Edit tour

Windows Analysis Report
install_numarkidjliveii+(1).exe

Overview

General Information

Sample name:	install_numarkidjliveii+(1).exe
Analysis ID:	1427202
MD5:	049a333248120d695c0b344f9698de4e
SHA1:	422f821ddbb9c70edd991f8f9d40f3b1e31b49db
SHA256:	92cd9486c31b528a0dd4a3b83aa165454143bf8439ecfc65191a99ed2a4e34f7
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample reads itself and does not show any behavior, likely it performs some host environment checks which are compared to an embedded key

Process Tree

System is w10x64

install_numarkidjliveii+(1).exe (PID: 7308 cmdline: "C:\Users\user\Desktop\install_numarkidjliveii+(1).exe" MD5: 049A333248120D695C0B344F9698DE4E)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: install_numarkidjliveii+(1).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: install_numarkidjliveii+(1).exe

Static PE information: certificate valid

Source: install_numarkidjliveii+(1).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://ocsp.thawte.com0
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://s2.symcb.com0
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://sv.symcd.com0&
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://www.virtualdj.com/0/
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: http://www.winimage.com/zLibDll
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: install_numarkidjliveii+(1).exe	String found in binary or memory: https://d.symcb.com/rpa0

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D7080	0_2_008D7080
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008E541E	0_2_008E541E
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D5C29	0_2_008D5C29
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008DB02A	0_2_008DB02A
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D7C70	0_2_008D7C70
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D6D90	0_2_008D6D90
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D5160	0_2_008D5160
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008E8A9F	0_2_008E8A9F
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D2A43	0_2_008D2A43
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008E4F70	0_2_008E4F70

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Code function: String function: 008D40B0 appears 34 times

Source: install_numarkidjliveii+(1).exe, 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameinstalladdon.exeB vs install_numarkidjliveii+(1).exe
Source: install_numarkidjliveii+(1).exe	Binary or memory string: OriginalFilenameinstalladdon.exeB vs install_numarkidjliveii+(1).exe

Source: install_numarkidjliveii+(1).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean5.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Command line argument: %s\%s		0_2_008D321A
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Command line argument: %s\%s%s		0_2_008D321A

Source: install_numarkidjliveii+(1).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

File read: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Jump to behavior

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Section loaded: wintypes.dll	Jump to behavior

Source: install_numarkidjliveii+(1).exe

Static PE information: certificate valid

Source: install_numarkidjliveii+(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: install_numarkidjliveii+(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: install_numarkidjliveii+(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: install_numarkidjliveii+(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: install_numarkidjliveii+(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: install_numarkidjliveii+(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: install_numarkidjliveii+(1).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: install_numarkidjliveii+(1).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: install_numarkidjliveii+(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: install_numarkidjliveii+(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: install_numarkidjliveii+(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: install_numarkidjliveii+(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: install_numarkidjliveii+(1).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Code function: 0_2_008D40F6 push ecx; ret

0_2_008D4109

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

API coverage: 9.7 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Code function: 0_2_008DD428 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_008DD428

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Code function: 0_2_008DC6A6 mov eax, dword ptr fs:[00000030h]

0_2_008DC6A6

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Code function: 0_2_008E33B1 GetProcessHeap,

0_2_008E33B1

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D38C3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008D38C3
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008DD428 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008DD428
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D3E66 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008D3E66
Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe	Code function: 0_2_008D3FF9 SetUnhandledExceptionFilter,	0_2_008D3FF9

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Code function: 0_2_008D410B cpuid

0_2_008D410B

Source: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe

Code function: 0_2_008D3D58 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008D3D58

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
install_numarkidjliveii+(1).exe	3%	ReversingLabs
install_numarkidjliveii+(1).exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.virtualdj.com/0/	install_numarkidjliveii+(1).exe	false		high
http://www.winimage.com/zLibDll	install_numarkidjliveii+(1).exe	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	install_numarkidjliveii+(1).exe	false		high
http://www.symauth.com/cps0(	install_numarkidjliveii+(1).exe	false		high
http://www.symauth.com/rpa00	install_numarkidjliveii+(1).exe	false		high
http://ocsp.thawte.com0	install_numarkidjliveii+(1).exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427202
Start date and time:	2024-04-17 08:53:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	install_numarkidjliveii+(1).exe
Detection:	CLEAN
Classification:	clean5.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 4 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.864060199493046
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	install_numarkidjliveii+(1).exe
File size:	940'952 bytes
MD5:	049a333248120d695c0b344f9698de4e
SHA1:	422f821ddbb9c70edd991f8f9d40f3b1e31b49db
SHA256:	92cd9486c31b528a0dd4a3b83aa165454143bf8439ecfc65191a99ed2a4e34f7
SHA512:	1682f18ca6a2ce8cd8b2715fb981b70e794631b71fe4555535ef923400b2a0d700514f609a2cf465fca7d2c42b2e9aef5d6bfba76c7ede459a612ead6ee4c6ce
SSDEEP:	12288:N/d78kkTQDmiS97LwWU5SWtAvBqqSjJrK8w0KxNOQjVDcATASPvBLwjR45QtMYQ7:Fd785TQDmzQltekPj8iZ2BccmtWTt5r
TLSH:	0A152303318085B0D577493896F9EE389A2CB9301E65DDEF725823BA8F255D099349FF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9.~.9.~.9.~..8..4.~..8....~..8..!.~.x.z.1.~.k.}.*.~.k.{...~.k.z.+.~.0...0.~.9...f.~.U.v.:.~.U...8.~.9...8.~.U.\|.8.~.Rich9.~

File Icon


Icon Hash:	8e1f4c4f4f1d0f06

Static PE Info

General

Entrypoint:	0x4038b9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5BD72BAE [Mon Oct 29 15:47:58 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	251ebb044beda80d7d482044d8a442fa

