Edit tour

Windows Analysis Report
invoice & packing list.exe

Overview

General Information

Sample name:	invoice & packing list.exe
Analysis ID:	1427730
MD5:	e9de39ce29b4e19d9487d6517f5fe390
SHA1:	aa9300231e426c9d0cbffe0bcf36f047235e79a6
SHA256:	24390949599e57a802ea820e402befca0610937e51e19a4db8228235d0017a58
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

invoice & packing list.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\invoice & packing list.exe" MD5: E9DE39CE29B4E19D9487D6517F5FE390)

invoice & packing list.exe (PID: 6324 cmdline: "C:\Users\user\Desktop\invoice & packing list.exe" MD5: E9DE39CE29B4E19D9487D6517F5FE390)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2874078879.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2874078879.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: invoice & packing list.exe PID: 6616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: invoice & packing list.exe PID: 6616	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: invoice & packing list.exe PID: 6616	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: invoice & packing list.exe PID: 6324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: invoice & packing list.exe PID: 6324	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.invoice & packing list.exe.36edbe0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.invoice & packing list.exe.36edbe0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.invoice & packing list.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.invoice & packing list.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.invoice & packing list.exe.36edbe0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31673:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3176f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31801:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3186b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318dd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31973:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a03:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.invoice & packing list.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33473:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3356f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33601:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3366b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336dd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33773:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33803:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.invoice & packing list.exe.36b31c0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.invoice & packing list.exe.36b31c0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.invoice & packing list.exe.36b31c0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31673:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3176f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31801:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3186b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318dd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31973:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a03:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.invoice & packing list.exe.36edbe0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.invoice & packing list.exe.36edbe0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.invoice & packing list.exe.36edbe0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33473:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dc93:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd05:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3356f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dd8f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33601:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de21:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3366b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6de8b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336dd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6defd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33773:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6df93:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33803:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e023:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.invoice & packing list.exe.36b31c0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.invoice & packing list.exe.36b31c0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.invoice & packing list.exe.36b31c0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33473:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6de93:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa86b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df05:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8725:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3356f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6df8f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33601:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e021:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8841:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3366b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e08b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336dd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e0fd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa891d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33773:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e193:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa89b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 162.241.123.30, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\invoice & packing list.exe, Initiated: true, ProcessId: 6324, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49735

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: invoice & packing list.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: invoice & packing list.exe

Virustotal: Detection: 29%

Perma Link

Machine Learning detection for sample

Source: invoice & packing list.exe

Joe Sandbox ML: detected

Source: invoice & packing list.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: invoice & packing list.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 162.241.123.30:587

Source: Joe Sandbox View	IP Address: 162.241.123.30 162.241.123.30
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 162.241.123.30:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.techwiser.in
Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873691975.00000000011F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873691975.00000000011F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2879639896.0000000006845000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2879639896.0000000006845000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: invoice & packing list.exe, 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: invoice & packing list.exe, 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2874078879.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: invoice & packing list.exe, 00000002.00000002.2874078879.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, oAKy.cs

.Net Code: xXlophBw8

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.invoice & packing list.exe.36edbe0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.invoice & packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.invoice & packing list.exe.36b31c0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.invoice & packing list.exe.36b31c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: invoice & packing list.exe, App.cs	Large array initialization: : array initializer size 627791
Source: 0.2.invoice & packing list.exe.6f30000.6.raw.unpack, SQL.cs	Large array initialization: : array initializer size 33608
Source: 0.2.invoice & packing list.exe.2690d84.0.raw.unpack, SQL.cs	Large array initialization: : array initializer size 33608

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: invoice & packing list.exe

Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB43A0	0_2_06FB43A0
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB4088	0_2_06FB4088
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0040	0_2_06FB0040
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0EF0	0_2_06FB0EF0
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB6560	0_2_06FB6560
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB654F	0_2_06FB654F
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB326C	0_2_06FB326C
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB3240	0_2_06FB3240
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB4390	0_2_06FB4390
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FBF338	0_2_06FBF338
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FBF328	0_2_06FBF328
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB4079	0_2_06FB4079
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB001E	0_2_06FB001E
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB3008	0_2_06FB3008
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FBEEF0	0_2_06FBEEF0
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0EB9	0_2_06FB0EB9
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB2FF8	0_2_06FB2FF8
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB2C98	0_2_06FB2C98
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB2C88	0_2_06FB2C88
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB1DE0	0_2_06FB1DE0
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB1DD0	0_2_06FB1DD0
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010EE6D0	2_2_010EE6D0
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010ED9D8	2_2_010ED9D8
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010E4A98	2_2_010E4A98
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010E3E80	2_2_010E3E80
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010E41C8	2_2_010E41C8
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010EA958	2_2_010EA958
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06ACA068	2_2_06ACA068
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06AD5570	2_2_06AD5570
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06ADB299	2_2_06ADB299
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06AD3028	2_2_06AD3028
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06ADC148	2_2_06ADC148
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06AD7D40	2_2_06AD7D40
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06AD7660	2_2_06AD7660
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06ADE360	2_2_06ADE360
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06AD0040	2_2_06AD0040
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06AD5CAF	2_2_06AD5CAF
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06AD0006	2_2_06AD0006

Source: invoice & packing list.exe, 00000000.00000002.1684734948.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000000.00000002.1686242139.0000000004026000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000000.00000002.1685787944.00000000026AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename28519625-fb4c-40d0-af15-66ea2f96c830.exe4 vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename28519625-fb4c-40d0-af15-66ea2f96c830.exe4 vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000000.00000002.1689959978.0000000006F30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000000.00000002.1685787944.000000000266D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000000.00000002.1690928922.000000000AD10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000002.00000002.2872402277.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs invoice & packing list.exe
Source: invoice & packing list.exe, 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename28519625-fb4c-40d0-af15-66ea2f96c830.exe4 vs invoice & packing list.exe
Source: invoice & packing list.exe	Binary or memory string: OriginalFilenameGGDk.exe< vs invoice & packing list.exe

Source: invoice & packing list.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.invoice & packing list.exe.36edbe0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.invoice & packing list.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.invoice & packing list.exe.36b31c0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.invoice & packing list.exe.36b31c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: invoice & packing list.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, ekKu0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, vKf1z6NvS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, ZNAvlD7qmXc.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, U2doU2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, BgffYko.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, HrTdA63.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, boeN8EZugYfTRxOApL.cs	Security API names: _0020.SetAccessControl
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, boeN8EZugYfTRxOApL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, boeN8EZugYfTRxOApL.cs	Security API names: _0020.AddAccessRule
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, IsmbWLLylsNbQBJICW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, boeN8EZugYfTRxOApL.cs	Security API names: _0020.SetAccessControl
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, boeN8EZugYfTRxOApL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, boeN8EZugYfTRxOApL.cs	Security API names: _0020.AddAccessRule
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, IsmbWLLylsNbQBJICW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\invoice & packing list.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice & packing list.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe	Mutant created: \Sessions\1\BaseNamedObjects\oOQVhVfletgHpIzCI
Source: C:\Users\user\Desktop\invoice & packing list.exe	Mutant created: NULL

Source: invoice & packing list.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: invoice & packing list.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\invoice & packing list.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\invoice & packing list.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\invoice & packing list.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: invoice & packing list.exe

Virustotal: Detection: 29%

Source: C:\Users\user\Desktop\invoice & packing list.exe

File read: C:\Users\user\Desktop\invoice & packing list.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\invoice & packing list.exe "C:\Users\user\Desktop\invoice & packing list.exe"
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process created: C:\Users\user\Desktop\invoice & packing list.exe "C:\Users\user\Desktop\invoice & packing list.exe"
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process created: C:\Users\user\Desktop\invoice & packing list.exe "C:\Users\user\Desktop\invoice & packing list.exe"	Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: invoice & packing list.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: invoice & packing list.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: invoice & packing list.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, boeN8EZugYfTRxOApL.cs	.Net Code: AMv9OyRGrP System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice & packing list.exe.6f30000.6.raw.unpack, SQL.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice & packing list.exe.2690d84.0.raw.unpack, SQL.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, boeN8EZugYfTRxOApL.cs	.Net Code: AMv9OyRGrP System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_024E336C push 9C00005Fh; iretd	0_2_024E3419
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_024E3445 push F000005Fh; iretd	0_2_024E34C9
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_024E3415 pushfd ; iretd	0_2_024E3419
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_024E3EF7 push ebp; ret	0_2_024E3EF8
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0E9A push es; retf	0_2_06FB0EB8
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0E69 push es; retf	0_2_06FB0EB8
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0E00 push es; retf	0_2_06FB0E68
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0E00 push es; retf	0_2_06FB0EB8
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB0947 pushad ; retf	0_2_06FB0948
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 0_2_06FB093D pushad ; retf	0_2_06FB093E
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010E0B4D push edi; ret	2_2_010E0CC2
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_010E0C95 push edi; retf	2_2_010E0C3A
Source: C:\Users\user\Desktop\invoice & packing list.exe	Code function: 2_2_06ACFCBC push es; retf	2_2_06ACFCC8

Source: invoice & packing list.exe

Static PE information: section name: .text entropy: 7.970575972972858

Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, x6benKwwZ9OwZYvEPhn.cs	High entropy of concatenated method names: 'ToString', 'VSP3618CtA', 'xeh39qOQIy', 'xHq3sxK7ey', 'QKn3AgOVGb', 'V5a3Qjwcky', 'hBv3YcnJih', 'R343HW93pw', 'FnLW62HuhEV7M8yQfVG', 'Yrdk1oH22RnKmcAtAOV'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, NHwoM1feufwrIp88B7.cs	High entropy of concatenated method names: 'TjaHK8nL6T', 'k6wH7cfYmb', 'dSYYI47qIx', 'QbhYiMyCfP', 'xnMYdFZPI7', 'DlrYjQHgjP', 'go3YL71jjB', 'AhYYSKQxyt', 't1NYZFw4UN', 'UKpYhbXrOj'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, VJT7qa0GcUv7HvpF5g.cs	High entropy of concatenated method names: 's82k01XjC8', 'xk7kMWDN2a', 'MVLkOSmlmX', 'Kqmk1jXlMq', 'DjokKHi0ah', 'UHrkpJiWlf', 'DfVk730jki', 'MWDkrkKROV', 'yMckbyMxh3', 'allkg8P9HJ'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, aY32ngbTNeQthivMBh.cs	High entropy of concatenated method names: 'ToString', 'B5wUwkIEKn', 'ICEU8y1pp5', 'zGQUIdi6Yk', 'bCSUi1oDLS', 'RtEUdTIPJM', 'SsjUjYQg99', 'tpTULwdGGI', 'u3fUS3c3UV', 'oJpUZWE20I'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, bjS7XK30X9MGr4KoTc.cs	High entropy of concatenated method names: 'D2BWkSxUkq', 'sGoWqRGJ4v', 'pleW2BRIQj', 'R4BWml4h3L', 'QNWWDA9wS8', 'ANxWU8iRhX', 'JkQSGOtnKHu1nTjyZD', 'MRPl3WxGhfE0PhYE6K', 'feuWWnVAA1', 'QNrW65oNTm'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, jHYnMeOpB2i33fdhPK.cs	High entropy of concatenated method names: 'JtEY1AF6UQ', 'WQLYptfsXH', 'EXpYrDr5SO', 'WWMYbDOv7X', 'G1kYDOQcKe', 'VooYUMxsjU', 'n0hYyBIe6W', 'KFUYug5OLA', 'jMdYEmKQqd', 'S3eY3kRGII'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, Td6Ro8Ni3RtXwCuSkU.cs	High entropy of concatenated method names: 'AJmy2C0JKc', 'UKxymGnbN1', 'ToString', 'KdLyAJpH35', 'eaayQtiCTv', 'jIpyY9g5gd', 'hqtyHKZuRI', 'XRXyG5JZxS', 'xITykNIGjh', 'Crqyq5svsj'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, boeN8EZugYfTRxOApL.cs	High entropy of concatenated method names: 'PP36s8YSCR', 'XBX6A0ctCl', 'XI26Q5YSad', 'HsA6YVSQNw', 'gVs6H0VDmC', 'KTp6G4vIdO', 'TvV6kQnO5F', 'c166q4Zled', 'R9d6nQ7qwA', 'U7t62ikyau'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, zM27DOwKFXHJLIf69Xf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T8X3fLxdIs', 'F7n3a6aZ7B', 'DLW3VuEG3b', 'ewr3cKfNMy', 'Tgs3BiM6nJ', 'xRY3XBSgHc', 'WKv3NlLNRe'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, JPAuFR60HCnWvWaABo.cs	High entropy of concatenated method names: 'evZuAns7vC', 'Un8uQQZU7g', 'EiJuY36GOy', 'uINuHJyY3A', 'SK9uGWZMuM', 'il7ukYIO6I', 'rAVuqkwi2r', 'TQbunOkVHV', 'rgtu2jqurm', 'pdDum795lD'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, RoTI2YwtT6lNXfg1pmy.cs	High entropy of concatenated method names: 'hB8E0qBN8j', 'vhbEM3VPqb', 'wEdEONQ9BO', 'XZ2E1KU3DL', 'QCCEKeUVjj', 'jpkEpyZIQd', 'e5oE77TpGj', 'M1SErlDX76', 'QtpEbWv7el', 'y63EgHZvHB'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, pBUQqE1OKEYDSahrfn.cs	High entropy of concatenated method names: 'rKQEWweWEX', 'oLYE62bB6T', 'Rf3E9Fgk4r', 'hc5EAqlUXg', 'ydtEQeNFIK', 'R0TEHV88Gd', 'DAZEGcwi2V', 'qjVuN8FdtA', 'cyMu45QHPu', 'D2FuPfGOBX'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, NilmEEE0CH8Q7vyWme.cs	High entropy of concatenated method names: 'wKIuTu0RNE', 'kInu8fW2JI', 'hrquIgbww2', 'T3Qui585nc', 'hC0ufw6Ojk', 'N0sud33a3Y', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, T9YxjoU0gsyH6XRSVo.cs	High entropy of concatenated method names: 'vCBtrZw2vF', 'PXntb963d0', 'ofYtTiplwu', 'zXTt8ks425', 'a2dtiGF7jU', 'PQItdMinaG', 'Q8qtLEwr4J', 'XZVtSUe3Ki', 'L5MthJexUV', 'O17twxIF2F'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, aNy1cxcPoNsKYhTvd2.cs	High entropy of concatenated method names: 'WOWO967wR', 'Aic14bKHY', 'NsLpwBq0p', 'FN77d83oE', 'syTbZIAUR', 'ieDgU1B0x', 'xV3xN9GFbAgaMFBLSr', 'iLLIGZaGfe2eGAjW68', 'VF0udco3J', 'XwN3EsMqd'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, wDdWn8PJtKvMPM9vfi.cs	High entropy of concatenated method names: 'dy2Gs38uj9', 'l9ZGQlYVh6', 'HWDGH9fYl0', 'I43GkA116F', 'WstGq3k1Mv', 'auMHBwk8NX', 'EZiHXO5owM', 'QDFHNgoiFU', 'dgbH4EXpEo', 'uFnHPLNqLh'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, IsmbWLLylsNbQBJICW.cs	High entropy of concatenated method names: 'Lb4Qfsf5pH', 'AdIQa7AiVe', 'CbjQV2Iu3q', 'BIsQcCUQBD', 'dq2QB2sxPX', 'UBnQXVc8wP', 'jHYQNwDBYf', 'cm0Q4kEFHq', 'k9LQPuvq2y', 'neBQ5qRlZT'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, qjLOrWra3YQuKSIDmX.cs	High entropy of concatenated method names: 'Dispose', 'CgfWP3kEYE', 'EkOC8uSJKp', 'NhOvvfL6F8', 'MWvW5UAuWL', 'TCtWztLLyV', 'ProcessDialogKey', 'IUvCRu4VOd', 'nCHCWrjQS4', 'fVpCCPUgyW'
Source: 0.2.invoice & packing list.exe.ad10000.9.raw.unpack, a3SImVRQIFAnlduMwN.cs	High entropy of concatenated method names: 'ftry4m9djd', 'fu5y5RNfOd', 'J8guR3DhKx', 'zHHuWeHSjW', 'zYFywBOO42', 'rAcyeyX2Wm', 'tuEyoYpQwm', 'NRLyfREgu8', 'JgvyaUps9J', 'YdAyVbv0GA'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, x6benKwwZ9OwZYvEPhn.cs	High entropy of concatenated method names: 'ToString', 'VSP3618CtA', 'xeh39qOQIy', 'xHq3sxK7ey', 'QKn3AgOVGb', 'V5a3Qjwcky', 'hBv3YcnJih', 'R343HW93pw', 'FnLW62HuhEV7M8yQfVG', 'Yrdk1oH22RnKmcAtAOV'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, NHwoM1feufwrIp88B7.cs	High entropy of concatenated method names: 'TjaHK8nL6T', 'k6wH7cfYmb', 'dSYYI47qIx', 'QbhYiMyCfP', 'xnMYdFZPI7', 'DlrYjQHgjP', 'go3YL71jjB', 'AhYYSKQxyt', 't1NYZFw4UN', 'UKpYhbXrOj'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, VJT7qa0GcUv7HvpF5g.cs	High entropy of concatenated method names: 's82k01XjC8', 'xk7kMWDN2a', 'MVLkOSmlmX', 'Kqmk1jXlMq', 'DjokKHi0ah', 'UHrkpJiWlf', 'DfVk730jki', 'MWDkrkKROV', 'yMckbyMxh3', 'allkg8P9HJ'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, aY32ngbTNeQthivMBh.cs	High entropy of concatenated method names: 'ToString', 'B5wUwkIEKn', 'ICEU8y1pp5', 'zGQUIdi6Yk', 'bCSUi1oDLS', 'RtEUdTIPJM', 'SsjUjYQg99', 'tpTULwdGGI', 'u3fUS3c3UV', 'oJpUZWE20I'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, bjS7XK30X9MGr4KoTc.cs	High entropy of concatenated method names: 'D2BWkSxUkq', 'sGoWqRGJ4v', 'pleW2BRIQj', 'R4BWml4h3L', 'QNWWDA9wS8', 'ANxWU8iRhX', 'JkQSGOtnKHu1nTjyZD', 'MRPl3WxGhfE0PhYE6K', 'feuWWnVAA1', 'QNrW65oNTm'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, jHYnMeOpB2i33fdhPK.cs	High entropy of concatenated method names: 'JtEY1AF6UQ', 'WQLYptfsXH', 'EXpYrDr5SO', 'WWMYbDOv7X', 'G1kYDOQcKe', 'VooYUMxsjU', 'n0hYyBIe6W', 'KFUYug5OLA', 'jMdYEmKQqd', 'S3eY3kRGII'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, Td6Ro8Ni3RtXwCuSkU.cs	High entropy of concatenated method names: 'AJmy2C0JKc', 'UKxymGnbN1', 'ToString', 'KdLyAJpH35', 'eaayQtiCTv', 'jIpyY9g5gd', 'hqtyHKZuRI', 'XRXyG5JZxS', 'xITykNIGjh', 'Crqyq5svsj'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, boeN8EZugYfTRxOApL.cs	High entropy of concatenated method names: 'PP36s8YSCR', 'XBX6A0ctCl', 'XI26Q5YSad', 'HsA6YVSQNw', 'gVs6H0VDmC', 'KTp6G4vIdO', 'TvV6kQnO5F', 'c166q4Zled', 'R9d6nQ7qwA', 'U7t62ikyau'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, zM27DOwKFXHJLIf69Xf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T8X3fLxdIs', 'F7n3a6aZ7B', 'DLW3VuEG3b', 'ewr3cKfNMy', 'Tgs3BiM6nJ', 'xRY3XBSgHc', 'WKv3NlLNRe'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, JPAuFR60HCnWvWaABo.cs	High entropy of concatenated method names: 'evZuAns7vC', 'Un8uQQZU7g', 'EiJuY36GOy', 'uINuHJyY3A', 'SK9uGWZMuM', 'il7ukYIO6I', 'rAVuqkwi2r', 'TQbunOkVHV', 'rgtu2jqurm', 'pdDum795lD'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, RoTI2YwtT6lNXfg1pmy.cs	High entropy of concatenated method names: 'hB8E0qBN8j', 'vhbEM3VPqb', 'wEdEONQ9BO', 'XZ2E1KU3DL', 'QCCEKeUVjj', 'jpkEpyZIQd', 'e5oE77TpGj', 'M1SErlDX76', 'QtpEbWv7el', 'y63EgHZvHB'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, pBUQqE1OKEYDSahrfn.cs	High entropy of concatenated method names: 'rKQEWweWEX', 'oLYE62bB6T', 'Rf3E9Fgk4r', 'hc5EAqlUXg', 'ydtEQeNFIK', 'R0TEHV88Gd', 'DAZEGcwi2V', 'qjVuN8FdtA', 'cyMu45QHPu', 'D2FuPfGOBX'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, NilmEEE0CH8Q7vyWme.cs	High entropy of concatenated method names: 'wKIuTu0RNE', 'kInu8fW2JI', 'hrquIgbww2', 'T3Qui585nc', 'hC0ufw6Ojk', 'N0sud33a3Y', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, T9YxjoU0gsyH6XRSVo.cs	High entropy of concatenated method names: 'vCBtrZw2vF', 'PXntb963d0', 'ofYtTiplwu', 'zXTt8ks425', 'a2dtiGF7jU', 'PQItdMinaG', 'Q8qtLEwr4J', 'XZVtSUe3Ki', 'L5MthJexUV', 'O17twxIF2F'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, aNy1cxcPoNsKYhTvd2.cs	High entropy of concatenated method names: 'WOWO967wR', 'Aic14bKHY', 'NsLpwBq0p', 'FN77d83oE', 'syTbZIAUR', 'ieDgU1B0x', 'xV3xN9GFbAgaMFBLSr', 'iLLIGZaGfe2eGAjW68', 'VF0udco3J', 'XwN3EsMqd'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, wDdWn8PJtKvMPM9vfi.cs	High entropy of concatenated method names: 'dy2Gs38uj9', 'l9ZGQlYVh6', 'HWDGH9fYl0', 'I43GkA116F', 'WstGq3k1Mv', 'auMHBwk8NX', 'EZiHXO5owM', 'QDFHNgoiFU', 'dgbH4EXpEo', 'uFnHPLNqLh'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, IsmbWLLylsNbQBJICW.cs	High entropy of concatenated method names: 'Lb4Qfsf5pH', 'AdIQa7AiVe', 'CbjQV2Iu3q', 'BIsQcCUQBD', 'dq2QB2sxPX', 'UBnQXVc8wP', 'jHYQNwDBYf', 'cm0Q4kEFHq', 'k9LQPuvq2y', 'neBQ5qRlZT'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, qjLOrWra3YQuKSIDmX.cs	High entropy of concatenated method names: 'Dispose', 'CgfWP3kEYE', 'EkOC8uSJKp', 'NhOvvfL6F8', 'MWvW5UAuWL', 'TCtWztLLyV', 'ProcessDialogKey', 'IUvCRu4VOd', 'nCHCWrjQS4', 'fVpCCPUgyW'
Source: 0.2.invoice & packing list.exe.422c0a0.4.raw.unpack, a3SImVRQIFAnlduMwN.cs	High entropy of concatenated method names: 'ftry4m9djd', 'fu5y5RNfOd', 'J8guR3DhKx', 'zHHuWeHSjW', 'zYFywBOO42', 'rAcyeyX2Wm', 'tuEyoYpQwm', 'NRLyfREgu8', 'JgvyaUps9J', 'YdAyVbv0GA'

