0
    • Opcode ID: 4a8bf40b5d4a20c4336136f9297d4a5283dd8369256c4447f972f73e295122a5
    • Instruction ID: 4d16860b71b5d85e06f3d7e22a9a031ba67d64ec54dc3716248cb0e71f7e2987
    • Opcode Fuzzy Hash: 4a8bf40b5d4a20c4336136f9297d4a5283dd8369256c4447f972f73e295122a5
    • Instruction Fuzzy Hash: AFF090B19042104ADB10BF7596C561B7AB85E00348F05017AED40AB297E73CB905C6AB
    Uniqueness

    Uniqueness Score: -1.00%