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	22/06/2016 01:00:00 23/07/2019 00:59:59
Subject Chain	CN=Atomix Productions Inc., O=Atomix Productions Inc., L=Los Angeles, S=California, C=US
Version:	3
Thumbprint MD5:	E5897BDAE0607CCFB3B5DE0B8CBE95A8
Thumbprint SHA-1:	CB8429E919FA35C08A073CF7B92629896D021F99
Thumbprint SHA-256:	AB2B1018F39AC64F6BDD21CB42A96F86036A3C25DBC28ED3ADD07B4964148240
Serial:	59E035CD9FB3F4AE7656CF5892A9112E

Entrypoint Preview

Instruction
call 00007F4DB08F856Ch
jmp 00007F4DB08F7EFFh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0041A048h]
push dword ptr [ebp+08h]
call dword ptr [0041A044h]
push C0000409h
call dword ptr [0041A04Ch]
push eax
call dword ptr [0041A050h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007F4DB08FC840h
test eax, eax
je 00007F4DB08F8087h
push 00000002h
pop ecx
int 29h
mov dword ptr [004249D8h], eax
mov dword ptr [004249D4h], ecx
mov dword ptr [004249D0h], edx
mov dword ptr [004249CCh], ebx
mov dword ptr [004249C8h], esi
mov dword ptr [004249C4h], edi
mov word ptr [004249F0h], ss
mov word ptr [004249E4h], cs
mov word ptr [004249C0h], ds
mov word ptr [004249BCh], es
mov word ptr [004249B8h], fs
mov word ptr [004249B4h], gs
pushfd
pop dword ptr [004249E8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004249DCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004249E0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004249ECh], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00424928h], 00010001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2361c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x8450	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xe3ea0	0x1cf8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x11dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x22dc0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x22df8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1885b	0x18a00	74c44e468a41564a545bf8045f72018a	False	0.5900618654822335	COM executable for DOS	6.657681839908799	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x9d22	0x9e00	decefa83b3104212e92e9634494844a6	False	0.5813637262658228	data	6.016711848151997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x24000	0x13f8	0xa00	e30004c77286a14ea7706cb733dc6237	False	0.146875	data	1.924625714805442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x8450	0x8600	2ad58a9491a82c9415bfc6aad62fc9b8	False	0.4777285447761194	data	4.831322386922661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x11dc	0x1200	3d564330567fa755c932abbed26ec763	False	0.8053385416666666	data	6.551172943745427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x264c8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.4456188001889466
RT_ICON	0x2a6f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5252074688796681
RT_ICON	0x2cc98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5347091932457786
RT_ICON	0x2dd40	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6595744680851063
RT_GROUP_ICON	0x2e1a8	0x3e	data	English	United States	0.8225806451612904
RT_VERSION	0x261c0	0x304	data	English	United States	0.42357512953367876
RT_MANIFEST	0x2e1e8	0x261	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (549), with CRLF line terminators	English	United States	0.5451559934318555

Imports

DLL	Import
USER32.dll	MessageBoxW, wsprintfW
ADVAPI32.dll	RegCloseKey, RegOpenKeyW, RegQueryValueExW
SHELL32.dll	SHCreateDirectoryExW
KERNEL32.dll	HeapSize, SetEndOfFile, GetStdHandle, WriteConsoleW, FlushFileBuffers, ReadFile, GetCommandLineW, WriteFile, SetFilePointer, CreateFileW, MultiByteToWideChar, CloseHandle, GetFileSize, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, RaiseException, DecodePointer, GetModuleFileNameW, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetACP, SetFilePointerEx, GetConsoleMode, ReadConsoleW, GetFileType, HeapFree, GetConsoleCP, HeapAlloc, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, SetStdHandle, GetStringTypeW, GetProcessHeap

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	08:53:48
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\install_numarkidjliveii+(1).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\install_numarkidjliveii+(1).exe"
Imagebase:	0x8d0000
File size:	940'952 bytes
MD5 hash:	049A333248120D695C0B344F9698DE4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	1373
Total number of Limit Nodes:	37

Executed Functions

Function 008D321A Relevance: 51.1, APIs: 24, Strings: 5, Instructions: 352
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 008D323B
_wcschr.LIBVCRUNTIME ref: 008D3250
CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008D326F
GetFileSize.KERNEL32(00000000,00000000), ref: 008D328B
SetFilePointer.KERNELBASE(00000000,0002CE00,00000000,00000000), ref: 008D32A5
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 008D32D3
FindCloseChangeNotification.KERNELBASE(00000000), ref: 008D32DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,00000800), ref: 008D3367
wsprintfW.USER32 ref: 008D339C
_strlen.LIBCMT ref: 008D33A3
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 008D33DE
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000800), ref: 008D3480
wsprintfW.USER32 ref: 008D34BA
_strlen.LIBCMT ref: 008D34D5
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 008D34F3
MessageBoxW.USER32(00000000,Installation successfull,VirtualDJ Addons Installer,00000000), ref: 008D3648

Strings

%s\%s, xrefs: 008D3396
%s\%s%s, xrefs: 008D34B4
VirtualDJ not found, xrefs: 008D32F7
VirtualDJ Addons Installer, xrefs: 008D32F2, 008D363C
Installation successfull, xrefs: 008D3641