Source: C:\Users\user\Desktop\invoice & packing list.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: invoice & packing list.exe PID: 6616, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\invoice & packing list.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 24A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 2640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 4640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 8770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 7100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 9770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: A770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: AD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 8770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Memory allocated: 4C40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe	Window / User API: threadDelayed 1125			Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Window / User API: threadDelayed 4351			Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 6568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7276	Thread sleep count: 1125 > 30	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7276	Thread sleep count: 4351 > 30	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99116s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98769s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -98091s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97216s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -97109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe TID: 7272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\invoice & packing list.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\invoice & packing list.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99116	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98769	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 98091	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97216	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 97109	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: invoice & packing list.exe, 00000002.00000002.2873751221.00000000011FE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3

Source: C:\Users\user\Desktop\invoice & packing list.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

Process created: C:\Users\user\Desktop\invoice & packing list.exe "C:\Users\user\Desktop\invoice & packing list.exe"

Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Users\user\Desktop\invoice & packing list.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Users\user\Desktop\invoice & packing list.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\invoice & packing list.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.invoice & packing list.exe.36edbe0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.invoice & packing list.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36b31c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36b31c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2874078879.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice & packing list.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: invoice & packing list.exe PID: 6324, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\invoice & packing list.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\invoice & packing list.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\invoice & packing list.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\invoice & packing list.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.invoice & packing list.exe.36edbe0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.invoice & packing list.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36b31c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36b31c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2874078879.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice & packing list.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: invoice & packing list.exe PID: 6324, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.invoice & packing list.exe.36edbe0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.invoice & packing list.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36b31c0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36edbe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice & packing list.exe.36b31c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2874078879.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice & packing list.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: invoice & packing list.exe PID: 6324, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
invoice & packing list.exe	11%	ReversingLabs
invoice & packing list.exe	30%	Virustotal		Browse
invoice & packing list.exe	100%	Avira	HEUR/AGEN.1310026
invoice & packing list.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.techwiser.in	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://mail.techwiser.in	1%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high
mail.techwiser.in	162.241.123.30	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://account.dyn.com/	invoice & packing list.exe, 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	invoice & packing list.exe, 00000002.00000002.2874078879.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873691975.00000000011F2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.galapagosdesign.com/staff/dennis.htm	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	invoice & packing list.exe, 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2874078879.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.fontbureau.com/designers/frere-user.html	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2879639896.0000000006845000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2879639896.0000000006845000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001157000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873127457.0000000001191000.00000004.00000020.00020000.00000000.sdmp, invoice & packing list.exe, 00000002.00000002.2873691975.00000000011F2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.techwiser.in	invoice & packing list.exe, 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.urwpp.deDPlease	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	invoice & packing list.exe, 00000002.00000002.2874078879.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	invoice & packing list.exe, 00000000.00000002.1689367239.0000000006B52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.241.123.30	mail.techwiser.in	United States		46606	UNIFIEDLAYER-AS-1US	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427730
Start date and time:	2024-04-18 02:20:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	invoice & packing list.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 156 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:20:53	API Interceptor	28x Sleep call for process: invoice & packing list.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.241.123.30	Draft Sales contract.exe	Get hash	malicious	AgentTesla	Browse
	signed documents and BOL.exe	Get hash	malicious	AgentTesla	Browse
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla	Browse
	#568350035791.exe	Get hash	malicious	AgentTesla	Browse
	shipping documents and ETA.exe	Get hash	malicious	AgentTesla	Browse
	shipping documents and ETA.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATION.exe	Get hash	malicious	AgentTesla	Browse
	https://t.co/hkbALnjMCQ	Get hash	malicious	HTMLPhisher	Browse
172.67.74.152	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.techwiser.in	Draft Sales contract.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	signed documents and BOL.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	#568350035791.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	shipping documents and ETA.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	shipping documents and ETA.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
api.ipify.org	ZG17uv37pi.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	ZG17uv37pi.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.FileRepMalware.7644.21541.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	payload.js	Get hash	malicious	Unknown	Browse	104.26.13.205
	payload.js	Get hash	malicious	Unknown	Browse	172.67.74.152
	Payment Advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Draft Sales contract.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Bank slip.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SHARPIL RAT.exe	Get hash	malicious	SHARPIL RAT	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	Draft Sales contract.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	Bank slip.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FQuantexa/IpoXF42991IpoXF42991IpoXF/bWFzc2ltb2JvcnJlbGxpQHF1YW50ZXhhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.185.104.70
	QUOTATION-#170424.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	PURCHASE ORDER LISTS GREEN VALLY CORP.bat	Get hash	malicious	GuLoader	Browse	173.254.31.34
	draft bl_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.13.234
	signed documents and BOL.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
	DN.exe	Get hash	malicious	AgentTesla	Browse	50.87.253.239
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	198.57.242.153
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla	Browse	162.241.123.30
CLOUDFLARENETUS	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Heuristic.HEUR.AGEN.1343277.7061.14046.exe	Get hash	malicious	Unknown	Browse	172.67.184.140
	https://windowdefalerts-error0x21906-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.67.176.240
	https://windowdefalerts-error0x21903-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.66.44.169
	https://windowdefalerts-error0x21905-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	104.21.56.41
	SecuriteInfo.com.Heuristic.HEUR.AGEN.1343277.7061.14046.exe	Get hash	malicious	Unknown	Browse	104.21.75.251
	https://windowdefalerts-error0x21908-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.66.47.160
	https://windowdefalerts-error0x21904-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.66.44.151
	https://windowdefalerts-error0x21902-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	104.21.56.41
	https://groun-93ed.ehajdranrsuw.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ZG17uv37pi.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	ZG17uv37pi.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://mitchellind.ubpages.com/mi-ind/	Get hash	malicious	Unknown	Browse	172.67.74.152
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.FileRepMalware.7644.21541.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payment Advice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Draft Sales contract.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Bank slip.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FQuantexa/IpoXF42991IpoXF42991IpoXF/bWFzc2ltb2JvcnJlbGxpQHF1YW50ZXhhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	SHARPIL RAT.exe	Get hash	malicious	SHARPIL RAT	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\invoice & packing list.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.342567089024067
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeRHKx1qHKHxvj:iqlYqh3ou0aymsqwtI6eqzqqxwqRb
MD5:	83A6E29FD802325CCCB720870B60C618
SHA1:	4CD8AC6CA2659E4E32D1B27A8A4E77ABF980EE43
SHA-256:	A81A5B984180553C06E7C9CAE0BAF7E195950801F493996F48FA59F1ACC135B2
SHA-512:	69CC81145ACCA3D5C154D3A11396C2AFAEC4135662A82124EA249817BE7066D782DE2C79FE985E23F32F9709C144E2C513C727CFD1A88D677F34EB25E868B560
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.963304670236745
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	invoice & packing list.exe
File size:	677'888 bytes
MD5:	e9de39ce29b4e19d9487d6517f5fe390
SHA1:	aa9300231e426c9d0cbffe0bcf36f047235e79a6
SHA256:	24390949599e57a802ea820e402befca0610937e51e19a4db8228235d0017a58
SHA512:	bf67fd485900c9279b9d6be034c4f98c8b2ea711e32dc86821b83d5be17612a0bb326206a6695852228fbbd7cdb72e4c5f152108454f63ea53c9b3669ff0c849
SSDEEP:	12288:GORgtsY15YRNYpMIhka5EzcCWee290ki+lMkmn4HA3eKzm1asfD:6P5S4MIXeeUn1mkmnqQeKzmwsfD
TLSH:	A7E42394EA595A1FE14E97FEB912602843F112EE8036D7DEDCC91CAA5CD038947C233A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....J f.................4..."......NS... ........@.. ....................................@................................

File Icon


Icon Hash:	0f235999b9792317

Static PE Info

General

Entrypoint:	0x4a534e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66204A0B [Wed Apr 17 22:15:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa52fc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa6000	0x2000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa3354	0xa3400	f3f7deba8085b8096e1a1136efe28769	False	0.9716752009954058	data	7.970575972972858	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa6000	0x2000	0x2000	03816a1292f607fe5427cccc1bc12e0a	False	0.850830078125	data	7.305034955062381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa8000	0xc	0x200	ca268675f2a438a2d3d0c0dc895171a3	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa6100	0x1834	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9917688831504197
RT_GROUP_ICON	0xa7944	0x14	data	1.05
RT_VERSION	0xa7968	0x350	data	0.43985849056603776
RT_MANIFEST	0xa7cc8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 02:20:56.766282082 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:56.766336918 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:56.766411066 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:56.773417950 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:56.773433924 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:57.004425049 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:57.004511118 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:57.007452965 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:57.007484913 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:57.007895947 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:57.058218002 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:57.065417051 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:57.112123966 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:57.306142092 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:57.306288958 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 18, 2024 02:20:57.306361914 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:57.312591076 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 18, 2024 02:20:58.016705990 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:58.176745892 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:58.176855087 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:58.730129957 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:58.730572939 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:58.891308069 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:58.891463041 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:59.053905964 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.054390907 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:59.221674919 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.221709967 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.221730947 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.221817017 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:59.247426987 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:59.408389091 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.411334038 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:59.571712017 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.572665930 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:59.734268904 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.734637022 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:20:59.935652018 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.986987114 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:20:59.987281084 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:21:00.147273064 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.147380114 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.147694111 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:21:00.348604918 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.358428955 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.358689070 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:21:00.518589973 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.518775940 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.519329071 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:21:00.519556999 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:21:00.519586086 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:21:00.519644976 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:21:00.679521084 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.679792881 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.680624962 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:21:00.730093956 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:22:37.808825016 CEST	49735	587	192.168.2.4	162.241.123.30
Apr 18, 2024 02:22:37.969960928 CEST	587	49735	162.241.123.30	192.168.2.4
Apr 18, 2024 02:22:37.970561981 CEST	49735	587	192.168.2.4	162.241.123.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 02:20:56.656342983 CEST	58579	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:20:56.760756969 CEST	53	58579	1.1.1.1	192.168.2.4
Apr 18, 2024 02:20:57.783555984 CEST	64164	53	192.168.2.4	1.1.1.1
Apr 18, 2024 02:20:58.014494896 CEST	53	64164	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 02:20:56.656342983 CEST	192.168.2.4	1.1.1.1	0xee31	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:20:57.783555984 CEST	192.168.2.4	1.1.1.1	0x82cb	Standard query (0)	mail.techwiser.in	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 02:20:56.760756969 CEST	1.1.1.1	192.168.2.4	0xee31	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:20:56.760756969 CEST	1.1.1.1	192.168.2.4	0xee31	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:20:56.760756969 CEST	1.1.1.1	192.168.2.4	0xee31	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 02:20:58.014494896 CEST	1.1.1.1	192.168.2.4	0x82cb	No error (0)	mail.techwiser.in	162.241.123.30	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.74.152	443	6324	C:\Users\user\Desktop\invoice & packing list.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 00:20:57 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 00:20:57 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 00:20:57 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87607df15fb7676e-ATL
2024-04-18 00:20:57 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 18, 2024 02:20:58.730129957 CEST	587	49735	162.241.123.30	192.168.2.4	220-sh014.hostgator.in ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 05:50:58 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 02:20:58.730572939 CEST	49735	587	192.168.2.4	162.241.123.30	EHLO 305090
Apr 18, 2024 02:20:58.891308069 CEST	587	49735	162.241.123.30	192.168.2.4	250-sh014.hostgator.in Hello 305090 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 18, 2024 02:20:58.891463041 CEST	49735	587	192.168.2.4	162.241.123.30	STARTTLS
Apr 18, 2024 02:20:59.053905964 CEST	587	49735	162.241.123.30	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	02:20:51
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\invoice & packing list.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\invoice & packing list.exe"
Imagebase:	0x2e0000
File size:	677'888 bytes
MD5 hash:	E9DE39CE29B4E19D9487D6517F5FE390
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1686242139.00000000036B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:20:55
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\invoice & packing list.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\invoice & packing list.exe"
Imagebase:	0xa60000
File size:	677'888 bytes
MD5 hash:	E9DE39CE29B4E19D9487D6517F5FE390
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2874078879.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2874078879.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2874078879.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2872129268.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	3

Executed Functions

Function 06FB0EB9 Relevance: 1.6, Strings: 1, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tIh, xrefs: 06FB12A5

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 1ebef288b97d8112f2629c4b30161960255b64b01e6249f8e3de1df9c1b89d3e
Instruction ID: f9d79ce25809de595aad1868ed64c19c657ccf9d0777700b4a02ff105565b37b
Opcode Fuzzy Hash: 1ebef288b97d8112f2629c4b30161960255b64b01e6249f8e3de1df9c1b89d3e
Instruction Fuzzy Hash: A6D16E71E0520ADFDB44CF9AC8818AEFFB6FF89340B14E555E411AB254DB34A982CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB0EF0 Relevance: 1.6, Strings: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tIh, xrefs: 06FB12A5

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 804ee5e96f363bd85472f70bc4ed78f7b7e1206dcd704776abf066c87b031749
Instruction ID: d4ab497253dbb563a9c09544b28452b47f1a235cc9413ae37e9d4aa2658785e4
Opcode Fuzzy Hash: 804ee5e96f363bd85472f70bc4ed78f7b7e1206dcd704776abf066c87b031749
Instruction Fuzzy Hash: 58D13C70E1520ADFDB44CF9AD8858AEFFB6FF88300B14E555E411AB254DB349982CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB43A0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24de1b9a9b96a38ea7182cf2241434d950aa1507c2bd6766d9978d6265e177d4
Instruction ID: f23795d093c8b9dc9906f09b17d5fc44d0ac51c21d1bef9da6a8df4814e78107
Opcode Fuzzy Hash: 24de1b9a9b96a38ea7182cf2241434d950aa1507c2bd6766d9978d6265e177d4
Instruction Fuzzy Hash: 8D910571D15208DFDB48CFAAE6809DDFBF2FB89300F20A41AE416BB269D73099558F54

Uniqueness

Uniqueness Score: -1.00%

Function 06FB4390 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddeedcb427e3ae6d12c94454378076ece29cf63f17c6604dd90accc161685091
Instruction ID: 8211c28ea5062c2e493e0bcbcbf704ba653ae14608f6ed4efdbe10b7d540c6bf
Opcode Fuzzy Hash: ddeedcb427e3ae6d12c94454378076ece29cf63f17c6604dd90accc161685091
Instruction Fuzzy Hash: D8913971D15209DFDB48CFAAEA809DDFBF2FB89300F10A429E416B7269D73099458F54

Uniqueness

Uniqueness Score: -1.00%

Function 06FB4088 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee3e0be1ae3248d95c46adaf710b3ca6992fcf498d206cc913ee27e49d2a195
Instruction ID: 7cfa4e0c7fcbe6a825fa0fc3700011384b74c1e48f006d7ef0213e1e4dd32f03
Opcode Fuzzy Hash: cee3e0be1ae3248d95c46adaf710b3ca6992fcf498d206cc913ee27e49d2a195
Instruction Fuzzy Hash: AC812F75E00229CFDB44CFAAC9809EEFBB2FB98300F10A91AD511B7259D7359952CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB4079 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afec08a6ab3cd1310abb5db73e809418c20e3a9cf574c3d8cfd4851f237feb23
Instruction ID: 73a04f5faac84a60ddfcf73d9038af60b7dc1c2a8c27237ff822152d090a633f
Opcode Fuzzy Hash: afec08a6ab3cd1310abb5db73e809418c20e3a9cf574c3d8cfd4851f237feb23
Instruction Fuzzy Hash: 1C811275E00229DFDB44CFAAC980AEEBBF2FB98300F00A45AD511A7259D7359952CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB001E Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff53cc0276164d58812a6c7f4ac9f519919e35df9471d10745b9e5eb5bf39764
Instruction ID: d037ebcf17edf142f6da239d9d3d26614fbe536bc09286d78b5e5a984ba44623
Opcode Fuzzy Hash: ff53cc0276164d58812a6c7f4ac9f519919e35df9471d10745b9e5eb5bf39764
Instruction Fuzzy Hash: F1212D71E056488BDB18CF6BC8502DEBFB3AFC9300F14C0AAD408AA255DB755945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06FB0040 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b3a73b8d8a4032816ee80c3b4904d988cbe262fa69a98808ea67a70ef95848
Instruction ID: 8bbe385126e54d8a4495054c470e51c291f0b720fa2aa1cc2c9b955a0cfa30cc
Opcode Fuzzy Hash: d9b3a73b8d8a4032816ee80c3b4904d988cbe262fa69a98808ea67a70ef95848
Instruction Fuzzy Hash: 5421E7B1E016188BEB58CFABD8542DEFBF3AFC8310F14C16AD508A6258DF741A45CA90

Uniqueness

Uniqueness Score: -1.00%

Function 06FB1530 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3H5, xrefs: 06FB15CE
3H5, xrefs: 06FB15C0

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: 8b4bd4b9d17f90bed466ae34bfbb87f3e9bfd21f304a9b3db243dc34633f7fd7
Instruction ID: be55ecda361f24bc123c6c59b3c8266bd6be637b9f388cd051b4998d80bb58eb
Opcode Fuzzy Hash: 8b4bd4b9d17f90bed466ae34bfbb87f3e9bfd21f304a9b3db243dc34633f7fd7
Instruction Fuzzy Hash: 992128B0E11209DFDB44CFAAC550AAEFBF1FF89300F14D5AAD509AB254E7309A45CB85

Uniqueness

Uniqueness Score: -1.00%

Function 024EDB68 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1685652314.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24e0000_invoice & packing list.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 712d801894b2196b09e2cd38f4aa8dacffccdcda040cc9e9373735287abb224c
Instruction ID: 1b1be5f7c3ce666b66f08259dd225a6e5f4d172244ee177b0a23c7e072ec608f
Opcode Fuzzy Hash: 712d801894b2196b09e2cd38f4aa8dacffccdcda040cc9e9373735287abb224c
Instruction Fuzzy Hash: 8D712570A00B058FEB24DF29C44575ABBF9FF88305F048A2ED48A97B50D775E949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 024ED0F0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,024EDE39,00000800,00000000,00000000), ref: 024EE02A

Memory Dump Source

Source File: 00000000.00000002.1685652314.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24e0000_invoice & packing list.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d294bebf0560e2590ac96c1330e4988bcf58cb1cef001834872125cce336672c
Instruction ID: ce3c9a6953a4dcfb7be8611706dea556ad8fbd749805f7223c2100fe8f9fb5d3
Opcode Fuzzy Hash: d294bebf0560e2590ac96c1330e4988bcf58cb1cef001834872125cce336672c
Instruction Fuzzy Hash: 181103B69002188FDB20CF9AD444A9EFBF4EB48324F10846AE91AA7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 024EBE10 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,024EDB84), ref: 024EDDBE

Memory Dump Source

Source File: 00000000.00000002.1685652314.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24e0000_invoice & packing list.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0700e5c3fba4f0ec1ae907974dd793aba4060a602e60299c4a5c3ced1bf86ce9
Instruction ID: 1902ad3be829febbf5fe676afc993379080f2792670f5bc690f5ec453af42a9f
Opcode Fuzzy Hash: 0700e5c3fba4f0ec1ae907974dd793aba4060a602e60299c4a5c3ced1bf86ce9
Instruction Fuzzy Hash: E31102B5D00249CFDB20DF9AD444ADEFBF8EB89224F10846AD46AA7710C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3A6C Relevance: 1.4, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06FB5B39

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 27eb3496d32cd17e7f983a961bd91d4da2fc28a7e80f7a1a9eb88bf32444db57
Instruction ID: 8194a8e66ffcead7b2b00ab53ef783b62562c8363a6c8d782413a3a3b66a2fbb
Opcode Fuzzy Hash: 27eb3496d32cd17e7f983a961bd91d4da2fc28a7e80f7a1a9eb88bf32444db57
Instruction Fuzzy Hash: 7E517E31B002058FCB14EFB998848AEBBF6EFC47207148969E469D7395DF749D0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 06FB36BF Relevance: 1.4, Strings: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O};5, xrefs: 06FB3708

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: f728d9048f7e92f4b7777dc48e1475d6c07595454c934aa3552cc8237f6f9572
Instruction ID: 8b6cc50c9d2610c4d7ace2e7efcd3683829057bb05e90f6f6ac7082c02e3716d
Opcode Fuzzy Hash: f728d9048f7e92f4b7777dc48e1475d6c07595454c934aa3552cc8237f6f9572
Instruction Fuzzy Hash: CD41ADB5A24609EFDB84CF96D58489DFFB1FF89200B60D4D9D044AB3A5D7719A50CB00

Uniqueness

Uniqueness Score: -1.00%

Function 06FBB2B0 Relevance: 1.4, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06FBB3FE

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 1d8dc6b1a6e22ae2debea30d76498650b7f4767a49d16e54986f0e6114f5ec04
Instruction ID: c6a7329dd2c6762949429d2022a9a8d007d622364fb546ff9887cb68125494e3
Opcode Fuzzy Hash: 1d8dc6b1a6e22ae2debea30d76498650b7f4767a49d16e54986f0e6114f5ec04
Instruction Fuzzy Hash: DE311770E05208CFEB08DFAAD9446EEBFF6FF89300F14912AE416AB254EB755945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06FB36D0 Relevance: 1.3, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O};5, xrefs: 06FB3708

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 57f4a1e3f6fcb5bcaad305505cd05223b857e196a9361e61c93fd0d5f807af4e
Instruction ID: c484fabe8eb25b0128b19a5fd7cdfc12a8ed1c530b45c5037d77828556030596
Opcode Fuzzy Hash: 57f4a1e3f6fcb5bcaad305505cd05223b857e196a9361e61c93fd0d5f807af4e
Instruction Fuzzy Hash: A0417BB1A24609EFDB84CF96D5848AEFFF1FB89200F60E499D405E72A4DB709A50CB10

Uniqueness

Uniqueness Score: -1.00%

Function 06FBB2C0 Relevance: 1.3, Strings: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06FBB3FE

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 79c638e41dc46f893eb1b428f0fb44b8ab17a7335464f3cb8b5cd82ec66370f4
Instruction ID: cb72490442bfd0fa5ff797ab19b68b663f32943436838212cf08ce9f42f48e71
Opcode Fuzzy Hash: 79c638e41dc46f893eb1b428f0fb44b8ab17a7335464f3cb8b5cd82ec66370f4
Instruction Fuzzy Hash: C531E274E01208CBEB08DFAAD9456EEBFF6BF89300F14902AE41AAB254DB755945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06FBB33C Relevance: 1.3, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06FBB360

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 9ad16971b2a620c92a62e427f032bacc39c5ca00d5bed585049fd0c515da59a2
Instruction ID: e591175653c7f87e3bf92f95137454b873bcbc5b6e09f527fcc81658bc0c912d
Opcode Fuzzy Hash: 9ad16971b2a620c92a62e427f032bacc39c5ca00d5bed585049fd0c515da59a2
Instruction Fuzzy Hash: E731C275E04209CFDB04CFE9C8849EDBBB1FF48300F249129E919AB365C731A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3A5C Relevance: 1.3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 06FB5963

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b3325a638b67a12929ed693363a651e647284dec945fd6869aa2a165ffa2a669
Instruction ID: 81c858fa1a00e6bd1da48d1e399c2b01703e50f9afa9ca1adb22355354103203
Opcode Fuzzy Hash: b3325a638b67a12929ed693363a651e647284dec945fd6869aa2a165ffa2a669
Instruction Fuzzy Hash: 8C116031F102098BCB44EFB999505FEB6F6AFC4310F10447AD415EB254EB358D05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB1522 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

3H5, xrefs: 06FB15CE

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: 3H5
API String ID: 0-3899204960
Opcode ID: ee9bcbad89079c655d0d695202f19f9f3d93bdbd7857062f180e8b656097177b
Instruction ID: 75c0efc3ff58cb78eaf42e86f6418a0c61d0e8d33e6ffef083529486fcb83e0d
Opcode Fuzzy Hash: ee9bcbad89079c655d0d695202f19f9f3d93bdbd7857062f180e8b656097177b
Instruction Fuzzy Hash: 6C214AB0E11609DFDB44CFAAC580AAEFFF1EF8A300F14D1AAD105AB254D7309A45CB85

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE71A Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

'o!, xrefs: 06FBE71A

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: 'o!
API String ID: 0-3977600089
Opcode ID: f4c0bcec8cd46418fcb54597e50b49ec5cd26ca136d91d339b1fe3898aedda00
Instruction ID: 9e0d9556b750073b3c6c582f323f196b3635790b94fae6a134aa547864e8d2a8
Opcode Fuzzy Hash: f4c0bcec8cd46418fcb54597e50b49ec5cd26ca136d91d339b1fe3898aedda00
Instruction Fuzzy Hash: 0311F374A142588FDB40DFA9E4849DDBFB6FB49310F10A529E416AB388DB3198448F84

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE82D Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

sw{, xrefs: 06FBE834

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: sw{
API String ID: 0-3213569877
Opcode ID: 8ed555d8e8450609d9b63fcb4158f7522a18a14c1a3540eb0224486c9c0675e2
Instruction ID: 9741e033e49e1de694e0dff15dbb9028b0729523d0028494cdbd8e57ede24d59
Opcode Fuzzy Hash: 8ed555d8e8450609d9b63fcb4158f7522a18a14c1a3540eb0224486c9c0675e2
Instruction Fuzzy Hash: 52F030B8908318CFDB90DF10D944798BBF7EB84240F105195950A97316DBB09E85CF42

Uniqueness

Uniqueness Score: -1.00%

Function 06FB6F18 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b59296fafd86fe6cc6d1d2504d1ba692195fb57c3a76c9209d1a9f35db04b43
Instruction ID: 1c7ad3ae8ca77d84fe3f80e9b8c19a9598995851b6b504cf86294ddc3ad12c4a
Opcode Fuzzy Hash: 7b59296fafd86fe6cc6d1d2504d1ba692195fb57c3a76c9209d1a9f35db04b43
Instruction Fuzzy Hash: A951D631E00115DFDB409B9AD894AFEBFB2EF84340F44A06AE505EB294D776D941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB6F08 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05537d41e70b606fe7e63466ae9ae47c0b7f8ac1d58cd872b30d4837fb83c459
Instruction ID: 8cf9d6d39bf2dd6846440929e45817df5dc139066d58ba4f2cf8af98c3df759a
Opcode Fuzzy Hash: 05537d41e70b606fe7e63466ae9ae47c0b7f8ac1d58cd872b30d4837fb83c459
Instruction Fuzzy Hash: F251A332E00215DFDB40DF9AD885AFDBFB6EB84301F44A06AE511EB290D736D941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBB48 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25479f924e075967eb87f73af2390ab81fbabd28656a5f032340e0a30035f6cb
Instruction ID: 5237418c3b598f45cb17afc289f1ed1ec0392930880473e268e916021478b4ba
Opcode Fuzzy Hash: 25479f924e075967eb87f73af2390ab81fbabd28656a5f032340e0a30035f6cb
Instruction Fuzzy Hash: 1B41FAB5D09209CFEB48CFAAC4446EEBBF6AF8C301F14E069D419A3255DF345941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3568 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355ade067eacb5f33682be1caab1c8e7a3faf3f718944d272b4b6a70e980de0b
Instruction ID: 6ccc05c10778b8a3d41bfb69d12899281beebc7abdbd1d35303a2b45ceeb53ae
Opcode Fuzzy Hash: 355ade067eacb5f33682be1caab1c8e7a3faf3f718944d272b4b6a70e980de0b
Instruction Fuzzy Hash: 4541B1B49186849FD306CBA9D494988BFB0EF8A211F1680D6D484DB3B3DB359985CB12