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: File$Create$ByteCharDirectoryMultiWide_strlenwsprintf$ChangeCloseCommandFindLineMessageNotificationPointerReadSize_wcschr
String ID: %s\%s$%s\%s%s$Installation successfull$VirtualDJ Addons Installer$VirtualDJ not found
API String ID: 261716316-320160432
Opcode ID: d12cb304d8bc1d3ea53139e0d76cfddc1bb0dea8a76e4c2ebce77ca96e6cf470
Instruction ID: 7841961fded17131bc77b0fc7f7fdeb737c6e5405f5c906a096509e7328666b4
Opcode Fuzzy Hash: d12cb304d8bc1d3ea53139e0d76cfddc1bb0dea8a76e4c2ebce77ca96e6cf470
Instruction Fuzzy Hash: 18B1E171508344AAE724AB249C49F7F77E8FB84B20F14461BF645D63C1EF349A488763

Uniqueness

Uniqueness Score: -1.00%

Function 008DC6A6 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,008DC67C,00000003,008F3270,0000000C,008DC7D3,00000003,00000002,00000000,?,008DD08D,00000003), ref: 008DC6C7
TerminateProcess.KERNEL32(00000000,?,008DC67C,00000003,008F3270,0000000C,008DC7D3,00000003,00000002,00000000,?,008DD08D,00000003), ref: 008DC6CE
ExitProcess.KERNEL32 ref: 008DC6E0

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 05567ba23cc0b9d523ebf483a21a27ae6257fdd3c78bd72ca953ee233d5d2597
Instruction ID: 8ef121d8c7e51c6cdc6b80354d521be3ede0cb75555d15d7348ffe8c63f7d902
Opcode Fuzzy Hash: 05567ba23cc0b9d523ebf483a21a27ae6257fdd3c78bd72ca953ee233d5d2597
Instruction Fuzzy Hash: F7E04631000588EFCF156F58DC48A583B69FB60B81B010118F8058A231CB35ED42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 008D30B6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32(80000001,Software\VirtualDJ,?), ref: 008D30D2
RegQueryValueExW.ADVAPI32(?,HomeFolder,00000000,?,00000000,?), ref: 008D30F5
RegQueryValueExW.ADVAPI32(?,HomeFolder,00000000,00000000,?,00000400), ref: 008D3121
RegCloseKey.ADVAPI32(?), ref: 008D3139

Strings

Software\VirtualDJ, xrefs: 008D30C8
HomeFolder, xrefs: 008D30ED, 008D3119

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: HomeFolder$Software\VirtualDJ
API String ID: 1586453840-3986070691
Opcode ID: 17029408be9027d09e44cb42f2a8bacdec41da39e4078d3d4aa337109584ede3
Instruction ID: 0d2bc58b1973e1d17258c025d2a7740feb1bdeae08f1f479d5003400f26fcedf
Opcode Fuzzy Hash: 17029408be9027d09e44cb42f2a8bacdec41da39e4078d3d4aa337109584ede3
Instruction Fuzzy Hash: 1B015770A41249FEEF10ABA0DC859BE77BDFB05744F10056BB902E2250E6709F499A22

Uniqueness

Uniqueness Score: -1.00%

Function 008DFBDA Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,008E2F0F,00000000,?,008DD17C,?,00000008,?,008DFC68,?,?,?), ref: 008DFC0C

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0fbe39e2f8082dacef507291bfe93e6882b6f39a553805d52cd1c70f0557080e
Instruction ID: 098b2572b88a71d60494062e69748e74de02ebb25449770fb50bc4471415e1e1
Opcode Fuzzy Hash: 0fbe39e2f8082dacef507291bfe93e6882b6f39a553805d52cd1c70f0557080e
Instruction Fuzzy Hash: 57E0A02125467D6A9B31276AAC00B5B3748FF517A5B014333FF06D63C2CA10CC61A1E2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008E541E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1387COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008E5564

Strings

1#IND, xrefs: 008E675C
1#QNAN, xrefs: 008E676A
1#SNAN, xrefs: 008E6763
1#INF, xrefs: 008E6771

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d3be9652b63335017e6c51444c46c283f2eab9637eaa3896117d60a968016aa5
Instruction ID: 9057143f4a712f09316b4539fa9f72116fa6fa0cfbdc2bf543aa9ef51478e3f8
Opcode Fuzzy Hash: d3be9652b63335017e6c51444c46c283f2eab9637eaa3896117d60a968016aa5
Instruction Fuzzy Hash: 21C28B71E086688FDB25CE29DD407EAB3B5FB96359F1441EAD80DE7240E774AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 008DD428 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 008DD520
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 008DD52A
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 008DD537

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 141f97c34426baab7715b3933f33df5b3a193812278652d476b2d9e87b2201ce
Instruction ID: fc55f7574ddb4ddbe634926ef8863477e6e1c87d40d8e7199aaa3a3f0420c139
Opcode Fuzzy Hash: 141f97c34426baab7715b3933f33df5b3a193812278652d476b2d9e87b2201ce
Instruction Fuzzy Hash: FA31D3749012289BCB61DF28DC88B8CBBB8FF08710F5042DAE40CA7251EB349F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 008E4F70 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78925b750365db1a32b7e4cf676e42cc126356a11ec8d58d82cae34f46637a44
Instruction ID: e8ef4e6a05ed8978fed75dc4325552e198cca2a0728c4fa7be889ef32574345c
Opcode Fuzzy Hash: 78925b750365db1a32b7e4cf676e42cc126356a11ec8d58d82cae34f46637a44
Instruction Fuzzy Hash: E7023C71E006599BDF14CFA9C8806ADB7F1FF89328F25426AD919EB384D771AD418B80

Uniqueness

Uniqueness Score: -1.00%

Function 008D5C29 Relevance: 2.2, Strings: 1, Instructions: 908COMMON

Download Yara Rule

Strings

F?, xrefs: 008D5DCB

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID: F?
API String ID: 0-1369233217
Opcode ID: 867ef7da61d40fc491219a19016a1acc295bd8629e4debac72cf331af81072fb
Instruction ID: ff8506cb9fd089996542f528cae26943bc9307c0de4fd9ddb9c0e6c5524ca43c
Opcode Fuzzy Hash: 867ef7da61d40fc491219a19016a1acc295bd8629e4debac72cf331af81072fb
Instruction Fuzzy Hash: A2825A71E006199FCB08CF99C4945ADBBF2FF88314B2482AED855EB341D735AA56CF90