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBB39 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c486ad1fa7dde372bc116c378bb0b199d3d24338eb3442fd0d501d3b9b743df
Instruction ID: 144a0c59f96bd25549199803bd2c693e18d19d175bbe2bc5b2ff1b4959ae6167
Opcode Fuzzy Hash: 1c486ad1fa7dde372bc116c378bb0b199d3d24338eb3442fd0d501d3b9b743df
Instruction Fuzzy Hash: 6041E9B5D09208CFDB48CFAAD9446EEBFF6AF8D301F14E06AE419A3255DB344941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBCE1 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4baaeb2664d385ad75a2a607234519341240967b8b0e464a42bb22f44ea2ff
Instruction ID: d89256bb350672713803a3a7932c5bc879308e13af6ca7a27dc0033555e778cd
Opcode Fuzzy Hash: db4baaeb2664d385ad75a2a607234519341240967b8b0e464a42bb22f44ea2ff
Instruction Fuzzy Hash: 97310774D09209DFDB84CFA6D5819FEBBBAEB4D301F206055E40AA7251CB345A41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB8A68 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ee35fc58c023c12c363a9b091a7a65caa069d1dfbbefb9f761f35dac330fe3
Instruction ID: 1a1fbd4be9c034ca5e6d93de4d6892f1c149b03042fbb3c2cb23e19ba9e5a536
Opcode Fuzzy Hash: 50ee35fc58c023c12c363a9b091a7a65caa069d1dfbbefb9f761f35dac330fe3
Instruction Fuzzy Hash: DA41B231E08215DFD380DBAAC885AFA77EEEB80381F49A0B6E525D72D1C334D940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3858 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ee2c9792b76aa9a2d04fd2bf7d3200eff765ba1860597d8ccf8b12c5b63efb
Instruction ID: 22914c79ee2d28b8b65aa5449b342d6bebbcee9a52d88cb18aafbe9a5a8d6941
Opcode Fuzzy Hash: d2ee2c9792b76aa9a2d04fd2bf7d3200eff765ba1860597d8ccf8b12c5b63efb
Instruction Fuzzy Hash: 3D41AE76E0420ADFDB45CF95D8419EEBFB2FB89310F10A529D504A7394D7709A81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3852 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095e40f926f13fa3e54339de1a8ca102b9ebff473420fb0605f9a9ab74967247
Instruction ID: 5450d15ad78f05e030d3b9fcf8cc400ac1bc27d36d9eeb58b77220ad11065eb7
Opcode Fuzzy Hash: 095e40f926f13fa3e54339de1a8ca102b9ebff473420fb0605f9a9ab74967247
Instruction Fuzzy Hash: A8418B76E0420A9FDB45CF99D8419EEBFB2FB89310F10A529E504B7394D7709A818FA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB6B40 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61b7e4bcb27906d713bb3ec1d55f4a9edeaed2963d2ee3005bdd937cd6c52f4
Instruction ID: 950f6848c7d102fa534dde6d4d625ebbc51a5fa6f3e59bec474f778117796d08
Opcode Fuzzy Hash: d61b7e4bcb27906d713bb3ec1d55f4a9edeaed2963d2ee3005bdd937cd6c52f4
Instruction Fuzzy Hash: 89312871900209EFCB50DFAAD844ADEBFF9FB89310F10846AE519E7211D735A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBE88 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94eb9c1f49b81ac3dedf54648d4474ab331a7325d90d9d2f7dd21a2ea06845fc
Instruction ID: 9e126e77443ca5e8c865b80641689a1e0b4770f9c58ca9ef339e95ad97f09a44
Opcode Fuzzy Hash: 94eb9c1f49b81ac3dedf54648d4474ab331a7325d90d9d2f7dd21a2ea06845fc
Instruction Fuzzy Hash: 48314A75E09218DFDB44CFAAD844AEDBBF5FF89300F0090A9E805A7261DB319A40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D06C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685197350.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8051e52722fa27454d969e6e6aedba71f4ed283f6723f52027e5d2bad47018e0
Instruction ID: 9f0861e8f41b6d29aaf63c520632487cce99b4193c03d0a84751b5e0d2c7ada8
Opcode Fuzzy Hash: 8051e52722fa27454d969e6e6aedba71f4ed283f6723f52027e5d2bad47018e0
Instruction Fuzzy Hash: EB212471100200DFCB059F14C9C4B26BFA5FB88314F2086A9ED091B256C33AC916EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D5C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685197350.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a5d9d8f31f58b10db24da53249dc72c88e4a20056c096ae82aa57dc20836dc
Instruction ID: 91e8db8feb2613353fec5b79d4703555004e45118d027bab58d0ed2997320463
Opcode Fuzzy Hash: 10a5d9d8f31f58b10db24da53249dc72c88e4a20056c096ae82aa57dc20836dc
Instruction Fuzzy Hash: 6D212571500200DFCB05DF14D9C4B2ABFA5FB94314F20C5ADE9090B25AC336D956E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D2F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685296209.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b5d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12db482e1332f8fab0520577651e9695958f60ef031060a75fb2ee9ba392411b
Instruction ID: 957c5803f65e32b77e2606dce61aa8712b4b8e1c6963a433cc5aa7be2200c745
Opcode Fuzzy Hash: 12db482e1332f8fab0520577651e9695958f60ef031060a75fb2ee9ba392411b
Instruction Fuzzy Hash: C32104B1604204DFDB24DF14D9C4B26BBA5FB84315F20C6EDDC494B356C37AD84ACA66

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685296209.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b5d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9fed8e8f8cb9dbe44188333cf4b0bf1285276784c1244afdda5b7ac67cd012
Instruction ID: ab4bae8f6aad8ebf4149c16612ffd31734f5ac221c7d905a42c6a5475655bc8c
Opcode Fuzzy Hash: 4a9fed8e8f8cb9dbe44188333cf4b0bf1285276784c1244afdda5b7ac67cd012
Instruction Fuzzy Hash: C721F271604240DFDB24DF14D9D4B26BBA5EB88315F28C6EDDD0A4B296C33AD84BCA61

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD1B1 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47bcd1a7639bc6ca6b5564f99d979fc24ed1389da1b9a82621ef06c453d1a2b4
Instruction ID: 78887f2da45fd06bf82e55b3f2ab80c5b26e16af0a638baabe7a63ebc28087ca
Opcode Fuzzy Hash: 47bcd1a7639bc6ca6b5564f99d979fc24ed1389da1b9a82621ef06c453d1a2b4
Instruction Fuzzy Hash: 68216270D05349AFD780DFA9DC05AEEBFF5AF44200F0585AAE414E7252E7749605CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 06FB5B7E Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7757c0f2d9b5a764c477f8078691d55667444763713a0cf8c267d86f04a378
Instruction ID: 1363575eaf485787fc7661d0af8c0ee0ae993637442ad84292aaaf8190b406fd
Opcode Fuzzy Hash: 5c7757c0f2d9b5a764c477f8078691d55667444763713a0cf8c267d86f04a378
Instruction Fuzzy Hash: 4831C0B4D012189FDB60DFAAC989BCEBFF5EB08714F248459E404BB250C7B95885CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3C0C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba5ebe7002c9d6436447f3b24460cf23866d2877e137e2f6e4c7f71ee56145a
Instruction ID: b13af3cb880ee50ce42bc700e4e7e20a2dd85628568535e6b2889512877eae6f
Opcode Fuzzy Hash: aba5ebe7002c9d6436447f3b24460cf23866d2877e137e2f6e4c7f71ee56145a
Instruction Fuzzy Hash: E631CEB4D01218DFDB60DFAAC989BDEBFF5AB08314F249459E404BB250C7B95885CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06FB6B14 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbb131a20323a83eaf9d9c94922c6faef42eb1677287459550a9350f1278da5
Instruction ID: e36786b2cbb30e1432b3aa19a27ecfa104555ef9a1fd9830941a4adfaeb48bee
Opcode Fuzzy Hash: abbb131a20323a83eaf9d9c94922c6faef42eb1677287459550a9350f1278da5
Instruction Fuzzy Hash: 2C11E762A18384AFCB41DB75CC15AAE7BF5EB51600F2444E9E805C7342ED35DD058361

Uniqueness

Uniqueness Score: -1.00%

Function 06FB8968 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1942c038a5246fc2cc22b3fb2c32f2049320b3935ebced751c6377acf016df38
Instruction ID: 34742820d64a41b0c433bea7c371148d6cb0edb154af4c9799f1edcc0651ec36
Opcode Fuzzy Hash: 1942c038a5246fc2cc22b3fb2c32f2049320b3935ebced751c6377acf016df38
Instruction Fuzzy Hash: 0011E931F44344EFEF555A07CC09BA57A6FEBC2F81F195066E1215F1D5C632D840C642

Uniqueness

Uniqueness Score: -1.00%

Function 06FBCC22 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fc35391e24176d7e0d142caa370b484501d72e21adf103729e85659b51e51a
Instruction ID: f3847fa35a49f6fecb02696af9d9b5e878e0a916531e6ef55963ac693ec3693a
Opcode Fuzzy Hash: 76fc35391e24176d7e0d142caa370b484501d72e21adf103729e85659b51e51a
Instruction Fuzzy Hash: 44118B75E052189FD748CF6AC4448EEBFBAEF8D311F04D069E415AB251DB35A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06FB35F8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7599fa5d3055ca6dec2e657dfe91be188afdf5941a8328779e1946aadc707492
Instruction ID: e1fb2ea2d0b3645efdfe27bbee376f7b46e9fbe9fec27372e2a4de4144f4bf96
Opcode Fuzzy Hash: 7599fa5d3055ca6dec2e657dfe91be188afdf5941a8328779e1946aadc707492
Instruction Fuzzy Hash: 69219FB4A10908DFD744CF5AE084999BFF1FF88310F5280D8E8489B2A6DB719991CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685296209.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b5d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176584610317ad6545de6b627560e21ec37d87d73e5ac63d62231f7b3100ae79
Instruction ID: 52b9f7c6176e5b6cf69eceedbaf4f907d5d33778947c9c8f10861deca231ac0f
Opcode Fuzzy Hash: 176584610317ad6545de6b627560e21ec37d87d73e5ac63d62231f7b3100ae79
Instruction Fuzzy Hash: 272165755093C08FDB16CF24D594715BF71EB45314F28C6DAD8498B697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06FB59CA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ed71cecd79d3820da53f5ca457e0bbc678fbcee9ab9a7582299fa52d0dc3c0
Instruction ID: 3e3e16db97ff741ab0a114b8a5cd04ce637b71f38c8f7509e7db35ef47bba652
Opcode Fuzzy Hash: 55ed71cecd79d3820da53f5ca457e0bbc678fbcee9ab9a7582299fa52d0dc3c0
Instruction Fuzzy Hash: C81186B2F006155B9B64EE7A9C445FFBBFAEBC4660B154929E429E7340DF3099014760

Uniqueness

Uniqueness Score: -1.00%

Function 06FBC1F9 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb7e149ea62af0f6d15ae20b695723e4d40d98fa1375c8ae907066fe9b543eb
Instruction ID: 6af9f5b2d479d254b4b8f5e1e2f1bd05d86fe9d8608e41c9b0a8e53f349921b0
Opcode Fuzzy Hash: fbb7e149ea62af0f6d15ae20b695723e4d40d98fa1375c8ae907066fe9b543eb
Instruction Fuzzy Hash: 0F21F4B1D056588BEB58CFABC8043EEBFF6AFC9300F14D06AD408B6295DB7509458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBCF0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3083025c99df84c796084f855c063874da713d3794edf5e6a510ecaa3abb4ec1
Instruction ID: 802d2f9797eac4bf9b8b2af782945697862ec5c3fd1adc69851c9e21a9cf04a7
Opcode Fuzzy Hash: 3083025c99df84c796084f855c063874da713d3794edf5e6a510ecaa3abb4ec1
Instruction Fuzzy Hash: D521C7B4E09209DFDB80CFAAD1819EEBBF6AB4C300F60A0559819A7351DB749E40CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBD99 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85869c3947f1667e07f88c00c7c0fe42dc3cf170cc56a9abe56385a950d60ad
Instruction ID: bb13a74c25fd445078034d0f221f3b0e42326945bdde5296bbb6f9385eee02fd
Opcode Fuzzy Hash: b85869c3947f1667e07f88c00c7c0fe42dc3cf170cc56a9abe56385a950d60ad
Instruction Fuzzy Hash: 69112874D09208EFDB84DFAAD4859EEBBFAEF49300F11A5D5D40897256DB70AA41CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D067 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685197350.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 99e1490b0855bf150f59a974947bf6f595533b11ea97717507c0fa8202a52e17
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: C821DF76504280DFCB06CF00D9C4B16BFB2FB98314F24C2A9DD491B256C33AD926DB92

Uniqueness

Uniqueness Score: -1.00%

Function 06FB6B50 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de90bb4f09d1870da7a0a5fbb1b59ff47a33299d8b6d9fc9d99531eda2cf675
Instruction ID: 5e76e46dd65920a0fc3d3a6c7b32f0b1cc3fd79c924337b12019a3c748759cd6
Opcode Fuzzy Hash: 4de90bb4f09d1870da7a0a5fbb1b59ff47a33299d8b6d9fc9d99531eda2cf675
Instruction Fuzzy Hash: 6721D0B5D00249DFCB20DF9AD884ADEBFF4FB48320F10842AE959A7211C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D5C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685197350.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: fd83f3477bd17e9894d850ea06fb37c0399606f30a666eabc94b10c078e98788
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 7711B176504240CFCB16CF14D5C4B16BFB2FB94314F24C6A9D8490B256C336D95ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB5FDA Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed03498d9ab82148e61f99bc42756ab448f6581e01fb946ad7b7e0000c24a07
Instruction ID: 420f123b103d9cb4d95f9a7a4c98f120a82c9a70303aa64b5cf8e8b93f28b258
Opcode Fuzzy Hash: 4ed03498d9ab82148e61f99bc42756ab448f6581e01fb946ad7b7e0000c24a07
Instruction Fuzzy Hash: 9901B132B04204AFD304CB6ED884AABBBF9EFC9674B15806AF408CB350CA308C01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D2EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685296209.0000000000B5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b5d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 5dc6b70a77b045cac598093537eab135e80c531d76b484e9d97c0751b2758c16
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6011BB75504280CFDB11CF14D5C4B15BFA2FB84314F24C6EADC494B256C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06FBC208 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcecbff47ba2fa8404ad61bddbade1777163bd159db6442c3c5394f6efae2240
Instruction ID: 4b833f4f3314dc773e283d28b539cc747e1c589cf59898874df35d464c69f9a8
Opcode Fuzzy Hash: fcecbff47ba2fa8404ad61bddbade1777163bd159db6442c3c5394f6efae2240
Instruction Fuzzy Hash: E911D2B1D006188BEB58CFABD8457DEFEF6AFC8300F04D06AD408B62A4DB7509458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD000 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac174bf6591373de01777f4bb83f29d3e9263ab32f31c3d49006900cf3b0b0f9
Instruction ID: 93241a1500cecb7a1ec47be92165032af4595b2ba46664156200c4a0fe143f76
Opcode Fuzzy Hash: ac174bf6591373de01777f4bb83f29d3e9263ab32f31c3d49006900cf3b0b0f9
Instruction Fuzzy Hash: 8B01473090E145CFD341CB16C5809F9BFB99F8A344B04B191E4198B15BC7365A0BCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD078 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3f09d14b2309a47a1ea692ba69eac5f2c9f5a5f04f6d69ab1eb45c663858da
Instruction ID: f0115748239e5e25d8dfbe702b0cc6a61ba5cacf86b818d8013a0ee0b3cbdaad
Opcode Fuzzy Hash: 9c3f09d14b2309a47a1ea692ba69eac5f2c9f5a5f04f6d69ab1eb45c663858da
Instruction Fuzzy Hash: 6501DE35A08148DFC740CBA9C9859E9BFF6AF8A300B14A1C0E4098B2A6C7319E02DB42

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBDA8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6c960bab5da6fbe99398c835cb4ebaa911f9e99b0e9b0ce684b4df86f74639
Instruction ID: 7565c1e42f995e401beb2862154940d0e31cef0b96f46446547c1c53ca2cbc9d
Opcode Fuzzy Hash: 9a6c960bab5da6fbe99398c835cb4ebaa911f9e99b0e9b0ce684b4df86f74639
Instruction Fuzzy Hash: 8011B774E09208DFDB84DFAAD5819EDBBFAFF48310F11A5959418A7316DB70AA41CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06FBCC38 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e470d505e3bc23538deda475e702ffc75791d3708d230a65fcda041e6bf14500
Instruction ID: 20ad72db4a5df7b21d2d20f167b5d4a35e3089ea84d675c2cf37c4ae285e9cbb
Opcode Fuzzy Hash: e470d505e3bc23538deda475e702ffc75791d3708d230a65fcda041e6bf14500
Instruction Fuzzy Hash: 6D11F775E042089FDB48CFAAD4449EEBFBAAF8D311F04E069E419A7351DB319981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06FBAE08 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc06eaf077abc0aa0dfb945c3534d23924de6abad03299981184e63a915c08b
Instruction ID: 65e6f26c99b61d6a2a2f76aaf39336c0c475d8f19bacfd83b699cd851ca9898d
Opcode Fuzzy Hash: 0bc06eaf077abc0aa0dfb945c3534d23924de6abad03299981184e63a915c08b
Instruction Fuzzy Hash: 5011E274D0921CCFEB91CFA6E994BDCBBB5FB09305F5061A9E00AA2288D77549C4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06FBDF21 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6465e3d5dda1f5376bf2a018c924e80badfafdc0b830df9dc09aae1c9dee9a11
Instruction ID: 754c290b9be44e26530e5c25c265923bfdfb26fee8d47fca722352246317c8b4
Opcode Fuzzy Hash: 6465e3d5dda1f5376bf2a018c924e80badfafdc0b830df9dc09aae1c9dee9a11
Instruction Fuzzy Hash: B1113974D09249AFCB80DFA8D8459EEBFF5BF49300F14819AE854E7381D7349A40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D92D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685197350.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc3141915da1958ed3cc7799a340845af78c170a21c222909756f96a75b89d4
Instruction ID: b64bf1e7753af505a81ca296cbfeae72ffd6b84993931760ebcb9a4a77879433
Opcode Fuzzy Hash: 9cc3141915da1958ed3cc7799a340845af78c170a21c222909756f96a75b89d4
Instruction Fuzzy Hash: 9601D671108340DAE7108F2ACDC476BFFE8EF51324F18C8AAED598A286C679DD40E671

Uniqueness

Uniqueness Score: -1.00%

Function 06FB39FA Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415e0cd3dbd6d9d819c3def20214c49778f22dc293bcb0f9f19829f395d9ba3
Instruction ID: 25966d5bf3d2aa38b90182eafb5663807d3389fb5f2be76aa640e1382783e4c6
Opcode Fuzzy Hash: 1415e0cd3dbd6d9d819c3def20214c49778f22dc293bcb0f9f19829f395d9ba3
Instruction Fuzzy Hash: 9701F66246E7E05ED7436B7849744C13FB09E53100B0B50D3C0D0CE0F3E4488A4DD7AA

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE692 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fe8b205df8bca7454d9cd4562c7204a06d685cd946f1220cdcad3e9b2c7ebc
Instruction ID: e888a87346bfefcbc73e6706a65dde46100b65efd31fa6916e16180983e5a188
Opcode Fuzzy Hash: 10fe8b205df8bca7454d9cd4562c7204a06d685cd946f1220cdcad3e9b2c7ebc
Instruction Fuzzy Hash: 2101F7B9918204DFD751DBB5E4047E87FBABB4A300F00A121A006D735ADB7096498FD2

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE6E9 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9566ac01d20144108a266a2ebc07093b28f88439531003bd8bfa7ff671a2d4
Instruction ID: 762a8af38df4204b4e60b8a6665af80a193f3eb4dc8c06825da1783165da2476
Opcode Fuzzy Hash: fd9566ac01d20144108a266a2ebc07093b28f88439531003bd8bfa7ff671a2d4
Instruction Fuzzy Hash: 36113674A05258CFDB50DF68E484AE97FF6FB09300F14A1A9E80987351CB70A881CF42

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD088 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df6c873a36f181a9f42af6e31e50034f4470fff16efbf454b0061e0a4e4f620
Instruction ID: dd478b3f1bf20b8b4a3ca124b95c4099d1e372de72b3fd7a44e170ab036ae512
Opcode Fuzzy Hash: 0df6c873a36f181a9f42af6e31e50034f4470fff16efbf454b0061e0a4e4f620
Instruction Fuzzy Hash: 63014B35A08108DFD744DFA9C585AADBFF9AF48300F25E094A4099B365CB31DE41DB41

Uniqueness

Uniqueness Score: -1.00%

Function 06FB5F3C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55db2894780cfaed1042240679a77a3b4c31c960e8a79111321099bc58a114ef
Instruction ID: 1b681c2f50fdd4016d0c3f421af2d0f42800bca4a5433d127bfffdd3cd44f557
Opcode Fuzzy Hash: 55db2894780cfaed1042240679a77a3b4c31c960e8a79111321099bc58a114ef
Instruction Fuzzy Hash: EE010871D00219EFEB51CFAAC8483EEBAF5FF48750F148565E424AB2A0D7788A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FBB421 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f78c0e749ab02a3b0222447819263390702226cc09b827f0c33e793236410c
Instruction ID: f6b640dd4e72f4d9c7b91beec155a1c91d1d1f20d98ce3daf617856c51cbddb6
Opcode Fuzzy Hash: 49f78c0e749ab02a3b0222447819263390702226cc09b827f0c33e793236410c
Instruction Fuzzy Hash: 1A011A74E05208CFEB04DFA5D9856EDBFF6FF49301F24A029E406AB245EB348A40CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06FB161A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73a641440e38d06ee0bcc3c355b7b46535a8d13410956ae8bab6e82a9d64e64
Instruction ID: 872ca44edd1e8f351009924fe5536049f11c7247c655108feef837917388169e
Opcode Fuzzy Hash: a73a641440e38d06ee0bcc3c355b7b46535a8d13410956ae8bab6e82a9d64e64
Instruction Fuzzy Hash: E701D675E00208AFDB04DFA9C985A9DBFF5EF88700F05C198A448AB3A1DB319A40CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD010 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372cf42f5936ce8c44b0e783bef3485f61ff66db6817ae6c47f5eb4200a7ed7e
Instruction ID: 58d5883a33f6294fcfd10f6434a312abd039843788a335cc74f48375b80b36d8
Opcode Fuzzy Hash: 372cf42f5936ce8c44b0e783bef3485f61ff66db6817ae6c47f5eb4200a7ed7e
Instruction Fuzzy Hash: CFF03C71909108DFD744DB67D5809EDBFB8AF89380F00B1A5D4095B219D7319A46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBE31 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e811ae41da3ea5b886bf3c14dce6ea2683a00faba8403adcc445cfbdc80f8d81
Instruction ID: 0908b3d342901f0b2c1d874185b01b00f2a27d1bd0cfef91b141cdb98a7103fe
Opcode Fuzzy Hash: e811ae41da3ea5b886bf3c14dce6ea2683a00faba8403adcc445cfbdc80f8d81
Instruction Fuzzy Hash: 8BF06D70D0A308EFDB45CF75D8048EDBFB8EB4A201F0091E9E84593262D7315A50DF90

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD208 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17331b6ee7df74187676e2fcd4896f04681195306cf6b980799e337073e67112
Instruction ID: e7a3d7c4925c7958e9b90600eaa5563e18e4ce6604a5d60eda56e4bc2e145d3e
Opcode Fuzzy Hash: 17331b6ee7df74187676e2fcd4896f04681195306cf6b980799e337073e67112
Instruction Fuzzy Hash: 63F04F70D0424AAFDB90DFA9D845AEFBFF5AF48200F008969E504E7241E774D6408FE2

Uniqueness

Uniqueness Score: -1.00%

Function 06FBDF30 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef9d776e01e94807639b59dc6dca6bef1a106a44e0263aadfa68aef9b35508f
Instruction ID: 61fff15587bd4b98a31ba491092366192b8fe450ef8f05c2577bb809bbb19721
Opcode Fuzzy Hash: 0ef9d776e01e94807639b59dc6dca6bef1a106a44e0263aadfa68aef9b35508f
Instruction Fuzzy Hash: 4D01D774D042499FCB40DFA9D4419AEBFF5BF08301F108196E854E3241D6349A80DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE6A0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec28ed5432f907b13b7b2cfbd21b3f55b93ab73377e27e113b7043ad8193bb42
Instruction ID: 9b60ac958f3d7ad2767655072b4be8af0bf5a73035f48759dd3c118b26210be5
Opcode Fuzzy Hash: ec28ed5432f907b13b7b2cfbd21b3f55b93ab73377e27e113b7043ad8193bb42
Instruction Fuzzy Hash: 00F081799042089FEB44EBB9D4446EDBFBEBB8A340F00A5249006A6358DB7095458F92

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D92C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685197350.0000000000B4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b4d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641809e3312e0461b0f3c70ce7b5e055da6cd0d25ac609df6e0079036d14eb93
Instruction ID: 2ef0186e72087b2b38c88537e08fc72845dacdaf5d0776efcc96cafda3e2042d
Opcode Fuzzy Hash: 641809e3312e0461b0f3c70ce7b5e055da6cd0d25ac609df6e0079036d14eb93
Instruction Fuzzy Hash: A5F06271504344AAE7108E16C8C4B66FFE8EB51724F18C89AED484A286C2799C44DA71

Uniqueness

Uniqueness Score: -1.00%

Function 06FBEC24 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57bc03797fe8adba3934664e0bab3e91b4ad9c90ef29ae64450b9dd4a6ea4973
Instruction ID: a44eac243e9e292b03a578e6e0a1b92ae31191c76df6e543f4fa7331ba49e9e5
Opcode Fuzzy Hash: 57bc03797fe8adba3934664e0bab3e91b4ad9c90ef29ae64450b9dd4a6ea4973
Instruction Fuzzy Hash: 28014874A04308CFDB50EF64E545AE97BF6BB49340F10A2A5E80987315DB70A984CF42

Uniqueness

Uniqueness Score: -1.00%

Function 06FB1628 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35120bffdbdcd602d84fdb5ea5b8dc93b9a42be19d6852875c59c6322e27b265
Instruction ID: e0a440d111621f30d9bb7f0134f2a616548be6b2b23c900688c87bf14d071128
Opcode Fuzzy Hash: 35120bffdbdcd602d84fdb5ea5b8dc93b9a42be19d6852875c59c6322e27b265
Instruction Fuzzy Hash: 0801AF74E01208AFDB44DFA9C589A9DFFF2AF88310F05C0A9A8089B365DB319A40DF40

Uniqueness

Uniqueness Score: -1.00%

Function 06FBC470 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784904dde69b386e0aa7f2b4e773bead563339ea45c815fe221f1e080e325d65
Instruction ID: e712f125d7e5b54553aa6332197e2702381d9e7efaea746fbc0eced514ded218
Opcode Fuzzy Hash: 784904dde69b386e0aa7f2b4e773bead563339ea45c815fe221f1e080e325d65
Instruction Fuzzy Hash: 4E117E78D04269CFDB61CF69C981A9CBFF1BB09201F5091DAE859A3351EB31AD85DF10

Uniqueness

Uniqueness Score: -1.00%

Function 06FB7431 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbe6f16e501d2d4b6ad367715906719f1af38f18a9710f9fcae5cfa0e3d8e80
Instruction ID: 51fa4ee6634d85cdfff35e3251185e39e52197b4d109a7b1b62affb05b71c352
Opcode Fuzzy Hash: dbbe6f16e501d2d4b6ad367715906719f1af38f18a9710f9fcae5cfa0e3d8e80
Instruction Fuzzy Hash: 9BF0FE72A00108BFDF84DB59DC51ADEBBFAEB44254F14C169E409D7261E632E9508794

Uniqueness

Uniqueness Score: -1.00%

Function 06FB5F48 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f0d4d5500205c599290e1d3b6f5dd7a3572ba8466764b8077d56b00a3210ab
Instruction ID: 6e7cd839185d72123e652d6858b208700c79d7bc9ffacb165b701934ca4512e1
Opcode Fuzzy Hash: 61f0d4d5500205c599290e1d3b6f5dd7a3572ba8466764b8077d56b00a3210ab
Instruction Fuzzy Hash: 1301A871C00219DFDB54DFAAC4447EEBAF5AF48360F149625E824AA2A0D7784A45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FB5FE8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd52c810c2e897138734543def97e6922a9ee7aeecf733fb748d24c9b01a8ac
Instruction ID: cd47c6d23e0b7adab245de9ebafc4e74f4efa184f014a03d0fc0e956b05b29f8
Opcode Fuzzy Hash: 0dd52c810c2e897138734543def97e6922a9ee7aeecf733fb748d24c9b01a8ac
Instruction Fuzzy Hash: 28E039727041286F93049A6ED884C6BBBEEEBCC664315807AF508C7310DA319D0086A0

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE917 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0f59e131c7880c34168cc89403227f6c6e427c2a5f8aa0bfa2eab1b3717cf3
Instruction ID: f7b7a9fac705bf39958fda7c9ab9625021064aa31efe2e36cf720356b2dd6fa8
Opcode Fuzzy Hash: 6a0f59e131c7880c34168cc89403227f6c6e427c2a5f8aa0bfa2eab1b3717cf3
Instruction Fuzzy Hash: 3101FB74915308CFDB40EF69E1899EABFF5FF48340B15A469E40A9B355DB30D980CB84

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD218 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af763a2c21ad914a8bd1c31e46685dcd1aab75ab5f9b71be7ca5d1bc7ca28f8
Instruction ID: 223ffbbeadd34182298d64be28e8a2e75a5a9cd3c0e47d8135d04d8aa54deafe
Opcode Fuzzy Hash: 5af763a2c21ad914a8bd1c31e46685dcd1aab75ab5f9b71be7ca5d1bc7ca28f8
Instruction Fuzzy Hash: 8FF0DAB0D0420A9FDB84DFA9D841ABEBBF5AF48204F1085A9D918E7340D775D5418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06FBBE40 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b426c07c01ed2a107f63096e62196ca019e2b0c67a71894257959c319de73f
Instruction ID: af9042d5b283df54d6b80d03739075ed0e0aa90012debf24f2c768db3c9c2722
Opcode Fuzzy Hash: 74b426c07c01ed2a107f63096e62196ca019e2b0c67a71894257959c319de73f
Instruction Fuzzy Hash: 5EF01C74D09208EFDB40DFA5D4055ACBFB4FB09301F0090A9E81993360DB315A90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06FBCCE1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1b12f31142f9bf33199229eff71f966982b6cc0c1ba8d9cd289c22cad705c1
Instruction ID: 63a712633150193e1588c8686e3ac3840c1f1ee8d8ca592f264922b2946f25b9
Opcode Fuzzy Hash: 7e1b12f31142f9bf33199229eff71f966982b6cc0c1ba8d9cd289c22cad705c1
Instruction Fuzzy Hash: 7BF0ED72619204CFC3469FA4E0164EC7F35EF8E322B043065E10A9B382CB329981CF20

Uniqueness

Uniqueness Score: -1.00%

Function 06FBCDB9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5171937f601349c9c958c21d7f5849e029d9f5cc18a0fbae264f9928b86996fc
Instruction ID: 98ecdb4e154384177553609cbac94e78beed5a62ca5443723255fc266e4ad33d
Opcode Fuzzy Hash: 5171937f601349c9c958c21d7f5849e029d9f5cc18a0fbae264f9928b86996fc
Instruction Fuzzy Hash: 7EF0D435A08208DFD745CFA9D0908EDBFB6EF4E321B14A094E409AB261C735E885CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE621 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564a93eb7f6bb087d537d3642fdf952e1116af97d9ff65c49aff6f73caac8b1b
Instruction ID: 13dbef887dbf8332ac3f956afac2aa0e0405a99dd7bda0e91f671c6199ceabf4
Opcode Fuzzy Hash: 564a93eb7f6bb087d537d3642fdf952e1116af97d9ff65c49aff6f73caac8b1b
Instruction Fuzzy Hash: 46E0C23081A348AFC786CB71A8146DA3FB9CB03211F1510DAE050CA291DB765B44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06FBA8A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed699f76b933708fa5c626dc439685be17ba2fa7b3ace28d7beb2d57c036c2a6
Instruction ID: f2f8814fd51a6a2bfd775081b7d54129431f820232820557022d6d908e5fc270
Opcode Fuzzy Hash: ed699f76b933708fa5c626dc439685be17ba2fa7b3ace28d7beb2d57c036c2a6
Instruction Fuzzy Hash: AED05E3005A6485FE3461371AC0D2A67FA8DB47102F450092F84985492AFB55A85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06FB0CF7 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c14079e2f8c621a40063d2fba94944aa785e06aa8990e3d2fd208d9707d9b7
Instruction ID: a488f6b12d0d051d562afa6584482b741a91678ceaf6a3560940a7c1f567a7e9
Opcode Fuzzy Hash: 49c14079e2f8c621a40063d2fba94944aa785e06aa8990e3d2fd208d9707d9b7
Instruction Fuzzy Hash: 5EE06D38A152188FDB50CF48D58088DBBB1FF48350F15E090E405AB229CB30FD80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06FB063C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e52814bb1bc8591f14fdf26517ea7f088845c0bc985a936ecf27bdebf62ea52
Instruction ID: 8358ae526b6cadc40a654da9ceec88c68251c8e33099c698da7d4b5a3e341df2
Opcode Fuzzy Hash: 8e52814bb1bc8591f14fdf26517ea7f088845c0bc985a936ecf27bdebf62ea52
Instruction Fuzzy Hash: C5E04671626344DFC758CFA1C08189ABF72FF49381B202199E402AA6B4CB36D882CE54