Uniqueness

Uniqueness Score: -1.00%

Function 008E8A9F Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008E8A9A,?,?,00000008,?,?,008E873A,00000000), ref: 008E8CCC

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ed962714485ec663a72bfc1257f5339c0af55cad4a84117a0d3f1e34550410cf
Instruction ID: f9d0d856de6817a0557212740ee1c15ef3162eb838cf3ecad39a0b6277d3fc82
Opcode Fuzzy Hash: ed962714485ec663a72bfc1257f5339c0af55cad4a84117a0d3f1e34550410cf
Instruction Fuzzy Hash: DEB15C71210648DFD715CF29C48AB687BE0FF46368F298658E899CF2E1C735E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 008D7080 Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

@, xrefs: 008D749D

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c5d52a5cededb353c32e2631ea98e9ab454f1b71921f461313e5f5e25b992ee6
Instruction ID: 09aeaa2b8d6039cfe7037b54fe2f7c6f58a12295290746419da5aaaa6467a87e
Opcode Fuzzy Hash: c5d52a5cededb353c32e2631ea98e9ab454f1b71921f461313e5f5e25b992ee6
Instruction Fuzzy Hash: 50F16C35E042588FCF24CFA8C5906ADBBB2FF59314F24826AD81AEB391E7319D45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 008D3FF9 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004005,008D3730), ref: 008D3FFE

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 19ec51da27ae9f70206137cc2cc65c6410fb16c16d54e8fa0b6e7c503b8a75e5
Instruction ID: 30fafce3fc8829363aee110dc1b32485fe51044cb446927e4f04f4f08c747898
Opcode Fuzzy Hash: 19ec51da27ae9f70206137cc2cc65c6410fb16c16d54e8fa0b6e7c503b8a75e5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 008DB02A Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 008DB19A

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f8a09bf90652abba03e4c4632af07912c1671ed9223366bd2e24022b032d3914
Instruction ID: 87cca0820e08083330320aad6fe6d37b105f424b2791fa042497e659147db1e4
Opcode Fuzzy Hash: f8a09bf90652abba03e4c4632af07912c1671ed9223366bd2e24022b032d3914
Instruction Fuzzy Hash: 94516861600A48D7DF38496C89A6BBF73D5FF61348F1A0B1BE8A2C7382C715DE458392

Uniqueness

Uniqueness Score: -1.00%

Function 008E33B1 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 008E33B1

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6599c370f2bcc6a78b5ab630852c50ab88672c8611d5349b2ba12433142288ba
Instruction ID: 868e4fbc4873eaf236975959467d1152eba43547639c6b64b0f53eb1f12a504a
Opcode Fuzzy Hash: 6599c370f2bcc6a78b5ab630852c50ab88672c8611d5349b2ba12433142288ba
Instruction Fuzzy Hash: BFA02230202300CF8380CF3AAE8A30CBEE8BA03EC0B028028A002C8330EB308080CB02

Uniqueness

Uniqueness Score: -1.00%

Function 008D5160 Relevance: .8, Instructions: 753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596ee9fa62655505517c6b7ae0fa77dd5944a8562f41b88bd58bb2ed7dd52b33
Instruction ID: 3c4157d1ac88ba1072d167108071629da8c24477ff4d244d5cc69de054546a2a
Opcode Fuzzy Hash: 596ee9fa62655505517c6b7ae0fa77dd5944a8562f41b88bd58bb2ed7dd52b33
Instruction Fuzzy Hash: 31626DB0E016099BDB14CF59D5806ADBBB1FF44318F2882AFD818EB342D775DA56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 008D7C70 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2306200850c581002163288ffb516e111bf9a11ce1db3d96b53d584ffe79dd74
Instruction ID: 69cbb36cb1ece988d9136b094ecff188740e5115101664636c6e82a1f213d6d6
Opcode Fuzzy Hash: 2306200850c581002163288ffb516e111bf9a11ce1db3d96b53d584ffe79dd74
Instruction Fuzzy Hash: D7F19031A046599FCB04CF68C5906ACBBF2FF89314F2482AED895DB346D735EA46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 008D2A43 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12afa0294e1a20503a5aa9e60ff949d18333c846e0f15a4e430caf2af8c0604
Instruction ID: b85ff988e2bd5fa1d5cb8d38f3236870be3c25fe1e979907459119043f6b4442
Opcode Fuzzy Hash: e12afa0294e1a20503a5aa9e60ff949d18333c846e0f15a4e430caf2af8c0604
Instruction Fuzzy Hash: D9E10771A04B12AFC718CF29C880A5AF7E1FF98714F144B2AE868D7741D770A8A5CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 008D6D90 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8329af39f88002c8ceb45a87e96089768bc9a4493f9d97ca4b690f39ed16bee2
Instruction ID: d13bd7fe69a93cebc5a808b9bc9bf5e9b27367484c026455b6a6379d5f1095c2
Opcode Fuzzy Hash: 8329af39f88002c8ceb45a87e96089768bc9a4493f9d97ca4b690f39ed16bee2
Instruction Fuzzy Hash: 867176316201A98FDB14CF2AFCD147A33A1F789385346862AEA41CF395D635E525DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008E3025 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 008E3069

Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2BBC
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2BCE
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2BE0
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2BF2
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C04
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C16
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C28
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C3A
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C4C
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C5E
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C70
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C82
Part of subcall function 008E2B9F: _free.LIBCMT ref: 008E2C94

_free.LIBCMT ref: 008E305E

Part of subcall function 008DEA9C: HeapFree.KERNEL32(00000000,00000000,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?), ref: 008DEAB2
Part of subcall function 008DEA9C: GetLastError.KERNEL32(?,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?,?), ref: 008DEAC4

_free.LIBCMT ref: 008E3080
_free.LIBCMT ref: 008E3095
_free.LIBCMT ref: 008E30A0
_free.LIBCMT ref: 008E30C2
_free.LIBCMT ref: 008E30D5
_free.LIBCMT ref: 008E30E3
_free.LIBCMT ref: 008E30EE
_free.LIBCMT ref: 008E3126
_free.LIBCMT ref: 008E312D
_free.LIBCMT ref: 008E314A
_free.LIBCMT ref: 008E3162

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: faee6554195e8c75a08e5ab364f709e15cd41a4c8dc84e2329fc2fac1428953a
Instruction ID: 4fef7737c045480e71fb359b29d42434ae51ac8237db9be32919a2815c953180
Opcode Fuzzy Hash: faee6554195e8c75a08e5ab364f709e15cd41a4c8dc84e2329fc2fac1428953a
Instruction Fuzzy Hash: 7B315E31604B469FEB21AA7ADC49B5AB7E8FF11310F51452AF458DB251DF31EE40C711

Uniqueness

Uniqueness Score: -1.00%

Function 008DDFE7 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 008DE25D

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 4849a4540b687f611245a832c40f3d4e0c93216c699c9aca91b3dd453cef7fe1
Instruction ID: 9a005da913eab114c8008cf7e7a36908ed836f9feb3b4f2e25fa4b4ed5d0d2bb
Opcode Fuzzy Hash: 4849a4540b687f611245a832c40f3d4e0c93216c699c9aca91b3dd453cef7fe1
Instruction Fuzzy Hash: 7DC1C174A042499FDB15EFACD881BAEBBB4FF59314F084296F444EB392C7709941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008E46EF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008E43BD: CreateFileW.KERNEL32(00000000,00000000,?,008E4798,?,?,00000000,?,008E4798,00000000,0000000C), ref: 008E43DA

GetLastError.KERNEL32 ref: 008E4803
__dosmaperr.LIBCMT ref: 008E480A
GetFileType.KERNEL32(00000000), ref: 008E4816
GetLastError.KERNEL32 ref: 008E4820
__dosmaperr.LIBCMT ref: 008E4829
CloseHandle.KERNEL32(00000000), ref: 008E4849
CloseHandle.KERNEL32(?), ref: 008E4993
GetLastError.KERNEL32 ref: 008E49C5
__dosmaperr.LIBCMT ref: 008E49CC

Strings

H, xrefs: 008E4951

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: f3b430b43876817c17d6d6f4c0be791b4c8f3b498a59558fd486fc7cf9f131ee
Instruction ID: d24f07805ce808f771964d636b4d3237987b29b8ddeab7dfb0ad12b190d217ab
Opcode Fuzzy Hash: f3b430b43876817c17d6d6f4c0be791b4c8f3b498a59558fd486fc7cf9f131ee
Instruction Fuzzy Hash: 39A1E631A101989FDF19AF68D851BAE7BA0FB07324F14115AF819EB3A1DB359C12C792

Uniqueness

Uniqueness Score: -1.00%

Function 008E041D Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 008E0431

Part of subcall function 008DEA9C: HeapFree.KERNEL32(00000000,00000000,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?), ref: 008DEAB2
Part of subcall function 008DEA9C: GetLastError.KERNEL32(?,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?,?), ref: 008DEAC4

_free.LIBCMT ref: 008E043D
_free.LIBCMT ref: 008E0448
_free.LIBCMT ref: 008E0453
_free.LIBCMT ref: 008E045E
_free.LIBCMT ref: 008E0469
_free.LIBCMT ref: 008E0474
_free.LIBCMT ref: 008E047F
_free.LIBCMT ref: 008E048A
_free.LIBCMT ref: 008E0498

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 94bfa12d6e014cc3854ff4bdc8f478e290144a80ca083632f0a3827a1d2757d0
Instruction ID: c018849bd8bc1147545ed725a43bfce980b02275284963c8819cfffd33dfdbf1
Opcode Fuzzy Hash: 94bfa12d6e014cc3854ff4bdc8f478e290144a80ca083632f0a3827a1d2757d0
Instruction Fuzzy Hash: FD11777650051AAFCB01FF59CD42CD93FA5FF14350B9285A6BA088F222D771EA509B85

Uniqueness

Uniqueness Score: -1.00%

Function 008DEE67 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,008DF5DC,?,?,?,?,?,?), ref: 008DEEA9
__fassign.LIBCMT ref: 008DEF24
__fassign.LIBCMT ref: 008DEF3F
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 008DEF65
WriteFile.KERNEL32(?,?,00000000,008DF5DC,00000000,?,?,?,?,?,?,?,?,?,008DF5DC,?), ref: 008DEF84
WriteFile.KERNEL32(?,?,00000001,008DF5DC,00000000,?,?,?,?,?,?,?,?,?,008DF5DC,?), ref: 008DEFBD

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 46aba663ba08da5adc3901787d1d18ea361286660a206cb72c3a9e23c78d94af
Instruction ID: 8cace9714d69d64167568275546845bae6911fea49b28022ed58cdde3ec5fd4c
Opcode Fuzzy Hash: 46aba663ba08da5adc3901787d1d18ea361286660a206cb72c3a9e23c78d94af
Instruction Fuzzy Hash: EA5171719006499FDB10CFA8D885EEEBBB5FF09304F14426BE956E7392DB30A941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008D8950 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 008D897B
___except_validate_context_record.LIBVCRUNTIME ref: 008D8983
_ValidateLocalCookies.LIBCMT ref: 008D8A11
__IsNonwritableInCurrentImage.LIBCMT ref: 008D8A3C
_ValidateLocalCookies.LIBCMT ref: 008D8A91