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD1C0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214094e7418ddee45bf0d5d4f447244666b1dd70e7e00903f1413535ba7200ee
Instruction ID: 4b788e699352650b4ef0ad97ccc429c56bd180cb5e60e566a28e8597016bef9f
Opcode Fuzzy Hash: 214094e7418ddee45bf0d5d4f447244666b1dd70e7e00903f1413535ba7200ee
Instruction Fuzzy Hash: F2E0B6B1D44209DFE780EFBAC905A9EBBF0BF08200F1585A9D019E7211EBB496048F91

Uniqueness

Uniqueness Score: -1.00%

Function 06FBC88A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97379ad0f00a51d319445765d8b491e525803161dec3c295ac09f6cf77503e9c
Instruction ID: 0ebcd97a4d5348aacaddec6d6717273f717a529a49980ed8ebf13f6657c89a3b
Opcode Fuzzy Hash: 97379ad0f00a51d319445765d8b491e525803161dec3c295ac09f6cf77503e9c
Instruction Fuzzy Hash: 7AE0C237604108CFD750DB40E4409E8BB39FF4A212F009092E10E93251CB329884CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06FBCD4A Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4352709ba06f8ebafc578220ece87d12a58678f2640d2951a0be044748de7ff
Instruction ID: 7576f364ce13d8c5361eb678e3b29fcd718e7cf4cef8556affada9e01ab73a46
Opcode Fuzzy Hash: f4352709ba06f8ebafc578220ece87d12a58678f2640d2951a0be044748de7ff
Instruction Fuzzy Hash: E0E0C2B5508204DFE7858F92C0094BE3F79EF9A302750A1D0F51A9E212CB31C442CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06FB05C4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a354d1467818e23bc311c57df82cb8673aca49f96e4abfd7bbdc03939c92650
Instruction ID: 34d1e7bd706b04f169b0425ba626692158d94dcffd8a5b2aa9408e0009149308
Opcode Fuzzy Hash: 7a354d1467818e23bc311c57df82cb8673aca49f96e4abfd7bbdc03939c92650
Instruction Fuzzy Hash: 70E08C70522314DFCB54DFA1C485589BF70FF44381B1020A5E8169F2A8CB368982CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06FBE630 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8c4fcfa7f80b28325f237f6936efb22e2fab17c3fd87b2a6c1466ce5b718f4
Instruction ID: 711603d04e83b71a690a9bfa9854140dc1bf9458148496748a3ea624d6134d63
Opcode Fuzzy Hash: 9b8c4fcfa7f80b28325f237f6936efb22e2fab17c3fd87b2a6c1466ce5b718f4
Instruction Fuzzy Hash: 29D0A93081220CDBC788DAB6E8016997B39DB02244F0020ACE40402280CB334A80CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06FBD2B8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c30fe55e589d74c79b15c9cbbedcf2d6f48396cdee27f891e0b600b4f1e989
Instruction ID: a9a26135780f81cadce461be8294f20078f456c4edc9b94712a30276ced09e68
Opcode Fuzzy Hash: f8c30fe55e589d74c79b15c9cbbedcf2d6f48396cdee27f891e0b600b4f1e989
Instruction Fuzzy Hash: 00D012361141085F5B81EE96EC40C967BDCBB18740744C432F604C7420E621E424D751

Uniqueness

Uniqueness Score: -1.00%

Function 06FBA8B8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638e39511b5dc53db742fe1f807e5cdd839ecd37a55a73294915f7ac8db21935
Instruction ID: 71ed5561c69e182fa41eb76d4b5f6c1cfbf6301e9f5f301df22c8dcda013399c
Opcode Fuzzy Hash: 638e39511b5dc53db742fe1f807e5cdd839ecd37a55a73294915f7ac8db21935
Instruction Fuzzy Hash: 75C02B3004560C87D25537F5F40E3687F689F05312F045010F90D40890CFB281C0CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 06FB6B04 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce132c6840be0350ec140decabc9e5125ebd11d165d601dfd175fb2b6ae946b
Instruction ID: 06d9529f3696c6f56447286e5eb9d251fe5e7a2544c0cde0990fdad4c00b220c
Opcode Fuzzy Hash: 8ce132c6840be0350ec140decabc9e5125ebd11d165d601dfd175fb2b6ae946b
Instruction Fuzzy Hash: A2B0122A1D4541F7598033694E9086AED20FBF1701B70FC253306A0054C532C464D277

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06FBEEF0 Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

WkN, xrefs: 06FBEF5B

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: WkN
API String ID: 0-3468331921
Opcode ID: ab4dcadfd6f6c3c9d2b52aee5e60195aff6bb193f84fc97738c8577cf6eca590
Instruction ID: 676564ab08bceb2e9bdc1a44d7d8f3ff0ce9b0eb2b9c6d5a5a80612875cd9d3e
Opcode Fuzzy Hash: ab4dcadfd6f6c3c9d2b52aee5e60195aff6bb193f84fc97738c8577cf6eca590
Instruction Fuzzy Hash: 70E10D74E052198FCB14DFA9C9809AEFBF2BF49304F249169D814AB35AD731AD41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FBF338 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af65f22f99e209eb8beda2fed6e01b10626757b6d2c1244c727d381743112228
Instruction ID: a83f3b99782b0e6abe81d2c26462c08b951cea855b929c788abcd337f772a0bf
Opcode Fuzzy Hash: af65f22f99e209eb8beda2fed6e01b10626757b6d2c1244c727d381743112228
Instruction Fuzzy Hash: 95E10CB4E052198FCB14DFA9C9909AEFBF2FF49304F249169D814AB359D730A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06FB654F Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb6adb330bc85e5f5cd5a882569cc9090418fa69ccd177a722df39367ce4973
Instruction ID: 994fca318bba66555e6099388a0cb339a1e9fe1f26fb124603ebc8cff77c102d
Opcode Fuzzy Hash: 0eb6adb330bc85e5f5cd5a882569cc9090418fa69ccd177a722df39367ce4973
Instruction Fuzzy Hash: 4DD1E83182075ACADB11EB64D994B9DF7B1FF95300F1097AAE0093B215EB70AAC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06FB6560 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9f631a151809595c37cc434083ec9ba09cf87d3ea966d5ee422acda9fdf318
Instruction ID: d0d23b0cdf24367d915f29599ab46716d5aa74a06bdf177619e58a9ba52153e2
Opcode Fuzzy Hash: 0a9f631a151809595c37cc434083ec9ba09cf87d3ea966d5ee422acda9fdf318
Instruction Fuzzy Hash: 8BD1E631C2075ACADB11EB64D994A9DF7B1FF95300F1097AAE0093B215EB70AAC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06FB1DE0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2894ed7e9b91fd0b67a7c780071eee66e18057f612238a00ad482590687660
Instruction ID: 65bc9029b19031f360ecf24b9bcf6e2383e1eb6d75895b8aff3b5b08a627913f
Opcode Fuzzy Hash: ae2894ed7e9b91fd0b67a7c780071eee66e18057f612238a00ad482590687660
Instruction Fuzzy Hash: 4A81C274E10219CFCB44CF9AD59499EFBF2FF88250F14A55AD415AB720D334AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB1DD0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a1c6de25eaba3cdc516c6a161f74424a76fa8e114b4bd14055725ad1424b2c
Instruction ID: 2c6932c80e7c0cc70296b1166fe1fb708d5b56f82a7559ba64f9cd9525750796
Opcode Fuzzy Hash: f1a1c6de25eaba3cdc516c6a161f74424a76fa8e114b4bd14055725ad1424b2c
Instruction Fuzzy Hash: 9E81D475E11219CFCB44CFAAD59499EFBF2FF88210F14A56AD415AB720D330AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3240 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0cc0ee4a11f6db84926e96ea06de406a78e71eacbb7fad064effcbdd02d2ca
Instruction ID: 3fbfedccfaa28b9bc0df92f9c7d5ed5361dd8370d093f3d0501ca61bd2c264fa
Opcode Fuzzy Hash: cd0cc0ee4a11f6db84926e96ea06de406a78e71eacbb7fad064effcbdd02d2ca
Instruction Fuzzy Hash: B4612776955A0AEFE780CF96E5C529DBFB1FB88310F20E48DC085871C9DB7182A1CB49

Uniqueness

Uniqueness Score: -1.00%

Function 06FB2C98 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25854b4a2e509a1f5c76f5db33514134263fc2862991a8d5b047fc37d44e0f0
Instruction ID: c686771740c0d3d9e53f44caf8127ce3c3cd19a49ab3cd7b6ae9fc273cc21ad3
Opcode Fuzzy Hash: d25854b4a2e509a1f5c76f5db33514134263fc2862991a8d5b047fc37d44e0f0
Instruction Fuzzy Hash: 346105B1E0420ADFDB44DFAAD9815EEFBB2BF49310F14941AD425B7240D734AA41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 06FB2C88 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7b983fd57b555068ddcb94f8957437d9f4a41305a3ef6874e54acb5582d939
Instruction ID: 6060e5770798ef96c53df06422a05f05553392487e38c9a59f520beca7d0ef03
Opcode Fuzzy Hash: ac7b983fd57b555068ddcb94f8957437d9f4a41305a3ef6874e54acb5582d939
Instruction Fuzzy Hash: 115117B1E0420A9FDB44DFAAD9815EEFBB2FF88310F14D46AD415A7240D734AA42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06FB326C Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87dfb265f0ee95b278ab9663bbe17e1327a8eac7098473bd875445a4a7e2e7d2
Instruction ID: 4181049c439497c5309a97be883b808d0f9ed0829d70e43263f98902d278c277
Opcode Fuzzy Hash: 87dfb265f0ee95b278ab9663bbe17e1327a8eac7098473bd875445a4a7e2e7d2
Instruction Fuzzy Hash: 9251297656160AEFE784CF96E5C529CBFB2FB88300B20E48DC085971C8DF7182A0CB49

Uniqueness

Uniqueness Score: -1.00%

Function 06FBF328 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b949e33c28875e03042dd3912e5a9ef2a89c6f2c0fc8991cd4d4553038d3c4c
Instruction ID: 247a6b8d19ee8d06c6146ac516f7170927e3af11e67fb394697a878bfce84d82
Opcode Fuzzy Hash: 2b949e33c28875e03042dd3912e5a9ef2a89c6f2c0fc8991cd4d4553038d3c4c
Instruction Fuzzy Hash: B8514D74E052198FDB14DFAAC9409EEFBF2BF89304F24916AD418A7316DB319941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FB3008 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc143150a9a8c65f62603a26bc5e8edf0391b81bf6159f58fe5071628b6d5a4c
Instruction ID: d8a623472fb7e4160675dec6f755c0adbac2f40026c39795b7ee144a800f66d8
Opcode Fuzzy Hash: dc143150a9a8c65f62603a26bc5e8edf0391b81bf6159f58fe5071628b6d5a4c
Instruction Fuzzy Hash: B941F7B1D0121ADFDB48CFAAC8815EEFBF6BF88340F14E12AC415A7244D7349A418F94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB2FF8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7876a31ebe66a126dc0ecaa8eb15083c3fddb2697e7d49ac8ebae6f44dacecd
Instruction ID: 8ade8d8ccbfc72736e4b229d8d863104bfcca4364e11922d1d6ab2786e2f8d7e
Opcode Fuzzy Hash: e7876a31ebe66a126dc0ecaa8eb15083c3fddb2697e7d49ac8ebae6f44dacecd
Instruction Fuzzy Hash: 7D4117B1E0560A9FDB48CFAAC8405EEFBB2BF89340F14E06AD415A7255D7349A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06FB8360 Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

]\`, xrefs: 06FB878A
[V~*, xrefs: 06FB866D
T+-q, xrefs: 06FB8842
[V~*, xrefs: 06FB8674

Memory Dump Source

Source File: 00000000.00000002.1690196764.0000000006FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fb0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 97fd2be0b9281eebe3498596fbf37fd17e9974ad897809dd1bde0cc2699765c7
Instruction ID: e11d557036f76717e43e564c8f53413f30f62a6e98678c3ec15d1844e844b1a5
Opcode Fuzzy Hash: 97fd2be0b9281eebe3498596fbf37fd17e9974ad897809dd1bde0cc2699765c7
Instruction Fuzzy Hash: 1041B576D05526CFCB80DBAAC8512FDBBF9FB89290F089126E475E7280D339D9418BD1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: invoice & packing list.exePID: 6324, Parent PID: 6616COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	175
Total number of Limit Nodes:	18

Executed Functions

Function 06AD3028 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06AD370A
$^q, xrefs: 06AD3727
$^q, xrefs: 06AD3757
$^q, xrefs: 06AD36FE
$^q, xrefs: 06AD3733
$^q, xrefs: 06AD374B

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 802191b75621f139aaf990da8a8236d112895ccea881e56455694c3b3ec49fba
Instruction ID: f0cd369beff3e1bad28cb9ec96785481670d41c41c99a4d2eabbb90944af6bcf
Opcode Fuzzy Hash: 802191b75621f139aaf990da8a8236d112895ccea881e56455694c3b3ec49fba
Instruction Fuzzy Hash: 65322F35E1061ADFCB54EF75C85459DB7B2FF89300F1086AAD44AAB224EB30ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD7D40 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06AD80AF
$^q, xrefs: 06AD80A3

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 2e1035683526dc52584defd3b9ad8afbf5a74ca3eb2115cfdfb324b8c83a9688
Instruction ID: 3745821f5271718dad7784dca15d0e9a1d4e6fc4fbbbb45d8883e2432cf0dcef
Opcode Fuzzy Hash: 2e1035683526dc52584defd3b9ad8afbf5a74ca3eb2115cfdfb324b8c83a9688
Instruction Fuzzy Hash: 34029C34B002059FDB58EB68D590BAEB7E2FF88304F148569E44ADB394DB35EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD5570 Relevance: 1.8, Strings: 1, Instructions: 595COMMON

Download Yara Rule

Strings

$, xrefs: 06AD5C7F

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 45f239a017b2bdb165957405187d69dbadb26de40af3e799f2c2b095bc57aa38
Instruction ID: b78d18924b304e53c205d3e5824364a3bf90051e565553a55daa10105790c084
Opcode Fuzzy Hash: 45f239a017b2bdb165957405187d69dbadb26de40af3e799f2c2b095bc57aa38
Instruction Fuzzy Hash: 8622CF35E002159FDF64EBA5C4906AEBBB2EF89314F248469D45AEF344DB31DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ADC148 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe37931c69efbf1bd4d05b698add2536c4a1830b87d19cff555555996b9f2bf
Instruction ID: 72d87e4ed14540afe7b90e46788b92f70f222360302e80bcbe3c39db1a59d8cc
Opcode Fuzzy Hash: ebe37931c69efbf1bd4d05b698add2536c4a1830b87d19cff555555996b9f2bf
Instruction Fuzzy Hash: 11329F34B002099FDB54EB68D980BAEB7B6FB88324F508565E407EB355DB35EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ADB299 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3b6a6837cf0eab46113ec280c70bd2f1bc46487042bfcece1df0ba97e749b8
Instruction ID: 04e8d98f4533f752c887f69a0dbe0acd32b3ed718f0e7295f4806e41a68c9094
Opcode Fuzzy Hash: ac3b6a6837cf0eab46113ec280c70bd2f1bc46487042bfcece1df0ba97e749b8
Instruction Fuzzy Hash: 991250B4E102098FDF64EB68C5807ADB7B2FB89314F218526E446EF395DA35DC81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06ADAC90 Relevance: 10.4, Strings: 8, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06ADAE3F
$^q, xrefs: 06ADAE5C
$^q, xrefs: 06ADADB1
$^q, xrefs: 06ADAE68
$^q, xrefs: 06ADAE04
$^q, xrefs: 06ADADBD
$^q, xrefs: 06ADAE33
$^q, xrefs: 06ADAE10

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: c86a6b79df0d46d787891b6e16aeebdf2e39aa993bd342a35bfaf46af204683d
Instruction ID: 36ac85938dd58261e05c03fc3af7b074816b255ba2314aa9e3d5e825ac8424c7
Opcode Fuzzy Hash: c86a6b79df0d46d787891b6e16aeebdf2e39aa993bd342a35bfaf46af204683d
Instruction Fuzzy Hash: BDE16C30E0020A8FCB65EF69D5846AEB7F2EF89304F108929E546DB354DB35EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ADB618 Relevance: 8.0, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06ADBB6D
$^q, xrefs: 06ADBB95
$^q, xrefs: 06ADBBD5
$^q, xrefs: 06ADBB61
$^q, xrefs: 06ADBBC9
$^q, xrefs: 06ADBBA1

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: d7cf1fb6d12b518878bcfc05e6d83559bccc5cf89b0e87608e2cf54d4fba6dfe
Instruction ID: 6e8f6af1e4fa3b4b1d335cdb6028df36aff6464e29ed71f177f4802503117ae8
Opcode Fuzzy Hash: d7cf1fb6d12b518878bcfc05e6d83559bccc5cf89b0e87608e2cf54d4fba6dfe
Instruction Fuzzy Hash: 08026C70E002098FDBA4EF68D5807ADB7B1FB85310F118566D416DF295DB35EC86CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AD9110 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06AD9157
$^q, xrefs: 06AD9192
$^q, xrefs: 06AD919E
$^q, xrefs: 06AD9163