Strings

csm, xrefs: 008D8A26

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b46c87f0bf60328b38d86a2ea82f8f3481f0266b9900c7a94036b6ef6c48bc25
Instruction ID: ad0a8321d9e4cb78a10cfd032b79bba56645d4e2f0995e1893f07be22b5b7143
Opcode Fuzzy Hash: b46c87f0bf60328b38d86a2ea82f8f3481f0266b9900c7a94036b6ef6c48bc25
Instruction Fuzzy Hash: E941C434A00218EBCB10DF6CC885AAE7BA4FF45324F148257E815EB352DB31EA41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008E6F31 Relevance: 10.6, APIs: 7, Instructions: 80
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d127c20d4e831c9ef6f0ddcca4dedcf82a698e73f0173ffa8af5426ae3a3ebe
Instruction ID: c0a0b53725d99adc546c4a0fbf00732ed14e869510017758c76e3ec09d097900
Opcode Fuzzy Hash: 2d127c20d4e831c9ef6f0ddcca4dedcf82a698e73f0173ffa8af5426ae3a3ebe
Instruction Fuzzy Hash: 2611E772504259BFDB206F7BBC44D6B3B6CFBA27B4B100225F815CA251EE30C81086A2

Uniqueness

Uniqueness Score: -1.00%

Function 008E2D42 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008E2D06: _free.LIBCMT ref: 008E2D2F

_free.LIBCMT ref: 008E2D90

Part of subcall function 008DEA9C: HeapFree.KERNEL32(00000000,00000000,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?), ref: 008DEAB2
Part of subcall function 008DEA9C: GetLastError.KERNEL32(?,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?,?), ref: 008DEAC4

_free.LIBCMT ref: 008E2D9B
_free.LIBCMT ref: 008E2DA6
_free.LIBCMT ref: 008E2DFA
_free.LIBCMT ref: 008E2E05
_free.LIBCMT ref: 008E2E10
_free.LIBCMT ref: 008E2E1B

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 563ebe20eca168fa2aad3ee1928db5ce48dfd6128f12bf5416359286e80c54b2
Instruction ID: c2c8ba5954c0e5fd71ada257afe6cf175454d123c557a837e424c9eba38549fa
Opcode Fuzzy Hash: 563ebe20eca168fa2aad3ee1928db5ce48dfd6128f12bf5416359286e80c54b2
Instruction Fuzzy Hash: 46119031600B4AA6D520BB75CC07FCB7BAEFF03310F404915B299EA162D734B5049682

Uniqueness

Uniqueness Score: -1.00%

Function 008E4C22 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,008DB439,008DB439,?,?,?,008E4E73,00000001,00000001,FDE85006), ref: 008E4C7C
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,008E4E73,00000001,00000001,FDE85006,?,?,?), ref: 008E4D02
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,FDE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 008E4DFC
__freea.LIBCMT ref: 008E4E09

Part of subcall function 008DFBDA: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,008E2F0F,00000000,?,008DD17C,?,00000008,?,008DFC68,?,?,?), ref: 008DFC0C

__freea.LIBCMT ref: 008E4E12
__freea.LIBCMT ref: 008E4E37

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 1289d23bcd5459c88ca099f6a670a0cef8b24a0b64e04421ce8b7f834176a062
Instruction ID: dbe78a722311551f24623ef2cbc33bd4b3636866ce51c3256abe17406d1943f7
Opcode Fuzzy Hash: 1289d23bcd5459c88ca099f6a670a0cef8b24a0b64e04421ce8b7f834176a062
Instruction Fuzzy Hash: B851247260029BABDB298F66CC41EBF77A9FB46760F250229FD18D7140DB74DC50C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 008E0511 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,008DAAD2,?,?,?,008DA693,?), ref: 008E0515
_free.LIBCMT ref: 008E0548
_free.LIBCMT ref: 008E0570
SetLastError.KERNEL32(00000000), ref: 008E057D
SetLastError.KERNEL32(00000000), ref: 008E0589
_abort.LIBCMT ref: 008E058F

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 532a84aab81c4cdce3203be90e9551914930620a30db3120ea598db8f207a941
Instruction ID: a15579c58ae179111156ba3fa561bcbc6e9cd3f194fd36a7154ae0bd211579da
Opcode Fuzzy Hash: 532a84aab81c4cdce3203be90e9551914930620a30db3120ea598db8f207a941
Instruction Fuzzy Hash: 23F0F932140A8167C601733E7C0AF3B2B29FFD3B21B210525F924E62D1EFB48A419D76

Uniqueness

Uniqueness Score: -1.00%

Function 008DC72B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,008DC6DC,00000003,?,008DC67C,00000003,008F3270,0000000C,008DC7D3,00000003,00000002), ref: 008DC74B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008DC75E
FreeLibrary.KERNEL32(00000000,?,?,?,008DC6DC,00000003,?,008DC67C,00000003,008F3270,0000000C,008DC7D3,00000003,00000002,00000000), ref: 008DC781

Strings

CorExitProcess, xrefs: 008DC756
mscoree.dll, xrefs: 008DC744

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8ab5dd66cb0b2d49f1a4bf0fe84cf86fb72da40eda1dcfa6c7a41d6fa3ce856d
Instruction ID: 3eb8c8ed522b82152561be9a3f747b1ac574ec474049e3ac749127c6dee9da94
Opcode Fuzzy Hash: 8ab5dd66cb0b2d49f1a4bf0fe84cf86fb72da40eda1dcfa6c7a41d6fa3ce856d
Instruction Fuzzy Hash: 8FF04430600548FBCB159F65DC49BAD7FB8FF05B12F000265F905E6290DB759E84CA51

Uniqueness

Uniqueness Score: -1.00%

Function 008DCC6C Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 008DCCDE
_free.LIBCMT ref: 008DCCFE

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3abe85f8d80c0f4a13e561e8822f3202ea706edd9d7fff178cdbfcb7c021ee85
Instruction ID: ebcc045a7076580d3239aaf1b030fea7b3fe249a289153d15ee9c378a3f74314
Opcode Fuzzy Hash: 3abe85f8d80c0f4a13e561e8822f3202ea706edd9d7fff178cdbfcb7c021ee85
Instruction Fuzzy Hash: 8941D232A006159FCB20DF78C981A5AB7A6FF89714F25466AE615EB341EB31AD01CB81

Uniqueness

Uniqueness Score: -1.00%

Function 008E0595 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,008DD6B3,008E1467,?,008E053F,00000001,00000364,?,008DAAD2,?,?,?,008DA693,?), ref: 008E059A
_free.LIBCMT ref: 008E05CF
_free.LIBCMT ref: 008E05F6
SetLastError.KERNEL32(00000000), ref: 008E0603
SetLastError.KERNEL32(00000000), ref: 008E060C

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 7d89bdfb743a4519c5811dce37b1a8d4a6450b5edf0dacbc2d6bba2e083b1ed3
Instruction ID: 5cd09448a772e489c96e50827dae1d09c7f05c39f4dbca2fd5b788e06bb15934
Opcode Fuzzy Hash: 7d89bdfb743a4519c5811dce37b1a8d4a6450b5edf0dacbc2d6bba2e083b1ed3
Instruction Fuzzy Hash: 4D014932144B81B7C212773A6C85E3B272DFFE37657310925F815E62A1EFB089414836

Uniqueness

Uniqueness Score: -1.00%

Function 008E2C9D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 008E2CB5

Part of subcall function 008DEA9C: HeapFree.KERNEL32(00000000,00000000,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?), ref: 008DEAB2
Part of subcall function 008DEA9C: GetLastError.KERNEL32(?,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?,?), ref: 008DEAC4

_free.LIBCMT ref: 008E2CC7
_free.LIBCMT ref: 008E2CD9
_free.LIBCMT ref: 008E2CEB
_free.LIBCMT ref: 008E2CFD

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a043f64c768c434a87806fdd4b25e298dd2af7217005b0a252755006a9b5ca53
Instruction ID: 8bfcc0151d1d073cb89558ef8b308dff2b088b313153061f1a25a5c467f7662d
Opcode Fuzzy Hash: a043f64c768c434a87806fdd4b25e298dd2af7217005b0a252755006a9b5ca53
Instruction Fuzzy Hash: EFF01D32514692AB8620FB69FD86C2B77EDFB057607A5191BF408DB620CB30FC80CA64

Uniqueness

Uniqueness Score: -1.00%

Function 008DCEBB Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 008DCED9

Part of subcall function 008DEA9C: HeapFree.KERNEL32(00000000,00000000,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?), ref: 008DEAB2
Part of subcall function 008DEA9C: GetLastError.KERNEL32(?,?,008E2D34,?,00000000,?,00000000,?,008E2D5B,?,00000007,?,?,008E31BD,?,?), ref: 008DEAC4

_free.LIBCMT ref: 008DCEEB
_free.LIBCMT ref: 008DCEFE
_free.LIBCMT ref: 008DCF0F
_free.LIBCMT ref: 008DCF20

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9e1f10ab278d43f32865096f4239d4a8c627d79dc08d93222cae0ab956c3a01b
Instruction ID: 66181d2862a1b2492b7105685b2e64dac40eea5ff0244a12efcb24e8ccd57ef2
Opcode Fuzzy Hash: 9e1f10ab278d43f32865096f4239d4a8c627d79dc08d93222cae0ab956c3a01b
Instruction Fuzzy Hash: 2DF017B0811E229BC721BF38EC02D2A3FA4F7157247921217F214DA371DB312991DAD2

Uniqueness

Uniqueness Score: -1.00%

Function 008DBF5F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\install_numarkidjliveii+(1).exe,00000104), ref: 008DBF9A
_free.LIBCMT ref: 008DC065
_free.LIBCMT ref: 008DC06F

Strings

C:\Users\user\Desktop\install_numarkidjliveii+(1).exe, xrefs: 008DBF91, 008DBF98, 008DBFC7, 008DBFFF

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\install_numarkidjliveii+(1).exe
API String ID: 2506810119-2219621482
Opcode ID: 6df442fc5ddd8aedbd07c95f8583d6833b560b3e27af3a47c526205b71dcef52
Instruction ID: 3992e5f09124604c1e620dba706d3e70bfd3e9536ff28dcf44928ce2244180ea
Opcode Fuzzy Hash: 6df442fc5ddd8aedbd07c95f8583d6833b560b3e27af3a47c526205b71dcef52
Instruction Fuzzy Hash: 69317C71A00619EFCB21DFA9DC81DAEBBB8FB95710B104267E504D7311DBB09E40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008D3071 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 008D308B
MessageBoxW.USER32(00000000,?,VirtualDJ Addons Installer,00000010), ref: 008D30A1

Strings

VirtualDJ Addons Installer, xrefs: 008D3099
Installation error %i, xrefs: 008D3085

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: Messagewsprintf
String ID: Installation error %i$VirtualDJ Addons Installer
API String ID: 300413163-227196857
Opcode ID: 10a90d38367356d6fd73cdbe1f6ebc9f9eadf1782d3fc34a0f7fbb3db0e72123
Instruction ID: 74328524ae3cf0c1f00df2cfeda364d24775b4c3f7ea38ba8dc794f7997a6404
Opcode Fuzzy Hash: 10a90d38367356d6fd73cdbe1f6ebc9f9eadf1782d3fc34a0f7fbb3db0e72123
Instruction Fuzzy Hash: 06E0127065020CABD704DBB8DD46F6E77A8FB04704F500159BA12E62C1D660FB049A5A

Uniqueness

Uniqueness Score: -1.00%

Function 008E0744 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008E07CF
__alldvrm.LIBCMT ref: 008E09D0
__alldvrm.LIBCMT ref: 008E09F2

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 83d04518bf0ef92ce44114796b77fbdc83d101adb180938118fe2ce886ac70b4
Instruction ID: c35481dd957f906e67f83fdbfbd2b9c8260c519a3fb7084942b50103baa86b95
Opcode Fuzzy Hash: 83d04518bf0ef92ce44114796b77fbdc83d101adb180938118fe2ce886ac70b4
Instruction Fuzzy Hash: 80A134719043DA9FEB21DE1AC8817AEBFA4FF12310F184969D484DB283C6B49981CB51

Uniqueness

Uniqueness Score: -1.00%

Function 008E6FF8 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 008E7127

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 15cc362db32fb1decc200f5f50eefc8380887b6e3b728c414eaa1e4b39dc5fe3
Instruction ID: 9ac563deaf07b228600992d39d155c7fa066b922a297e2491118ca71efb14ed8
Opcode Fuzzy Hash: 15cc362db32fb1decc200f5f50eefc8380887b6e3b728c414eaa1e4b39dc5fe3
Instruction Fuzzy Hash: E7411D31704784ABDB25BBBE9C85A6E3765FF57330F140326F418D6292DA34894056E3

Uniqueness

Uniqueness Score: -1.00%

Function 008E2E6B Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,008DFC68,?,00000000,?,00000001,?,?,00000001,008DFC68,?), ref: 008E2EB8
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 008E2F41
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,008DD17C,?), ref: 008E2F53
__freea.LIBCMT ref: 008E2F5C

Part of subcall function 008DFBDA: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,008E2F0F,00000000,?,008DD17C,?,00000008,?,008DFC68,?,?,?), ref: 008DFC0C

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 64df73c31387f51b735d7374963219d16c33d636f8434c483bcc78d0e1b7231f
Instruction ID: 9f35e10a227e2b9c3eab3daf6e1d4fbf61d1679020a8df0a9af654e27f86bf37
Opcode Fuzzy Hash: 64df73c31387f51b735d7374963219d16c33d636f8434c483bcc78d0e1b7231f
Instruction Fuzzy Hash: C631F032A0025AABCF258F6ADC85DAE7BB8FB01710F040269FC09DB250EB35DD55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008E22FE Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,008DA693,00000000,00000000,?,008E22A5,008DA693,00000000,00000000,00000000,?,008E24F0,00000006,FlsSetValue), ref: 008E2330
GetLastError.KERNEL32(?,008E22A5,008DA693,00000000,00000000,00000000,?,008E24F0,00000006,FlsSetValue,008EEEC4,FlsSetValue,00000000,00000364,?,008E05E3), ref: 008E233C
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,008E22A5,008DA693,00000000,00000000,00000000,?,008E24F0,00000006,FlsSetValue,008EEEC4,FlsSetValue,00000000), ref: 008E234A

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 86993ca23a26da0aa5d28080fc141cc8568eb8e72d44876b3ce0024a0a9464e9
Instruction ID: 0756b200d40dfef9909fc07db69e03a2ef774339b837cbe67daaae846337cd7b
Opcode Fuzzy Hash: 86993ca23a26da0aa5d28080fc141cc8568eb8e72d44876b3ce0024a0a9464e9
Instruction Fuzzy Hash: A601FC326016A6DBCB258A7AAC849577B9CFF06BA47210620FE05D7350D734E801CEE0

Uniqueness

Uniqueness Score: -1.00%

Function 008D112F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

r+b, xrefs: 008D114A, 008D1166

Memory Dump Source

Source File: 00000000.00000002.1675608255.00000000008D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1675591922.00000000008D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675630855.00000000008EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675657126.00000000008F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675673425.00000000008F6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_install_numarkidjliveii+(1).jbxd

Similarity

API ID:
String ID: r+b
API String ID: 0-2113443889
Opcode ID: 309239fb8f670160530669ef56da222a4f27fe49fb36dda4a3675442633757f8
Instruction ID: 1b9662ea0a4975208d8a9ecea53985bcc23a2c6026c9221eb050d628e30206fe
Opcode Fuzzy Hash: 309239fb8f670160530669ef56da222a4f27fe49fb36dda4a3675442633757f8
Instruction Fuzzy Hash: C611A171214259BBDF055AAC9C49BAA37D8FF49314B10872BFB09CA342DB30CD1087A1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report install_numarkidjliveii+(1).exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: install_numarkidjliveii+(1).exePID: 7308, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: install_numarkidjliveii+(1).exePID: 7308, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 008D321A Relevance: 51.1, APIs: 24, Strings: 5, Instructions: 352filewindowCOMMON

Windows Analysis Report
install_numarkidjliveii+(1).exe

Function 008D321A Relevance: 51.1, APIs: 24, Strings: 5, Instructions: 352
filewindowCOMMON

Function 008DC6A6 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 008D30B6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58
registryCOMMON

Function 008DFBDA Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 008E3025 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Function 008DDFE7 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Function 008E46EF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 008E041D Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Function 008DEE67 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMONLIBRARYCODE

Function 008D8950 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Function 008E6F31 Relevance: 10.6, APIs: 7, Instructions: 80
COMMONLIBRARYCODE