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 78910f418b49dc5e871b5a4ed6b88b922a44be8a6ff629c08a76efb278843614
Instruction ID: 94748d09ca911c9b16e862e0438bc5c89c8093aa2d937bcf2fe306f7063a16c8
Opcode Fuzzy Hash: 78910f418b49dc5e871b5a4ed6b88b922a44be8a6ff629c08a76efb278843614
Instruction Fuzzy Hash: 3A913D34F0061A9FDB94EB65D8507AFB3F6ABC9204F108569D40AEB344EB70DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ADCF00 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06ADD30B
$^q, xrefs: 06ADD2FF
$^q, xrefs: 06ADD2F7

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: fd989dfbef08ec0767d04b96d7bbfa6be13735757baba27ef0b6e14116f6f070
Instruction ID: 9b576601fa32d456ff54e841f3bcc01a5fd4e288a9bf04e1abe63619cab4f437
Opcode Fuzzy Hash: fd989dfbef08ec0767d04b96d7bbfa6be13735757baba27ef0b6e14116f6f070
Instruction Fuzzy Hash: FF622034A002168FCB55FB68D590A5EB7B2FF84304F248A69D046DF369DB75ED46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06AD4B38 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06AD4C89
\Ocq, xrefs: 06AD4D13
fcq, xrefs: 06AD4B63

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 4631322a8a7317460e007a00ec74939371fcc7daa70a57dfd64f558a8181ef4c
Instruction ID: eb61c948cd74f48c360ca98a0465ba4a53009c007463207e3caddace8f9d95aa
Opcode Fuzzy Hash: 4631322a8a7317460e007a00ec74939371fcc7daa70a57dfd64f558a8181ef4c
Instruction Fuzzy Hash: D0615130E002199FEB54AFA5C8547AEBAF6FFC8700F208529D146EB395DB758C468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD9105 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06AD9157
$^q, xrefs: 06AD9192

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 2b07711aa6f10c330ff23d3bb9b53d0dd41a931f56efb9bcbe40f109961e8b1e
Instruction ID: c8e903e131e5a0ce069f9fc31b93626b8fd0d247d31be193744054ff19aba12e
Opcode Fuzzy Hash: 2b07711aa6f10c330ff23d3bb9b53d0dd41a931f56efb9bcbe40f109961e8b1e
Instruction Fuzzy Hash: 8D516234B042069FDB94EB75D890BAFB3FAABC8644F108469D40ADB344DA30DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD4B28 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06AD4C89
fcq, xrefs: 06AD4B63

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 22068b5c5865d64d5520be6ab65ef04981d22d342aacaa9d9dfeb6745a86fd6b
Instruction ID: 5dcf4f318511255ed71c215e7652e2ff96bf028f308f0fe82677d1e7d6468cae
Opcode Fuzzy Hash: 22068b5c5865d64d5520be6ab65ef04981d22d342aacaa9d9dfeb6745a86fd6b
Instruction Fuzzy Hash: DF516030F002099FDB55AFA5C854BAEBAF6FFC8700F208529E146AB395DA758C418B91

Uniqueness

Uniqueness Score: -1.00%

Function 06ACB228 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6a6e2d8d91cdbb970b5c1dbfda327ce443ff816556b1ed200282d203b4a9ea9b
Instruction ID: 8db4e815b1caa88c63526dc9b878aa668830b5ed22d29af032c4714e81994e15
Opcode Fuzzy Hash: 6a6e2d8d91cdbb970b5c1dbfda327ce443ff816556b1ed200282d203b4a9ea9b
Instruction Fuzzy Hash: 10715370A00B058FDB64EF2AC45575ABBF1BF88310F008A2DD48A9BB50DB35E845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010EEB68 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2872999473.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10e0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee1735c257585ac8425e564682fb40c6313db9d1e3b458e2fe32e96b7204e2e
Instruction ID: d826a6a28ac31a24759d165b24917ee3e523cca2c682036b14b7856ca0bc8209
Opcode Fuzzy Hash: 2ee1735c257585ac8425e564682fb40c6313db9d1e3b458e2fe32e96b7204e2e
Instruction Fuzzy Hash: 5F414232D103599FCB10EFBAD8046DABFF5AF89210F1485AAE544A7251DB389881CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06ACD7C5 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06ACD922

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 74a7a2c4f2a0b173d4b7e848f1091a711de5a8c3e6d97b2d1e11377304f89111
Instruction ID: e94521a3f21f87200f90b72c3469efc2440201d864010a1f8b5f6a66b79f8b41
Opcode Fuzzy Hash: 74a7a2c4f2a0b173d4b7e848f1091a711de5a8c3e6d97b2d1e11377304f89111
Instruction Fuzzy Hash: 4151EEB5C00249EFDF15DFA9C984ADEBFB6BF48310F14816AE818AB220D7719841CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06ACD804 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06ACD922

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 74aae08b7a767ee0c80237a7eac07182acf365ff7ab1c6cd22b7323842576393
Instruction ID: ea7cef5bd3a9e7b67189ab499d74aa984c0cc03715dd55d6d092f742f693b58d
Opcode Fuzzy Hash: 74aae08b7a767ee0c80237a7eac07182acf365ff7ab1c6cd22b7323842576393
Instruction Fuzzy Hash: EB51CEB5D00349EFDB14DFAAC884ADEBFB5BF48310F24852AE819AB210D7709841CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06ACD810 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06ACD922

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8d4687e49955f441f95dbef4b670fe8a489205ebad9fdec299fb2c7db3dfcf6b
Instruction ID: 45daa76d0f068378b63094e6d325629d313cbc69772d199ec22ef7d0405c4bc3
Opcode Fuzzy Hash: 8d4687e49955f441f95dbef4b670fe8a489205ebad9fdec299fb2c7db3dfcf6b
Instruction Fuzzy Hash: FE41C0B5D10309EFDB14DF9AC884ADEBBB5BF48310F24852AE818AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06ACCD6C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06ACFE91

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: e3f45eb9f9113336baa3c3ea0c7ef8af9a53165cec34d62e5fd98a1c908485d3
Instruction ID: 9f725fdbda99989291070c7a5e4bcb2305e067d211f564ce4de5aa360b7f08db
Opcode Fuzzy Hash: e3f45eb9f9113336baa3c3ea0c7ef8af9a53165cec34d62e5fd98a1c908485d3
Instruction Fuzzy Hash: 6B4105B4900209CFDB54DF99C448AAABBF6FF89324F24845DD519AB321D734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06AC3048 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06AC30D7

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 84541dd4ab2db23a972a7352c284d5a4d8fb1196a834f8e12ea0102f0e58eb51
Instruction ID: 20ad0a3749ec5e8914c764080ba065b0f5308f6e708d85efa06c8636a142ae84
Opcode Fuzzy Hash: 84541dd4ab2db23a972a7352c284d5a4d8fb1196a834f8e12ea0102f0e58eb51
Instruction Fuzzy Hash: A321E4B5D00208DFDB10CFAAD984ADEBBF5EF48320F14841AE958A7350C375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AC3050 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06AC30D7

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d6d6410969821f6938628542a77c62f7bfe28971042fab336fef693c4e3b50c1
Instruction ID: 7706b3c79353c83ef52d22bbe2fa80c243af54eb7199805441d9d47ec4e76e1c
Opcode Fuzzy Hash: d6d6410969821f6938628542a77c62f7bfe28971042fab336fef693c4e3b50c1
Instruction Fuzzy Hash: FE21C4B5900258DFDB10CF9AD984ADEFFF4EB48320F14841AE954A7350D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ACB679 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 06ACB6EA

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 801e33adab1626b0eeba933cd192fc4d69b3869f8dfdcf4176d4b6f68c658700
Instruction ID: ac39e5f3dcb58a8d5bc721ba9eb41b4e1509332bb5fee458e121b71e6c62b983
Opcode Fuzzy Hash: 801e33adab1626b0eeba933cd192fc4d69b3869f8dfdcf4176d4b6f68c658700
Instruction Fuzzy Hash: A611F6B6D003499FDB20DFAAD844ADEFBF8EB48320F10842EE519A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ACB680 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 06ACB6EA

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6e8eb014e6bba4700eef57351bb4132302a0152dc166b5f3f917d659b0d16bb7
Instruction ID: 31cd416fa1d6e386048a2b6696725cf7097f0677ea9e1601b8ed87c16fc40875
Opcode Fuzzy Hash: 6e8eb014e6bba4700eef57351bb4132302a0152dc166b5f3f917d659b0d16bb7
Instruction Fuzzy Hash: E81104B6D003499FDB10DF9AD844ADEFBF8EB48320F10842ED419A7210C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 010EEC50 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 010EECB7

Memory Dump Source

Source File: 00000002.00000002.2872999473.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10e0000_invoice & packing list.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: af18a41891e677c1b0fddc33dacef92c8541abc22560710c5c9d4b77f0f1816a
Instruction ID: 3b72749967a81a5d7e4c4424925376751f9e19af55df2ebb18b427fdb56741d4
Opcode Fuzzy Hash: af18a41891e677c1b0fddc33dacef92c8541abc22560710c5c9d4b77f0f1816a
Instruction Fuzzy Hash: 8F111FB2C006699FCB10CF9AD548BDEFBF4AB48320F10816AD818B7241D378A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06ACA17C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,06ACB244), ref: 06ACB47E

Memory Dump Source

Source File: 00000002.00000002.2880244410.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ac0000_invoice & packing list.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4a1cc3a6e0d190d9d2b5d185a3b0dee03793efab2489a1f6ac2a2ee6f7e83727
Instruction ID: 514037bd5d886e1df7ee5abf42940fa2ce663deda4f3dd95f836a3be06d567a5
Opcode Fuzzy Hash: 4a1cc3a6e0d190d9d2b5d185a3b0dee03793efab2489a1f6ac2a2ee6f7e83727
Instruction Fuzzy Hash: 2D1102B6C047498FDB10DF9AD544ADEFBF8EB48224F10842AD419B7210C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ADDA75 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06ADDBD1

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e811a73d48361b83fe5dc3efd24ba7a6587eda6676b4087868305ce1a1a05a45
Instruction ID: 2934b79e7a85a887204d17be6105f2b21edc20455c3f792100a305ee9b7c26c9
Opcode Fuzzy Hash: e811a73d48361b83fe5dc3efd24ba7a6587eda6676b4087868305ce1a1a05a45
Instruction Fuzzy Hash: 8341B030E003099FDB61FFA4C4546AEBBB2BF85204F204529E442EB245DB75E846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06AD21D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06AD230B

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: ac0ce454d83f7aaf56d2e2fcf24717638af28348d207e71f3c58dc26f3dab0a0
Instruction ID: 78ca9985141b51b610eaad4c0764c36c1ddb63089b0e819880aae2d2044522f9
Opcode Fuzzy Hash: ac0ce454d83f7aaf56d2e2fcf24717638af28348d207e71f3c58dc26f3dab0a0
Instruction Fuzzy Hash: A731CD30B002058FDB59AB74C51476F7AE2AF89604F208468E546DB388DE3ADE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AD69E0 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6552d0b58188a32cb904530bb6604fce70bf9343f17e03fb7851c487ade33c18
Instruction ID: 75d2857f3e6294696831b8dc86bdef37892b4870b9f9f258cb712ea215b431d3
Opcode Fuzzy Hash: 6552d0b58188a32cb904530bb6604fce70bf9343f17e03fb7851c487ade33c18
Instruction Fuzzy Hash: B802AB34B002048FDB54EB68D544BAEB7F2EF88354F149569E45ADB390DB36EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06AD61B8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ed2fdddfe78e1e3453870229c5fcfee29cececb1d6f9612cb7d9737750b979
Instruction ID: e50783fdd8e7d3ef5e391f1cd742d83005f072c6c4aad4f7b9e322a6ae16fd74
Opcode Fuzzy Hash: f2ed2fdddfe78e1e3453870229c5fcfee29cececb1d6f9612cb7d9737750b979
Instruction Fuzzy Hash: E061AF71F000214FCB55AB7EC88466FAADBAFC4624F15447AE80EDB364EE65DD0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 06AD4268 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25db860ddab880d52ac6d226ad9c7d24c1689e969193e10f86e4dc808b93e74
Instruction ID: e907b71ff1bb9065a14404d85aa11077f4a044a276e82a59e72c035060a459fa
Opcode Fuzzy Hash: e25db860ddab880d52ac6d226ad9c7d24c1689e969193e10f86e4dc808b93e74
Instruction Fuzzy Hash: 6D812B34B006099FDF54EBA9D4547AEB7F6EF89304F108529D40AEB394EB31EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD4588 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912e51c528b8a03eaac188e7cd42b16c311daef7ae5165eb913c2f3b34e06281
Instruction ID: f42717bd09d38c00a87983477a94fe41595fa5e1b707cd5dad0d24ed84470b73
Opcode Fuzzy Hash: 912e51c528b8a03eaac188e7cd42b16c311daef7ae5165eb913c2f3b34e06281
Instruction Fuzzy Hash: 79913C30E106198FDF64DF68C890BDDB7B1FF89300F208695D549AB295EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD45A0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16024f96e6edba5a90b0934b5508b39cc2b1db42c0b061cb7c7b517eb38320a9
Instruction ID: 0da0fa4925898f2a8ff22520bcf43f243f7812594bf16de21202ff45665ab9c0
Opcode Fuzzy Hash: 16024f96e6edba5a90b0934b5508b39cc2b1db42c0b061cb7c7b517eb38320a9
Instruction Fuzzy Hash: 8E914D30E1061A8BDF60DF68C880B9DB7B1FF89300F208695D549BB255EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06ADEAC8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066306f0255ac0c6bf2a8291c7367b140d17edbbffc6a2647e3ff9a2f6bd303c
Instruction ID: 3bd8e1aa044706b1f57a0f401a2a4cd118a9da0cb174d6f0ce925f6afebdf589
Opcode Fuzzy Hash: 066306f0255ac0c6bf2a8291c7367b140d17edbbffc6a2647e3ff9a2f6bd303c
Instruction Fuzzy Hash: 0A713930A002099FDB54EBA9D990A9EBBF6FF88304F148569E446EB355DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06ADEAD8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3278e8ecc6377132c51ff19176f2032cf4e89e170b8139b2734baedca30898
Instruction ID: 86e51e2c588649bf8fc9498164cab841d2a8227f0ef28480fed6c619721df853
Opcode Fuzzy Hash: 3f3278e8ecc6377132c51ff19176f2032cf4e89e170b8139b2734baedca30898
Instruction Fuzzy Hash: 28711930A002099FDB54EFA9D990A9EBBF6FF88304F148569D446EB355DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06ADFC39 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce780239884eaca6eaddc9316de524dfefe2d52b2784866ef669c99c8dac1a90
Instruction ID: c022adba3423263002b2638a01f728633d057440065be4854ade0f3275932181
Opcode Fuzzy Hash: ce780239884eaca6eaddc9316de524dfefe2d52b2784866ef669c99c8dac1a90
Instruction Fuzzy Hash: DE51EF31E001059FCB64FBB8E8446AEBBB2FB85315F108869E50BDB255DF359D56CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06ADF9E8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940535090806e8be92aac579d037456500a55b9b55a7a27ea5e12a144ea6cb68
Instruction ID: 169e23e5fbfabfd2de7fda8245e3e0ffca46f6246351189ffcda91e19adc8d9d
Opcode Fuzzy Hash: 940535090806e8be92aac579d037456500a55b9b55a7a27ea5e12a144ea6cb68
Instruction Fuzzy Hash: 6851D834B102149FEFA0776CD9547AF265AD789350F20492AE40FDB3E9CB79CC868392

Uniqueness

Uniqueness Score: -1.00%

Function 06ADF9F8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b88dce0d376909d32837a6dc36131c93e235ecb72d55e6e4967bfd0cb59e84
Instruction ID: b88a16ff3608dc6097eed2e2a38a3405e3176660bfc7556452d8ab4e201f5273
Opcode Fuzzy Hash: b0b88dce0d376909d32837a6dc36131c93e235ecb72d55e6e4967bfd0cb59e84
Instruction Fuzzy Hash: D651B134B102149FEFA47768D95476F265AD789350F20482AE40FDB3E9CA79CC8643A2

Uniqueness

Uniqueness Score: -1.00%

Function 06AD5560 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f02dd6bf7d354e9c8cb8d60759e8f5016d3dc088401c1162ecf3a8f7bb7f51
Instruction ID: f3a305bf5e79a83c18b640efb653fa977a32405b81f06c4a3f9a593a5c171806
Opcode Fuzzy Hash: 85f02dd6bf7d354e9c8cb8d60759e8f5016d3dc088401c1162ecf3a8f7bb7f51
Instruction Fuzzy Hash: 1841C035E001059FDF64ABA9C880B7EFBB2EB45310F24886AD55BDF681C634E981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD53E8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9783dc69f43a1c8b26655571b7d1af9ee94aa5d3475c39cf1f7c2abdd3278a5
Instruction ID: 2a422f70d8a8e01c86b7dd9effbf4c98950ef916b08adebddea3da52276e492b
Opcode Fuzzy Hash: d9783dc69f43a1c8b26655571b7d1af9ee94aa5d3475c39cf1f7c2abdd3278a5
Instruction Fuzzy Hash: A3415D71E006098FDF70DFA9D880AAFFBB2FB95311F20492AE156DB650D330E9558B91

Uniqueness

Uniqueness Score: -1.00%

Function 06AD2080 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825bc98a281ebc597411dba6cc197385dcbc178d408f9996636129b3726021a1
Instruction ID: c05f2906d44cbef355322f6600e221299b00bfd3bbafb8daad499a5b72980e86
Opcode Fuzzy Hash: 825bc98a281ebc597411dba6cc197385dcbc178d408f9996636129b3726021a1
Instruction Fuzzy Hash: 3F315C35E106059FCB59EFA4D85479EB7B2BF89300F14C529EA06EB340DB71AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06AD2090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a867f0a6827e034be33b46a3be93d852bdd89156569244387e7cef120f3e6f6a
Instruction ID: a3d52304f010c6f98b1a3bbb7c46229e90cd828ce5b8f16388210a11ce05598c
Opcode Fuzzy Hash: a867f0a6827e034be33b46a3be93d852bdd89156569244387e7cef120f3e6f6a
Instruction Fuzzy Hash: 32313C34E106099FCB59EFA5D85479EB7B2BF89300F14C529EA0AEB350DB71AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06AD3A68 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927423acf121738a5009a159df3a4577f029c5092a80c440a59232b80ddbaf12
Instruction ID: 2c824aa82b65e81c784e702e32729eea5bce551b02cf602bebf033dfaa1a258a
Opcode Fuzzy Hash: 927423acf121738a5009a159df3a4577f029c5092a80c440a59232b80ddbaf12
Instruction Fuzzy Hash: 46219A75F016159FDF40EF69D880BEFBBF5EB48610F008025E906EB291E731D8028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AD3A78 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3303e941a8cf2619d9c0fabb206734b771a378a9179004fc129918e2ed53e5b7
Instruction ID: 0c5b11c0c19e208cf511b9dc617ba2357692b5cbac5832ffdc3f1baa5af5461b
Opcode Fuzzy Hash: 3303e941a8cf2619d9c0fabb206734b771a378a9179004fc129918e2ed53e5b7
Instruction Fuzzy Hash: 9C217A79F006159FDF50EF69D880AAEBBF5EB48610F108029E906EB395E731DD01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0109D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2872725947.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_109d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed19d47e7d738076631afe35ea3c201c3f69a7b40d767ed7b177c8d1803e0d66
Instruction ID: 4329bfd572a777faaa53264ece4e24ba3de8dfca5421f6862b9cbdbd22063bc2
Opcode Fuzzy Hash: ed19d47e7d738076631afe35ea3c201c3f69a7b40d767ed7b177c8d1803e0d66
Instruction Fuzzy Hash: 0E2134B1584204EFCF11DF68C9D4B2ABFA5FB84314F20C6ADE9894B252C73AD446DB61

Uniqueness

Uniqueness Score: -1.00%

Function 06AD6CD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde9c76c8f36916467a3072555730c5ad831970e3ae9e5c5e36c00cc24dcd2f6
Instruction ID: d84c41ac98e1d93a68b879b64439007034f1a11478adefffab8aea4a068f4ba5
Opcode Fuzzy Hash: bde9c76c8f36916467a3072555730c5ad831970e3ae9e5c5e36c00cc24dcd2f6
Instruction Fuzzy Hash: 25217F30B101199FDF94EB69E95079EB7F6EB84354F249425E80AEB384DB35EC428B84

Uniqueness

Uniqueness Score: -1.00%

Function 06AD3B88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b5f6079bf5ef0717f3cea7bcb24903ba2e3e7fb6edc6ed23f49f3673cfff6f
Instruction ID: 4a5a7b14d78a7f9e07025f88d26780cc4c01d1e75198ecdfbbda780feafb6dff
Opcode Fuzzy Hash: 84b5f6079bf5ef0717f3cea7bcb24903ba2e3e7fb6edc6ed23f49f3673cfff6f
Instruction Fuzzy Hash: 42118B36B105285FDF94A768C814AAF73BAEBC9215F04413AC50AEB384DA659C028B92

Uniqueness

Uniqueness Score: -1.00%

Function 06ADA2C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be16205fc1dade55f50b5a50f1ebd045486c3c624ff74d004840603885527cee
Instruction ID: 363bb774e5c184f7b28160d08c8ae2db078acc08215988593cfcaf52ad215c6d
Opcode Fuzzy Hash: be16205fc1dade55f50b5a50f1ebd045486c3c624ff74d004840603885527cee
Instruction Fuzzy Hash: D101B5387055101FCB61F77DE85076B77D6EB8A614F104469E10BCF356DA26DC428791

Uniqueness

Uniqueness Score: -1.00%

Function 06AD3021 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f2b89ebc5afe8f6e14918d64c64bc347a5d288a1e6e3be5435717ba632f410
Instruction ID: b1b0c92b14a6b1f25bd483f8aa851f37c1f088f0b7391fd6cb633c8dad7b5ad5
Opcode Fuzzy Hash: 98f2b89ebc5afe8f6e14918d64c64bc347a5d288a1e6e3be5435717ba632f410
Instruction Fuzzy Hash: 2511A571E002199FCF64EB75D8405DEF7B5EF89350F1085AAD406E7240DA31CA46CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06AD41C8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73250b5e19c991aa27d5cfed08af6d468629e27a3c922b0a579bb9e59d68aa8
Instruction ID: 84f115230208f86d48c7004e9c4ad7a70081654107b31da5276ac99a2ce802a0
Opcode Fuzzy Hash: e73250b5e19c991aa27d5cfed08af6d468629e27a3c922b0a579bb9e59d68aa8
Instruction Fuzzy Hash: 2401B134B045111FDB61A6BDA850B2BB7DADBCEA14F14887AE10BCB395E961DC0343A1

Uniqueness

Uniqueness Score: -1.00%

Function 06AD3B78 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc65168c9184bd448290b989d5846bbc01baae9ab62e5432d29e1a2df638d65a
Instruction ID: 7be8c58015137a4170b7d75be233fbdd700ae856ac31134dfce436a6938b6276
Opcode Fuzzy Hash: cc65168c9184bd448290b989d5846bbc01baae9ab62e5432d29e1a2df638d65a
Instruction Fuzzy Hash: 1901D435B104146BDF54AA69DC11AEF76BFDBC9614F00003AD50ADB284DE619C0247E3

Uniqueness

Uniqueness Score: -1.00%

Function 0109D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2872725947.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_109d000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 025c68aafad10deea26af8cb80e34adeb9dc394be64dd498b9413452dd4b5dda
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5B110075544240DFCB12CF18C5D4B15BFA1FB84314F24C6A9E8894B252C33AD40ADF61

Uniqueness

Uniqueness Score: -1.00%

Function 06AD3848 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6dd7555cdc5e0dafcfba9653479d165203aa627ebc9dd1cb14eb0622fee5b8
Instruction ID: b02afec4e92bbba46419d0720bfc1e5fa4550285a6455908f943b55814d01bd4
Opcode Fuzzy Hash: 6c6dd7555cdc5e0dafcfba9653479d165203aa627ebc9dd1cb14eb0622fee5b8
Instruction Fuzzy Hash: BF11B0B5D01259EFCB00DF9AD884ADEFFB4FB49324F10852AE918A7240D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AD3840 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af97259980b8e12bb0509894035ecd886c2b033a40f2068bfe6a3a0c3b8f7fbf
Instruction ID: e9be79220cbd9fc68fbb85647a36b72d3026b01320ab51ad15c5f1d4f17c75d1
Opcode Fuzzy Hash: af97259980b8e12bb0509894035ecd886c2b033a40f2068bfe6a3a0c3b8f7fbf
Instruction Fuzzy Hash: 5A21FCB5D00659EFCB00DF9AD884ADEFBB4BB08320F10852AE918A7200C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AD41D8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3182f9614f656463eaa5cfde0b8c8f6d4d964c235cd02532c3f944f4380547d
Instruction ID: 596556e015ab3fdf6ea2f2ac2def4334bf97cf8fa415a2eddec7ee809a5f74f8
Opcode Fuzzy Hash: f3182f9614f656463eaa5cfde0b8c8f6d4d964c235cd02532c3f944f4380547d
Instruction Fuzzy Hash: BF018135B001101BDB64A6AEA85472BB2DAEBCD714F20883AE50FCB344ED75EC4343A5

Uniqueness

Uniqueness Score: -1.00%

Function 06ADED49 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df2ba7c62caf4a330dfb5a1dcc0a4bc46866a8c1961a37d4cb82119ab756403
Instruction ID: f5dce4071e066649551254ab689fe558e5657025981f57233e00669b41f23c61
Opcode Fuzzy Hash: 4df2ba7c62caf4a330dfb5a1dcc0a4bc46866a8c1961a37d4cb82119ab756403
Instruction Fuzzy Hash: 46018F75B005104BCF65EBAC949076F73D6EBC9614F10882AE54BCF344EE21EC138795

Uniqueness

Uniqueness Score: -1.00%

Function 06ADED58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a153dfbc457eed457ababd7198197dccc67847f88cce126f883fc26d1fb876d4
Instruction ID: 155832255286389f15c989a5449c991a43140d35f950322d70abd112acba472f
Opcode Fuzzy Hash: a153dfbc457eed457ababd7198197dccc67847f88cce126f883fc26d1fb876d4
Instruction Fuzzy Hash: 88018C35B001141BDF65A76DA85072F72DAEBCAA10F108839E24BCF340EE65EC034395

Uniqueness

Uniqueness Score: -1.00%

Function 06ADA2D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6c766b47ccb77bdba06b4fac8a0ee7f45a533534d72249f230b0b196ba70da
Instruction ID: 24f40e2b95d460ea9cf582eda50ab212f9a968fedac3e1515c15251c05654cf7
Opcode Fuzzy Hash: 6b6c766b47ccb77bdba06b4fac8a0ee7f45a533534d72249f230b0b196ba70da
Instruction Fuzzy Hash: DD013134B005145FDB61B7BDE85072AB3D6E7C9624F108439E20FCB354DA26EC428795

Uniqueness

Uniqueness Score: -1.00%

Function 06ADC798 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ee39510a8b4c099e51cd3d4162fcad48001cb54b19e4fd30a25c22b16840d7
Instruction ID: f9a73288d8534c0d766e10c4d2ceb719357a026a556fb987e96b5a019549708c
Opcode Fuzzy Hash: 22ee39510a8b4c099e51cd3d4162fcad48001cb54b19e4fd30a25c22b16840d7
Instruction Fuzzy Hash: 3601A431F102289FCF64AA65E840A9EB7B9FB85724F404539E907EB344DB35AC05CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06AD6438 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71cfa7c8742a3b73219ed3b96a972c0426e2343bc540c58dd5e4816afde25d77
Instruction ID: 7888b677f5a643096fbfa521b5d0d41bfdba6e2d5e941ec291dc90a879f91eb2
Opcode Fuzzy Hash: 71cfa7c8742a3b73219ed3b96a972c0426e2343bc540c58dd5e4816afde25d77
Instruction Fuzzy Hash: 99E0D8B1E242086BEF50FFB0DA1578B7BAEDB42218F20C8A1D456DB142E132C9458751

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06AD7660 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06AD7BCE
$^q, xrefs: 06AD7750
$^q, xrefs: 06AD7B19
$^q, xrefs: 06AD778D
$^q, xrefs: 06AD7BC2
$^q, xrefs: 06AD7B0D
$^q, xrefs: 06AD7BB8
$^q, xrefs: 06AD775C
$^q, xrefs: 06AD7781
$^q, xrefs: 06AD7BAC

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 381eef088a3547ba104618f01b58e12430eab8c77f09e59f6240cd02ed64aca0
Instruction ID: f1648290287d2dd883db09815f0dcaee5462302df9d198478b1c220ff72b43b5
Opcode Fuzzy Hash: 381eef088a3547ba104618f01b58e12430eab8c77f09e59f6240cd02ed64aca0
Instruction Fuzzy Hash: DA12FD30E002198FDB68EF65C954A9EB7F2BF84704F2085A9D40AAB354DB31DD86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06ADA8F8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06ADAA49
$^q, xrefs: 06ADAAAA
$^q, xrefs: 06ADA9FA
$^q, xrefs: 06ADA9EE
$^q, xrefs: 06ADAAB6
$^q, xrefs: 06ADAA74
$^q, xrefs: 06ADAA80
$^q, xrefs: 06ADAA55

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: deea8d39b882513553bd9bbc6e78a931eb93015878a781d57ebaab770c2aef88
Instruction ID: 4180823b0fdf18c23cb011066b2110e6aa81e3f3b63231842c112a7d226e8b6a
Opcode Fuzzy Hash: deea8d39b882513553bd9bbc6e78a931eb93015878a781d57ebaab770c2aef88
Instruction Fuzzy Hash: D7915E30E002099FDB64EFA5DA54BAEB7F2BF84304F108529E5429B298DB759C46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06AD7060 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

.5vq, xrefs: 06AD70BB
$^q, xrefs: 06AD74FC
$^q, xrefs: 06AD7342
$^q, xrefs: 06AD7568
$^q, xrefs: 06AD73A8
$^q, xrefs: 06AD739C
$^q, xrefs: 06AD7574

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 22792f899e30b3b9db31ee932cad33428443656dad7fa1b0bbba46206284c5de
Instruction ID: 5df8d641f8ff8ea9621d44df32d5719ac115473ebb759ffbf6d6a5f978eae5fc
Opcode Fuzzy Hash: 22792f899e30b3b9db31ee932cad33428443656dad7fa1b0bbba46206284c5de
Instruction Fuzzy Hash: 44F12B34B00209CFDB59EBA5D594B6EB7F2BF84304F248568D4469B368DB75EC82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06AD8398 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06AD8663
$^q, xrefs: 06AD8657
$^q, xrefs: 06AD85FE
$^q, xrefs: 06AD85F2

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 52584b44e40f5839dcf9337ae5becc47e8d89b10cacad42e307534acb3f24145
Instruction ID: 64e80d96bfc713e61403dd356600af5e64eb6072857f6b502ea2f7c33461ed7f
Opcode Fuzzy Hash: 52584b44e40f5839dcf9337ae5becc47e8d89b10cacad42e307534acb3f24145
Instruction Fuzzy Hash: F3B12A30B002099FDB64EB69D594A9EB7F2FF84300F248969D046DB358DB79DC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06AD87B0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06AD883B
LR^q, xrefs: 06AD88F2
LR^q, xrefs: 06AD88A3
$^q, xrefs: 06AD882F

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 8855f21e3f419b6f91570a9fa5b2090ed40216df49225d1924322798c3a81858
Instruction ID: cb8288661a3d356f42178e25ac40926d5933a1cdc9a393b22f2d446a87ee32db
Opcode Fuzzy Hash: 8855f21e3f419b6f91570a9fa5b2090ed40216df49225d1924322798c3a81858
Instruction Fuzzy Hash: 81519E34B002059FDB58EB28C984A6EB7F6FB88704F108968E456DF399DB35EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ADAC87 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

$^q, xrefs: 06ADAE5C
$^q, xrefs: 06ADADB1
$^q, xrefs: 06ADAE04
$^q, xrefs: 06ADAE33

Memory Dump Source

Source File: 00000002.00000002.2880318470.0000000006AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ad0000_invoice & packing list.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 61cc745dfbfe18fd0551df51a945c4d040aeade519e97108035928c710f5bfc2
Instruction ID: a1d79a74209cb1f7d981ef519a88425a77013c8600e1e291ca54171fc510d639
Opcode Fuzzy Hash: 61cc745dfbfe18fd0551df51a945c4d040aeade519e97108035928c710f5bfc2
Instruction Fuzzy Hash: BD519D34F102058FCF65EB65D584AAEB3F2EB89310F148929E946DB358DB31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report invoice & packing list.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice & packing list.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
invoice & packing list.exe

Function 06FB0EB9 Relevance: 1.6, Strings: 1, Instructions: 320
COMMON

Function 06FB0EF0 Relevance: 1.6, Strings: 1, Instructions: 302
COMMON

Function 06FB1530 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Function 024EDB68 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 024ED0F0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 024EBE10 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 06FB3A6C Relevance: 1.4, Strings: 1, Instructions: 156
COMMON

Function 06FB36BF Relevance: 1.4, Strings: 1, Instructions: 102
COMMON

Function 06FBB2B0 Relevance: 1.4, Strings: 1, Instructions: 101
COMMON

Function 06FB36D0 Relevance: 1.3, Strings: 1, Instructions: 97
COMMON

Function 06FBB2C0 Relevance: 1.3, Strings: 1, Instructions: 91
COMMON

Function 06FBB33C Relevance: 1.3, Strings: 1, Instructions: 74
COMMON

Function 06FB3A5C Relevance: 1.3, Strings: 1, Instructions: 62
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre