Edit tour

Windows Analysis Report
RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Overview

General Information

Sample name:	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
Analysis ID:	1428254
MD5:	a6a52958bec5f9bca6d3dd49072b481b
SHA1:	c706c226c248dd1666e04ed404eab305e76228f1
SHA256:	2dcedda2d433140e29c0e0efa141df17c0398b820922c7e39f4ab503ef1f1855
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Yara detected AgentTesla

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe (PID: 5176 cmdline: "C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe" MD5: A6A52958BEC5F9BCA6D3DD49072B481B)

conhost.exe (PID: 4780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6880 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.temikan.com.tr", "Username": "merve@temikan.com.tr", "Password": "temikan63"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3322261762.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3322261762.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe PID: 5176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe PID: 5176	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 6880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6880	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3351b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3358d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33617:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336a9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33713:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33785:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3381b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338ab:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3351b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3358d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33617:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336a9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33713:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33785:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3381b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338ab:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3171b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3178d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31817:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318a9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31913:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31985:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a1b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31aab:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x5efeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x5f05d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x5f0e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x5f179:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x5f1e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x5f255:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x5f2eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x5f37b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 7 entries

Sigma Signatures

Networking

Sigma detected: RegAsm connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 31.192.214.172, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 6880, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49700

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Avira: detected

Found malware configuration

Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.temikan.com.tr", "Username": "merve@temikan.com.tr", "Password": "temikan63"}

Multi AV Scanner detection for submitted file

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Joe Sandbox ML: detected

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49699 version: TLS 1.2

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: 1_2_00BB9336 FindFirstFileExW,

1_2_00BB9336

Source: global traffic

TCP traffic: 192.168.2.6:49700 -> 31.192.214.172:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: NETINTERNETNetinternetBilisimTeknolojileriASTR NETINTERNETNetinternetBilisimTeknolojileriASTR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.6:49700 -> 31.192.214.172:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3321882179.0000000001195000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3324031872.000000000611C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3321882179.0000000001195000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3324031872.000000000611C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3321882179.0000000001195000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3324031872.000000000611C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: RegAsm.exe, 00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.temikan.com.tr
Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322028135.0000000001234000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0B
Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322028135.0000000001234000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegAsm.exe, 00000003.00000002.3322261762.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://temikan.com.tr
Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegAsm.exe, 00000003.00000002.3322261762.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegAsm.exe, 00000003.00000002.3322261762.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49699 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, cPKWk.cs

.Net Code: KidsR2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
Source: initial sample	Static PE information: Filename: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BBB99B	1_2_00BBB99B
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BAF1C0	1_2_00BAF1C0
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BAB922	1_2_00BAB922
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BB4902	1_2_00BB4902
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BBD200	1_2_00BBD200
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BB2DD2	1_2_00BB2DD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D14A98	3_2_02D14A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D1A958	3_2_02D1A958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D13E80	3_2_02D13E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D141C8	3_2_02D141C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D1F998	3_2_02D1F998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB5D38	3_2_05AB5D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB91E8	3_2_05AB91E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05ABA130	3_2_05ABA130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05ABE0D0	3_2_05ABE0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB45A8	3_2_05AB45A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB3580	3_2_05AB3580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB3CB0	3_2_05AB3CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB5658	3_2_05AB5658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05AB0338	3_2_05AB0338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_05ABC350	3_2_05ABC350

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: String function: 00BA69C0 appears 48 times

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Binary or memory string: OriginalFilename vs RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename360913dc-764e-4d41-ba62-f390e3d67fb7.exe4 vs RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@4/1@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4780:120:WilError_03

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe "C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe"
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BA6189 push ecx; ret		1_2_00BA619C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_02D10C95 push edi; ret		3_2_02D10CC2

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	File created: \rfq img_quotation po 202400969 - hessen tech_pdf.exe
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	File created: \rfq img_quotation po 202400969 - hessen tech_pdf.exe
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	File created: \rfq img_quotation po 202400969 - hessen tech_pdf.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 13A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1832			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6525			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2832	Thread sleep count: 1832 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2832	Thread sleep count: 6525 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99212s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97121s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96217s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -96000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -95890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -95781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -95672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -95562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2884	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: 1_2_00BB9336 FindFirstFileExW,

1_2_00BB9336

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99212	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97121	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96217	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: 1_2_00BACDCF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00BACDCF

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BBA4B1 mov eax, dword ptr fs:[00000030h]		1_2_00BBA4B1
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BB0694 mov ecx, dword ptr fs:[00000030h]		1_2_00BB0694

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: 1_2_00BBCAB0 GetProcessHeap,

1_2_00BBCAB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BA68F4 SetUnhandledExceptionFilter,	1_2_00BA68F4
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BA6490 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00BA6490
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BACDCF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00BACDCF
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: 1_2_00BA6798 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00BA6798

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: 1_2_00C0765D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

1_2_00C0765D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CDB008	Jump to behavior

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: 1_2_00BA627C cpuid

1_2_00BA627C

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00BBC84E
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: EnumSystemLocalesW,	1_2_00BBC18C
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: EnumSystemLocalesW,	1_2_00BBC1D7
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_00BBC2FD
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: EnumSystemLocalesW,	1_2_00BBC272
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: GetLocaleInfoW,	1_2_00BB547B
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: GetLocaleInfoW,	1_2_00BBC550
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_00BBBEEA
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00BBC679
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: GetLocaleInfoW,	1_2_00BBC77F
Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Code function: EnumSystemLocalesW,	1_2_00BB4F55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Code function: 1_2_00BA6692 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00BA6692

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3322261762.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6880, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3322261762.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6880, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.bccad0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3322261762.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6880, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	411 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	45 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	131 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	141 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	411 Process Injection	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	29%	ReversingLabs	Win32.Trojan.Generic
RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	100%	Avira	HEUR/AGEN.1352999
RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.13.205	true	false	high
temikan.com.tr	31.192.214.172	true	true	unknown
mail.temikan.com.tr	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322028135.0000000001234000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.temikan.com.tr	RegAsm.exe, 00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ipify.org	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://r3.i.lencr.org/0B	RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322028135.0000000001234000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://account.dyn.com/	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe, 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	RegAsm.exe, 00000003.00000002.3322261762.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000003.00000002.3322261762.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://temikan.com.tr	RegAsm.exe, 00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://cps.root-x1.letsencrypt.org0	RegAsm.exe, 00000003.00000002.3324031872.0000000006090000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3321882179.0000000001195000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3324031872.000000000611C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.192.214.172	temikan.com.tr	Turkey		51559	NETINTERNETNetinternetBilisimTeknolojileriASTR	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428254
Start date and time:	2024-04-18 18:28:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@4/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 62 Number of non-executed functions: 44
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
18:28:51	API Interceptor	41x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
31.192.214.172	Sxv09Al7Ah.exe	Get hash	malicious	AgentTesla	Browse
	Receipt.lnk	Get hash	malicious	AgentTesla	Browse
	rE1ge9sZhd.exe	Get hash	malicious	AgentTesla, MailPassView	Browse
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Scan-IMG PO Order CW289170-A CW201.bat.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	TransactionSummary_910020049836765_110424045239.xlsx	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PRODUCT LIST_002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	WZM.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Order Details and Specifications.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	RFQ-16042024-2_2403872952 .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://huntingtonoakmont-my.sharepoint.com/:b:/g/personal/cmariotti_oakmontcommunities_com/EeUv57weU1BKhs36H3rF_G0BHM4kTzJShI_ZPwFvp1P7-g?e=4UASJ5	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Nexpoint-annual-staff-promotion-and-benefits_KDV-791358.docx	Get hash	malicious	Unknown	Browse	104.21.63.140
	Nexpoint-annual-staff-promotion-and-benefits_KDV-791358.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=esi-doc.one/YWGTytNgAkCXj6A/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/c451eb59da652ea3e0bb7f8bf62dc775/bXNvbG9yemFub0Bsc2ZjdS5vcmc=&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Exploit.ShellCode.69.31966.31539.rtf	Get hash	malicious	Remcos	Browse	104.21.84.67
	https://assets-gbr.mkt.dynamics.com/63445ada-d6fc-ee11-9046-002248c656ac/digitalassets/standaloneforms/4f16ddf0-7afd-ee11-a1fe-000d3ad499fa	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	http://wechatunsuscribe.secure.force.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	notepad.txt	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FC2educate/aEFQv26188aEFQv26188aEFQv/anVsaWUubG9uZ2lub0BjMmVkdWNhdGUuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
NETINTERNETNetinternetBilisimTeknolojileriASTR	https://t.airgears.org/r/?resource=120958450/4d9ac80/2a1170&e=dYRtX3NhcXBhbXduQUFjYW4kb26DYXK0LWQzJnV0bW9zb3WyY3V9YWNkJnV1bV9uAWRpdZ09ZW1ibWwmd39udW09OUT3MTNwMzQzMUYmd391cj0zJm1pX4U9eW5kZWApbmVlJmNpZD2yYURNNzV0NDgmYnlkPUE2MjBzN&ref_=1wy&ref=98k/&u=4jj4/&eid=xekc6v/DU5MjEnc2VoY29lZT11cmRlZnluZWQ&s=obI3r-q7de3Me3nnN3cpKfiix7CULJmXF7FuunFtjSx	Get hash	malicious	Unknown	Browse	89.252.171.92
	product11221.exe	Get hash	malicious	AgentTesla	Browse	159.253.43.92
	invoice1337.exe	Get hash	malicious	AgentTesla	Browse	159.253.43.92
	http://minhaclaro.dtmmkt.com.br/effectivemail/redirecionaclique.aspx?idabordagem=5252932746&idlink=126090168=%0A66&endereco=//mhkyapi%E3%80%82com/temp/___cmljaGFyZEBnbG9iYWx0ZWNobmljYWxyZWFsdHkuY29t___fphpdnwwfu	Get hash	malicious	Unknown	Browse	89.252.137.195
	http://minhaclaro.dtmmkt.com.br/effectivemail/redirecionaclique.aspx?idabordagem=5252932746&idlink=126090168=%0A66&endereco=//astrolojidersleri%E3%80%82net/temp/___cnlhbnNAcHJlc2lkaW8uY29t___qegpdlclfv	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	91.227.6.15
	UGI9mVa2Gk.exe	Get hash	malicious	AgentTesla	Browse	95.173.177.114
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	95.173.177.114
	hesaphareketi-01.pdf.exe	Get hash	malicious	AgentTesla	Browse	95.173.177.114
	02_94_OR.EXE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	89.252.138.195
	TAVMCtVXa5.exe	Get hash	malicious	Unknown	Browse	89.252.138.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SA162.pdf.download.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://wechatunsuscribe.secure.force.com/	Get hash	malicious	Unknown	Browse	104.26.13.205
	https://t.airgears.org/r/?resource=120958450/4d9ac80/2a1170&e=dYRtX3NhcXBhbXduQUFjYW4kb26DYXK0LWQzJnV0bW9zb3WyY3V9YWNkJnV1bV9uAWRpdZ09ZW1ibWwmd39udW09OUT3MTNwMzQzMUYmd391cj0zJm1pX4U9eW5kZWApbmVlJmNpZD2yYURNNzV0NDgmYnlkPUE2MjBzN&ref_=1wy&ref=98k/&u=4jj4/&eid=xekc6v/DU5MjEnc2VoY29lZT11cmRlZnluZWQ&s=obI3r-q7de3Me3nnN3cpKfiix7CULJmXF7FuunFtjSx	Get hash	malicious	Unknown	Browse	104.26.13.205
	ueworoejvdvhruthqq3.exe	Get hash	malicious	Patchwork	Browse	104.26.13.205
	ueworoejvdvhruthqq3.exe	Get hash	malicious	Patchwork	Browse	104.26.13.205
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Scan-IMG PO Order CW289170-A CW201.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://Doggygangers.com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/get_download_file_name.php	Get hash	malicious	Unknown	Browse	104.26.13.205
	_Contrato_E2024A493865_PDF.js	Get hash	malicious	Unknown	Browse	104.26.13.205
	PRODUCT LIST_002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:A:A
MD5:	C83BBF39A26190B2D0EC2D3091356053
SHA1:	2C29EC19A8EC05D0CAA6527EA271229C0E7A7442
SHA-256:	7C468F5E59F2871B946E051445493BBCACE531D597EDBBCC9935E7D02D025114
SHA-512:	076C9EBFDD34C47081D70EA7A493B1CF324B3B5AE8286886590167F865D0D2936C8FE31B8C1E4BF7C40425C58F146C4D7B8E49B2EFF991EFB830A0518E041B7F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	4..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.592956266550325
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
File size:	429'056 bytes
MD5:	a6a52958bec5f9bca6d3dd49072b481b
SHA1:	c706c226c248dd1666e04ed404eab305e76228f1
SHA256:	2dcedda2d433140e29c0e0efa141df17c0398b820922c7e39f4ab503ef1f1855
SHA512:	db266982d3029b0ae5086955cdd37256757c2a943fa849634db4629a33f40d49c88ea5574d7752bead60580072c88f582a02e9078de31d00684e957db869997d
SSDEEP:	12288:W7/6Tsprci/CRTVXmsQuCiGhtsvo4H3mkiOYfjaneE:Wz62gi/wVmFuKmvLH2Jr+e
TLSH:	2194E11575C080B2D933213109F4DAB96E7DF9700AA55A8F67E40F7E8F70382E635AA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........OW.h.W.h.W.h...k.[.h...m...h...l.B.h..tl.E.h..tk.C.h...i.R.h.W.i...h..tm...h..wa.V.h..wj.V.h.RichW.h.........PE..L...z.!f...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x405f2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6621097A [Thu Apr 18 11:52:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e233f55b2e1564f7081c0ffda9a4bede

Entrypoint Preview

Instruction
call 00007F2200557BC1h
jmp 00007F2200557289h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F220055742Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F220055741Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F220055741Eh
add edx, 28h
cmp edx, esi
jne 00007F22005573FCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F220055740Bh
push esi
call 00007F2200557E98h
test eax, eax
je 00007F2200557432h
mov eax, dword ptr fs:[00000018h]
mov esi, 004680F0h
mov edx, dword ptr [eax+04h]
jmp 00007F2200557416h
cmp edx, eax
je 00007F2200557422h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F2200557402h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F2200557419h
mov byte ptr [004680F4h], 00000001h
call 00007F22005576CEh
call 00007F220055A43Bh
test al, al
jne 00007F2200557416h
xor al, al
pop ebp
ret
call 00007F22005637F8h
test al, al
jne 00007F220055741Ch
push 00000000h
call 00007F220055A442h
pop ecx
jmp 00007F22005573FBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [004680F5h], 00000000h
je 00007F2200557416h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b5b0	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x69000	0x1a8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29be0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29b20	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20d0f	0x20e00	e13a5776a0ed4655a44cc440cc250974	False	0.5821649239543726	data	6.632055157739106	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x9d14	0x9e00	88084451017105b1bf88cbc483fe6a3a	False	0.43599189082278483	data	4.974989141605991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x3cc08	0x3c000	3a44a39d7483e8b1dd90252c7311abe5	False	0.9847330729166667	DOS executable (block device driver \377\377\377\377)	7.984086048070751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x69000	0x1a8c	0x1c00	03f78380ee09af8022ac36975739032a	False	0.7214006696428571	data	6.36135008718028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

GDI32.dll

GetMapMode

KERNEL32.dll

WaitForSingleObject, CloseHandle, FreeConsole, CreateThread, VirtualProtectEx, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 18:28:50.473212957 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:50.473248959 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:50.473469019 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:50.521197081 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:50.521214008 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:50.748012066 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:50.748162031 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:50.752120018 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:50.752135992 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:50.752535105 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:50.793140888 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:50.820554018 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:50.864126921 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:51.053046942 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:51.053183079 CEST	443	49699	104.26.13.205	192.168.2.6
Apr 18, 2024 18:28:51.053262949 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:51.061496973 CEST	49699	443	192.168.2.6	104.26.13.205
Apr 18, 2024 18:28:52.223192930 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:52.475507021 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:52.476077080 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:53.076950073 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.090153933 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:53.342488050 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.342856884 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:53.597315073 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.597907066 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:53.859363079 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.859400034 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.859419107 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.859437943 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.859524012 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:53.859569073 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:53.862119913 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:53.902386904 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:53.912262917 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:54.164932013 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:54.168112040 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:54.420483112 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:54.421696901 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:54.674455881 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:54.678726912 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:54.973675966 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.014667988 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.014967918 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:55.267065048 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.267127037 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.267497063 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:55.558964014 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.577142954 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.577374935 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:55.829405069 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.829464912 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:55.835869074 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:55.836117983 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:55.836144924 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:55.836169958 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:28:56.088090897 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:56.088123083 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:56.088545084 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:56.092376947 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:28:56.136816978 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:30:31.683922052 CEST	49700	587	192.168.2.6	31.192.214.172
Apr 18, 2024 18:30:31.937190056 CEST	587	49700	31.192.214.172	192.168.2.6
Apr 18, 2024 18:30:31.937952042 CEST	49700	587	192.168.2.6	31.192.214.172

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 18:28:50.363900900 CEST	55525	53	192.168.2.6	1.1.1.1
Apr 18, 2024 18:28:50.468190908 CEST	53	55525	1.1.1.1	192.168.2.6
Apr 18, 2024 18:28:51.667602062 CEST	54043	53	192.168.2.6	1.1.1.1
Apr 18, 2024 18:28:52.221893072 CEST	53	54043	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 18:28:50.363900900 CEST	192.168.2.6	1.1.1.1	0x4542	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:28:51.667602062 CEST	192.168.2.6	1.1.1.1	0xd553	Standard query (0)	mail.temikan.com.tr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 18:28:50.468190908 CEST	1.1.1.1	192.168.2.6	0x4542	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:28:50.468190908 CEST	1.1.1.1	192.168.2.6	0x4542	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:28:50.468190908 CEST	1.1.1.1	192.168.2.6	0x4542	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 18, 2024 18:28:52.221893072 CEST	1.1.1.1	192.168.2.6	0xd553	No error (0)	mail.temikan.com.tr	temikan.com.tr		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 18:28:52.221893072 CEST	1.1.1.1	192.168.2.6	0xd553	No error (0)	temikan.com.tr		31.192.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	104.26.13.205	443	6880	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 16:28:50 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 16:28:51 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 16:28:50 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876607c248feb0bd-ATL
2024-04-18 16:28:51 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 18, 2024 18:28:53.076950073 CEST	587	49700	31.192.214.172	192.168.2.6	220-ni-polo.guzelhosting.com ESMTP Exim 4.96.2 #2 Thu, 18 Apr 2024 19:28:50 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 18, 2024 18:28:53.090153933 CEST	49700	587	192.168.2.6	31.192.214.172	EHLO 609290
Apr 18, 2024 18:28:53.342488050 CEST	587	49700	31.192.214.172	192.168.2.6	250-ni-polo.guzelhosting.com Hello 609290 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 18, 2024 18:28:53.342856884 CEST	49700	587	192.168.2.6	31.192.214.172	STARTTLS
Apr 18, 2024 18:28:53.597315073 CEST	587	49700	31.192.214.172	192.168.2.6	220 TLS go ahead

Target ID:	1
Start time:	18:28:48
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe"
Imagebase:	0xba0000
File size:	429'056 bytes
MD5 hash:	A6A52958BEC5F9BCA6D3DD49072B481B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:28:49
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:28:49
Start date:	18/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3321463370.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3322261762.0000000002DCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3322261762.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3322261762.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3322261762.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	46

Executed Functions

Function 00C0765D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00C077CC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00C077DF
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00C077FD
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00C07821
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 00C0784C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 00C078A4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 00C078EF
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00C0792D
Wow64SetThreadContext.KERNEL32(?,?), ref: 00C07969
ResumeThread.KERNELBASE(?), ref: 00C07978

Strings

Load, xrefs: 00C0769B
aryA, xrefs: 00C076A3
GetP, xrefs: 00C076DF
ress, xrefs: 00C076E7

Memory Dump Source

Source File: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 325aeaf332111adc57c95a5635d661d2786f87777f4ac56eee36315c382ed89e
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 99B1F47260028AAFDB60CF68CC80BDA73A5FF88714F158124EA18AB341D774FA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BBA4B1 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750bb6e24bacf6c6c1fe22d30eab7ef70185d3f4fb1221bc52ea6ae82660aa2b
Instruction ID: b38431a99a545ec3262524b93ca70ce3f3fc846fa93bf1af3a7c2a67181ed772
Opcode Fuzzy Hash: 750bb6e24bacf6c6c1fe22d30eab7ef70185d3f4fb1221bc52ea6ae82660aa2b
Instruction Fuzzy Hash: 5EE08C32912228EBCB25DB88C94899AF3ECEB45B00B1544A6B901E3210C2B0DE00D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB0694 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a398322db21a4a0fba5e59ad2640d5830a167ac53607654cde88f89d890111d
Instruction ID: 2c8cb93e67750a9f168e5a74bede1a9d1a4b69aa54821a9c82fd2a98982e1394
Opcode Fuzzy Hash: 9a398322db21a4a0fba5e59ad2640d5830a167ac53607654cde88f89d890111d
Instruction Fuzzy Hash: 65C01274A10A2047CE29A91482723FA3394F3D2782F8004CCC4030A782C5DE9C82DA81

Uniqueness

Uniqueness Score: -1.00%

Function 00BA1C39 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BA1E99: _strlen.LIBCMT ref: 00BA1EB1

Part of subcall function 00BA1D5A: __EH_prolog3_catch.LIBCMT ref: 00BA1D61

GetMapMode.GDI32(?,?,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 00BA1C90
VirtualProtectEx.KERNELBASE(000000FF,00C074D0,000004AC,00000040,?), ref: 00BA1CAE
FreeConsole.KERNELBASE ref: 00BA1CB4
CreateThread.KERNELBASE(00000000,00000000,Function_00067658,00BCCAD0,00000000,?), ref: 00BA1D00
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00BA1D0B
CloseHandle.KERNEL32(00000000), ref: 00BA1D12

Strings

006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@, xrefs: 00BA1C4F

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: CloseConsoleCreateFreeH_prolog3_catchHandleModeObjectProtectSingleThreadVirtualWait_strlen
String ID: 006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@
API String ID: 1073060540-32248209
Opcode ID: 51244b1a54365cedd2b04805a79dad299137adf7fb8dacd33b53971b51be29fb
Instruction ID: 04af1992adb330e8e5695a14ead64d59c2b3a1d23ef549dc3dabf77c38a3ca30
Opcode Fuzzy Hash: 51244b1a54365cedd2b04805a79dad299137adf7fb8dacd33b53971b51be29fb
Instruction Fuzzy Hash: 5F210B715083106BD728AB389C1AD9B7BD8EF4A720F100B5EF46A571D1DE206D06C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00BB511E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,66377BDF,?,00BB522B,00BAB276,?,F8250000,00000000), ref: 00BB51DF

Strings

ext-ms-, xrefs: 00BB5189
api-ms-, xrefs: 00BB5175

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ba5ebef5625be32f2ef0e3b38e15c5fa391d4e7233932b2d9785ea37481df961
Instruction ID: 921042809a9ca583d315d715a70f54a6bae5f1e9900b212d6bbb311e9f3c914d
Opcode Fuzzy Hash: ba5ebef5625be32f2ef0e3b38e15c5fa391d4e7233932b2d9785ea37481df961
Instruction Fuzzy Hash: 5721F371A01A11EBD7329B29DC40FBE37D8EF11760F220191E816B7291DBB0ED00C6E2

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3090 Relevance: 7.6, APIs: 5, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BA309C
int.LIBCPMT ref: 00BA30AF

Part of subcall function 00BA165A: std::_Lockit::_Lockit.LIBCPMT ref: 00BA166B
Part of subcall function 00BA165A: std::_Lockit::~_Lockit.LIBCPMT ref: 00BA1685

std::_Facet_Register.LIBCPMT ref: 00BA30E2
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA30F8
Concurrency::cancel_current_task.LIBCPMT ref: 00BA3103

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 119c9ab62fac3bff8d34985fac8251fd3d696b44353e5fdaada6575aeb7e2699
Instruction ID: 17758a37cc7778542fffc815a5961fa2471ebf45a7836dbc82273f25ce7fd3cf
Opcode Fuzzy Hash: 119c9ab62fac3bff8d34985fac8251fd3d696b44353e5fdaada6575aeb7e2699
Instruction Fuzzy Hash: EB11277260C528ABCB14AB5CDC16EAD77E8DF46B60F1402C9F9559B281EF70AF0187D4

Uniqueness

Uniqueness Score: -1.00%

Function 00BB0620 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00BB0776,?,00BB061A,00000000,?,?,00BB0776,66377BDF,?,00BB0776), ref: 00BB0631
TerminateProcess.KERNEL32(00000000,?,00BB061A,00000000,?,?,00BB0776,66377BDF,?,00BB0776), ref: 00BB0638
ExitProcess.KERNEL32 ref: 00BB064A

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 729827ef36ccd7bd5bc15245a436c7d308505f022efd99e56088d0d8cb9d372c
Instruction ID: 9907f40e2eeb502d6ab5e6741dc722b9ded36b3aa032a7ab49c587636bf536bd
Opcode Fuzzy Hash: 729827ef36ccd7bd5bc15245a436c7d308505f022efd99e56088d0d8cb9d372c
Instruction Fuzzy Hash: B3D09231010208AFCF113FA0DD0ECFE3F6AEF98341B004061B90A4A172DFB599A6DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00BB63A1 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB5AEB: GetConsoleOutputCP.KERNEL32(66377BDF,00000000,00000000,00000000), ref: 00BB5B4E

WriteFile.KERNEL32(?,00000000,?,00BCB310,00000000,0000000C,00000000,00000000,?,00000000,00BCB310,00000010,00BAE314,00000000,00000000,00000000), ref: 00BB650A
GetLastError.KERNEL32(?,00000000), ref: 00BB6514

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 89293916037efc943629fdd13b80f7349c23033122ded800837682846ac2d808
Instruction ID: 3e6442a36cdcc96ea178b4c549b4e88fb4227f3102b4dc6cd86a36494223fa0b
Opcode Fuzzy Hash: 89293916037efc943629fdd13b80f7349c23033122ded800837682846ac2d808
Instruction Fuzzy Hash: E4619EB1D04209AFDF208FA8C884AFEBBF9EF19304F1440D5E804A6256D3B9DD15CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5FA3 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,00BB64F0,00000000,00000000,00000000,?,0000000C,00000000), ref: 00BB603F
GetLastError.KERNEL32(?,00BB64F0,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,00BCB310,00000010,00BAE314,00000000,00000000), ref: 00BB6065

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 6a96df4ab9d3160bf0ba875e4aa4adcc04930c52ded7f45c6e5a875a94f0aa57
Instruction ID: 6b4ae8dd99c1a2c43ef8f675d8069fb1d16ecc07392a3cab9fd103b0e3bedf60
Opcode Fuzzy Hash: 6a96df4ab9d3160bf0ba875e4aa4adcc04930c52ded7f45c6e5a875a94f0aa57
Instruction Fuzzy Hash: D1219134A002199FCB15DF2ADCC0AE9B7FAEB5C301F5440E9E906D7251D670DE46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BB42F4 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00BB4340
GetFileType.KERNELBASE(00000000), ref: 00BB4352

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: bf23606c60f1bbdf45b68631bb599dc1870685824485981cfe10d716c50e61be
Instruction ID: 6b811288ab22be96e33d266fc39c7465225839429069d2e2c92e9205eb4aa596
Opcode Fuzzy Hash: bf23606c60f1bbdf45b68631bb599dc1870685824485981cfe10d716c50e61be
Instruction Fuzzy Hash: 7411817160475147CB348A3E8C886B67AD5F756330B3D07AAE0B6875F3C7B0D886D649

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4847 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8469b0460524071e44e5c1bbe61eac27b5c6ee48468ae67e607583b3840ff34b
Instruction ID: 2802a779d2167d669a887120cb840c7cd65c43da69d199572c2a9cb39be5647a
Opcode Fuzzy Hash: 8469b0460524071e44e5c1bbe61eac27b5c6ee48468ae67e607583b3840ff34b
Instruction Fuzzy Hash: 8631853190451AAFCF14CF68D4909DFB7F9FF8A324B14029AE511A7690D771F954CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BA1D5A Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00BA1D61

Part of subcall function 00BA313B: std::_Lockit::_Lockit.LIBCPMT ref: 00BA3147
Part of subcall function 00BA313B: int.LIBCPMT ref: 00BA315A
Part of subcall function 00BA313B: std::_Lockit::~_Lockit.LIBCPMT ref: 00BA31A3

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3_catchLockit::_Lockit::~_
String ID:
API String ID: 1693569656-0
Opcode ID: ac8b594776bcf76c667c5688490ded15b9f987d7856b4db6c02d7de63961996c
Instruction ID: c85441381ba7c9472c345a0a81d2134b1b13b67e1f068d5bb915730e614bdc72
Opcode Fuzzy Hash: ac8b594776bcf76c667c5688490ded15b9f987d7856b4db6c02d7de63961996c
Instruction Fuzzy Hash: 03218371E082459FCB05DBA8C989FEDBBF5BF49310F1481D9F505AB292DA30AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB51E9 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d468bf0719111c2102a6c3b0ca9149bed5285bed7ed3f0ad13d938fd875731
Instruction ID: dc6a04ca47a77bf9a4091e7dcce59f19bbf85c73891afae3d0d790dd431cfcb8
Opcode Fuzzy Hash: 64d468bf0719111c2102a6c3b0ca9149bed5285bed7ed3f0ad13d938fd875731
Instruction Fuzzy Hash: A801F533715A159FAB26CE6DEC41BAB37D6EBC83207184164FA05DB154DE70D8018752

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2479 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_swprintf.LIBCMT ref: 00BA24B9

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: _swprintf
String ID:
API String ID: 589789837-0
Opcode ID: bb5d4f8053a1c243aa476c3cb7d495b896ec10259871287b582b5993e7c76eb2
Instruction ID: 73777ff1c2669d62b351b44273af578149cb549f42fed0cab12fb85a9fa94a77
Opcode Fuzzy Hash: bb5d4f8053a1c243aa476c3cb7d495b896ec10259871287b582b5993e7c76eb2
Instruction Fuzzy Hash: 2B01F773504208BFDB10EF58CC42DABB7ACFB49724F00051AFA5493151EA31E92487E2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00BBD200 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BBD3E4

Strings

1#QNAN, xrefs: 00BBD313
1#SNAN, xrefs: 00BBD30C
1#INF, xrefs: 00BBD336
1#IND, xrefs: 00BBD305

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b0fb2d558d6ddf7bd870ef05e577300199fb8c6f42825c7aaf678d30835f9717
Instruction ID: 2cba4c67888d5c2ba12db1c0131167d6c54f0d384edfbb6ee8275e4907563d3b
Opcode Fuzzy Hash: b0fb2d558d6ddf7bd870ef05e577300199fb8c6f42825c7aaf678d30835f9717
Instruction Fuzzy Hash: 8BD22A71E082288FDB65CE28DD807EAB7F5EB54305F1445EAD44EE7240E7B8AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC679 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00BBC997,00000002,00000000,?,?,?,00BBC997,?,00000000), ref: 00BBC712
GetLocaleInfoW.KERNEL32(?,20001004,00BBC997,00000002,00000000,?,?,?,00BBC997,?,00000000), ref: 00BBC73B
GetACP.KERNEL32(?,?,00BBC997,?,00000000), ref: 00BBC750

Strings

ACP, xrefs: 00BBC697
OCP, xrefs: 00BBC6CD

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5bd3a0f7a93bcce50102abf727a755e93a6af66d557e9cec77cee5b60455c60e
Instruction ID: c9ec2ee41fdc306a24d275d79ad80430597702ef9f97db042c8211c483707796
Opcode Fuzzy Hash: 5bd3a0f7a93bcce50102abf727a755e93a6af66d557e9cec77cee5b60455c60e
Instruction Fuzzy Hash: DB216026600101A7DB34CF65C940FF77BE6EB58B60B5684A4E91BDB110EBB2DD41D790

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC84E Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00BBC95A
IsValidCodePage.KERNEL32(00000000), ref: 00BBC9A3
IsValidLocale.KERNEL32(?,00000001), ref: 00BBC9B2
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00BBC9FA
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00BBCA19

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 5bbad4e7afb166313b2db7b7a06735d310eae07c1d57f3043b18c9d76235a062
Instruction ID: 84add96da9c7ceaaa8a83678231b33693545e3e38adea65b50aa63aaa248efe2
Opcode Fuzzy Hash: 5bbad4e7afb166313b2db7b7a06735d310eae07c1d57f3043b18c9d76235a062
Instruction Fuzzy Hash: AE517F72A00205ABEF11DFA5CC41EFE7BF8EF49700F1444A9E995E7191EBB09A408B61

Uniqueness

Uniqueness Score: -1.00%

Function 00BBBEEA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

GetACP.KERNEL32(?,?,?,?,?,?,00BB0FD3,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00BBBFAB
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00BB0FD3,?,?,?,00000055,?,-00000050,?,?), ref: 00BBBFD6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00BBC139

Strings

utf8, xrefs: 00BBC0A8

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 3aa8e1de55b4626c73752829bb7623e02ae132e0c36b5dba35e2fbf722d5e707
Instruction ID: 052042160da1ba1e6a3d8480a448bc5ce21ed7b44362049e75bcef40a0a263b7
Opcode Fuzzy Hash: 3aa8e1de55b4626c73752829bb7623e02ae132e0c36b5dba35e2fbf722d5e707
Instruction Fuzzy Hash: 89719F71640606ABDB24EB75CC86FFA77E8EF45710F1444AAFA05E7181EBF0E94087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2DD2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BB2E5F

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 0a5fbe819e4ab1e77cef03ab8bd2c26e6f29305eab88940d16d3be36f103b94c
Instruction ID: d2fc9adae098115a34711e85b58b505aa0c50b192647441dd1768be7b8a92d56
Opcode Fuzzy Hash: 0a5fbe819e4ab1e77cef03ab8bd2c26e6f29305eab88940d16d3be36f103b94c
Instruction Fuzzy Hash: 6EB136329042459FDB15DF68C881BFEBBF5EF59350F1581EAE805AB241D2B5DE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6798 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00BA67A4
IsDebuggerPresent.KERNEL32 ref: 00BA6870
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BA6889
UnhandledExceptionFilter.KERNEL32(?), ref: 00BA6893

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d21adae83f49f5d8c503e025a45025f53f45e11e0e2539d7d82d571e09e9af11
Instruction ID: 308ea1c41b8b7075c5428692d0277301c86d03a0ae730b91f1e009d5f3d45ad5
Opcode Fuzzy Hash: d21adae83f49f5d8c503e025a45025f53f45e11e0e2539d7d82d571e09e9af11
Instruction Fuzzy Hash: 6231E5B5D092199BDF20DFA4D949BCDBBF8AF08304F1041EAE40DAB250EB759A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC2FD Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BBC351
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BBC39B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BBC461

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: b9f6b09efb88fec58215f43cc4beec2598cadf418287b50db2fdb3f01489a595
Instruction ID: 2f9f9bac103498c5f8b30d42058c4e55ef1dc3a2a36b360407441e7e72e75cf5
Opcode Fuzzy Hash: b9f6b09efb88fec58215f43cc4beec2598cadf418287b50db2fdb3f01489a595
Instruction Fuzzy Hash: FB6160719005179FDB28DF24CC92BFA7BE8EF54310F1041BAE906C6685EBB4EA85DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BACDCF Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00BACEC7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BACED1
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00BACEDE

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: dbe2c828c30b33fba50c52fe815c43d77db9843ab7f0a01b7d135182e8b2b3bc
Instruction ID: 62843261e25be6298bed73c9b026970efda8f885d0da0c4634cf3d1a23ecc211
Opcode Fuzzy Hash: dbe2c828c30b33fba50c52fe815c43d77db9843ab7f0a01b7d135182e8b2b3bc
Instruction Fuzzy Hash: 1431A4759052199BCB21DF64DD89B8DBBF8FF08310F5041EAE41CA7260EB749B858F44

Uniqueness

Uniqueness Score: -1.00%

Function 00BAF1C0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18014d3bc7e328d1a784cb4e9c3b3e4733de8ca481f64099e5cb8d8dc1847e8c
Instruction ID: 9c06864dd42ae41202a2c17dce1ba4878d496d1083b714039633f707627d3cbd
Opcode Fuzzy Hash: 18014d3bc7e328d1a784cb4e9c3b3e4733de8ca481f64099e5cb8d8dc1847e8c
Instruction Fuzzy Hash: 01F11D71E0421A9FDF14CFA9D880AEDB7F1EF89314F1582A9E815AB391D730AD05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4902 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BB48FD,?,?,00000008,?,?,00BC1115,00000000), ref: 00BB4B2F

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: edea73cecc5533ea6a7e11bb37b9576f87712634bd1045edf5dcf75257638695
Instruction ID: eb6c2eda799324870ef2c257efec2a28f65a5b9b4b10ce8a22cdbd69d16db905
Opcode Fuzzy Hash: edea73cecc5533ea6a7e11bb37b9576f87712634bd1045edf5dcf75257638695
Instruction Fuzzy Hash: BFB14C31210605DFDB24CF28C486BA57BE0FF45365F258698E9D9CF2A2C375E982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00BA627C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BA6292

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: cfe8b7d422e142d56ec0be3b350673e984bcbd6c5e1d35d7605adcbc438c8917
Instruction ID: ffba2212549f7d08407b8e931d917c8268c28ea00a4fe326212c1657d8e17ef0
Opcode Fuzzy Hash: cfe8b7d422e142d56ec0be3b350673e984bcbd6c5e1d35d7605adcbc438c8917
Instruction Fuzzy Hash: E6518BB1A05205CBEB18CF68D8967AEBBF0FB4C314F1884AAC455EB350DB759941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BB9336 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953f6e81ffa02ce1e18f978e05ad4341b7e0f38641eecfd8fa55b3e6d3c74b2e
Instruction ID: 8e4eb7568aec50535fd7767c3e2ddd0c8ad24c18ee46081ca45788082ebfab9c
Opcode Fuzzy Hash: 953f6e81ffa02ce1e18f978e05ad4341b7e0f38641eecfd8fa55b3e6d3c74b2e
Instruction Fuzzy Hash: 6D41ADB5804219AFDB20DF69CC89AFABBF9EF45304F1442D9E40DE3241DA759E858F60

Uniqueness

Uniqueness Score: -1.00%

Function 00BAB922 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00BABAB0

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 82cad758b35342542f9aa7c6bd48d34997fb9bb3bf9c1d63f78d45a4854180be
Instruction ID: 6eae33c5e314266c8fa78d850e3ae4951fc69e3431a3c78aa5d916a1adedfbfb
Opcode Fuzzy Hash: 82cad758b35342542f9aa7c6bd48d34997fb9bb3bf9c1d63f78d45a4854180be
Instruction Fuzzy Hash: FCC1EF7060864A8FCB28CF68C490EBEBBE1EF07310F544699D5B69B293DB31AD45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC550 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BBC5A4

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fafeed747aa20aa36829297ed1019872dc54b27ef172f8eabdcccc15ab749a0f
Instruction ID: 71823dfc04273b8a244896f86db91286e4553d32907b51971bf7c17d22717349
Opcode Fuzzy Hash: fafeed747aa20aa36829297ed1019872dc54b27ef172f8eabdcccc15ab749a0f
Instruction Fuzzy Hash: 5C218332614206ABDB28DB15DC82EFA7BE8EF54714B1050BAF906D7141EBB4ED40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC1D7 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

EnumSystemLocalesW.KERNEL32(00BBC2FD,00000001,00000000,?,-00000050,?,00BBC92E,00000000,?,?,?,00000055,?), ref: 00BBC249

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 18d6c9e143bd4a6b66e12fd518c516da9392cd5d7abed4427ef358585a324ff5
Instruction ID: 9e4e22b7225ac3bd45e1c6cb6d99708c10b9fdb2fbf07a43d33a6db689c6e748
Opcode Fuzzy Hash: 18d6c9e143bd4a6b66e12fd518c516da9392cd5d7abed4427ef358585a324ff5
Instruction Fuzzy Hash: E81125366043059FDB18DF78C8916BABBD1FF80768B14846DE98797A40D3B1A942C740

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC77F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00BBC519,00000000,00000000,?), ref: 00BBC7AB

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: da4a9a568e6ef56804d6bb35e88e84dbb627d6243aa0d88b11ac859558654a8d
Instruction ID: 8e76cda61417fe6c7bb98065620e39579a17126692a679142f9e258679cf4a90
Opcode Fuzzy Hash: da4a9a568e6ef56804d6bb35e88e84dbb627d6243aa0d88b11ac859558654a8d
Instruction Fuzzy Hash: A3F086379001126BDB249B658C45BFA7BE8EB40754F1544A5EC56E3180DFB4FE41C991

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC272 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

EnumSystemLocalesW.KERNEL32(00BBC550,00000001,?,?,-00000050,?,00BBC8F2,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00BBC2BC

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d90c295b1c7fb12f9009ab884ed0b8c0646367bbe9ad2929b1011fce4fcfc5fa
Instruction ID: 8f990a27824d56646ecfd7c055197a92da21bdc0ca9769afafb270c720c26078
Opcode Fuzzy Hash: d90c295b1c7fb12f9009ab884ed0b8c0646367bbe9ad2929b1011fce4fcfc5fa
Instruction Fuzzy Hash: 77F096362003045FDB249F79DC81ABA7FD5EF80768B1584AEF94A4B690D6F1AC42C650

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4F55 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BAD06D: EnterCriticalSection.KERNEL32(?,?,00BB3C2B,?,00BCB1D0,00000008,00BB3DEF,?,00BAB276,?), ref: 00BAD07C

EnumSystemLocalesW.KERNEL32(00BB4F48,00000001,00BCB290,0000000C,00BB5377,00000000), ref: 00BB4F8D

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 3c657a3b7503daaf10ee6569bd963fa00e5b022ed8439729223042172ad32d86
Instruction ID: aed50cacd39c16fe98cf4a7eb496662471c6a3e9e536cce40f0650542af27ed4
Opcode Fuzzy Hash: 3c657a3b7503daaf10ee6569bd963fa00e5b022ed8439729223042172ad32d86
Instruction Fuzzy Hash: DFF04976A04204DFD710EF98E842BAD7BF0FB49B21F1081AAF415DB6A1CBB94944CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00BBC18C Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BB3F53: GetLastError.KERNEL32(?,?,00BAF174,?,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?), ref: 00BB3F57
Part of subcall function 00BB3F53: SetLastError.KERNEL32(00000000,00BAC25F,?,?,00000003,00BAB46B,?,?,?,?,00000000,00BAC25F,?,?,?), ref: 00BB3FF9

EnumSystemLocalesW.KERNEL32(00BBC0E5,00000001,?,?,?,00BBC950,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00BBC1C3

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 36cfd69624efbbd728666e8bd60e864873f565f1d93eda76a538a604c60b417f
Instruction ID: 5ecb8ed8129e00c5352d4677f70dba90d764709d64e11f202bdb076a11edd0cb
Opcode Fuzzy Hash: 36cfd69624efbbd728666e8bd60e864873f565f1d93eda76a538a604c60b417f
Instruction Fuzzy Hash: F5F0E53674020597CB04EF39DC45BBABFE4EFC1750B46809AFE0A9B251C6F29942C790

Uniqueness

Uniqueness Score: -1.00%

Function 00BB547B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00BB1B39,?,20001004,00000000,00000002,?,?,00BB113B), ref: 00BB54AF

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 108b1eea3dd6d7286c2d9e9e0cab5fdf163c9ab71ddbda3259c04cd066e5a26e
Instruction ID: 89007dd936756ff030aca732fdf7c3526ceec7453e1ff89818eff35695abd033
Opcode Fuzzy Hash: 108b1eea3dd6d7286c2d9e9e0cab5fdf163c9ab71ddbda3259c04cd066e5a26e
Instruction Fuzzy Hash: 1BE04F31500A18BBCF222F61DC08FFE7F96EF44761F048051FD0566221DBB18961EAD6

Uniqueness

Uniqueness Score: -1.00%

Function 00BA68F4 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006900,00BA5D9F), ref: 00BA68F9

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b06c3a325e8f961572f27a37968799a5cb2bebe74625d61587059df2dd93b6de
Instruction ID: 08496f2f3ef2aeb66ee76e4d837d7e6e12e62055ed8106247382c4334e306b91
Opcode Fuzzy Hash: b06c3a325e8f961572f27a37968799a5cb2bebe74625d61587059df2dd93b6de
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00BBCAB0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BBCAB0

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1712c9404cd946273b18b9025e23cb97cc39bf06a498f492aee153d7345ee47f
Instruction ID: 600d44b8a92ccbedba55d113f975f53cdbd9e7408fa2c26a16446bd06de4ea77
Opcode Fuzzy Hash: 1712c9404cd946273b18b9025e23cb97cc39bf06a498f492aee153d7345ee47f
Instruction Fuzzy Hash: 9AA001B06052018B97408F36AE59B0D7BAAAA49A91B0A80A9A545D61A0EE648494AF01

Uniqueness

Uniqueness Score: -1.00%

Function 00BBB99B Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 5bdad192e5ccef97fe725fc1157eed4bad236ef913b6cd29063d5434c32cb755
Instruction ID: 6a5f81627c08ddf7c53cd418e63a65a3b52be2b5513c189f86e56b7dd96313d5
Opcode Fuzzy Hash: 5bdad192e5ccef97fe725fc1157eed4bad236ef913b6cd29063d5434c32cb755
Instruction Fuzzy Hash: 36B1C0355007059BDB38DB28CC92EF7B7E9EF44308F5448ADEA8686584EBF5E985CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00BA93F8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BA9517
___TypeMatch.LIBVCRUNTIME ref: 00BA9625
_UnwindNestedFrames.LIBCMT ref: 00BA9777
CallUnexpected.LIBVCRUNTIME ref: 00BA9792

Strings

csm, xrefs: 00BA9435
csm, xrefs: 00BA954E
csm, xrefs: 00BA94A2

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 835f7242161eb4cfb455d83a87196b2c26043f5b49b9882fc6e37f8b73e009e4
Instruction ID: 5538b71095e755d0a3f1dd50a6b7e645cfeac66e87a9d87e65af5b063727fbd4
Opcode Fuzzy Hash: 835f7242161eb4cfb455d83a87196b2c26043f5b49b9882fc6e37f8b73e009e4
Instruction Fuzzy Hash: 97B15971808219EFCF29DFA4C8819AEBBF5EF16310F15419AE8116B212D731DE51EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7599 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00BB7812

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: e48091b2afd43caf37942beea0335844a48bf2a98478d99afb147feb7d935675
Instruction ID: 37e4805f29752e8327f191dda2ff9a8812e1370b5ff6fcdef985c5b3648a5185
Opcode Fuzzy Hash: e48091b2afd43caf37942beea0335844a48bf2a98478d99afb147feb7d935675
Instruction Fuzzy Hash: 87B1A174A48249AFDB11DF9AC880BFDBBF5EF89300F144199E4459B292CFB19D42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BBFFDA Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(011E4DE0,011E4DE0,?,7FFFFFFF,?,00BC02AA,011E4DE0,011E4DE0,?,011E4DE0,?,?,?,?,011E4DE0,?), ref: 00BC0080
__alloca_probe_16.LIBCMT ref: 00BC013B
__alloca_probe_16.LIBCMT ref: 00BC01CA
__freea.LIBCMT ref: 00BC0215
__freea.LIBCMT ref: 00BC021B
__freea.LIBCMT ref: 00BC0251
__freea.LIBCMT ref: 00BC0257
__freea.LIBCMT ref: 00BC0267

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: e4ff50703100888cd3cf9a21426847b6e0f5f7a08a0597fbd528df3e5ce63d5e
Instruction ID: d171c0442045080a7ea8e2bcf7fe8093829a7840c567577e3e64fc52f8d8f561
Opcode Fuzzy Hash: e4ff50703100888cd3cf9a21426847b6e0f5f7a08a0597fbd528df3e5ce63d5e
Instruction Fuzzy Hash: 5771D372914209EBDF31AF948C86FEE7BE9DF49710F2900DDE944AB282DB758D408761

Uniqueness

Uniqueness Score: -1.00%

Function 00BA5A89 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00BA5AD2
__alloca_probe_16.LIBCMT ref: 00BA5AFE
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00BA5B3D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BA5B5A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00BA5B99
__alloca_probe_16.LIBCMT ref: 00BA5BB6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BA5BF8
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00BA5C1B

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: c7f4282d3d5f8b1f9ceb47e3aa04c87b42b78c997cafaf99ff43d3e25b479a22
Instruction ID: 5c53822ce43f7130c510431c6f932a98659b7521f0f3da33a936ad4fdf617a95
Opcode Fuzzy Hash: c7f4282d3d5f8b1f9ceb47e3aa04c87b42b78c997cafaf99ff43d3e25b479a22
Instruction Fuzzy Hash: 1251DFB260860AABDB309F64CC45FAB7BF9EF46760F1440A5F915E6154E734CE00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3EF6 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA3EFD
std::_Lockit::_Lockit.LIBCPMT ref: 00BA3F07
int.LIBCPMT ref: 00BA3F1E

Part of subcall function 00BA165A: std::_Lockit::_Lockit.LIBCPMT ref: 00BA166B
Part of subcall function 00BA165A: std::_Lockit::~_Lockit.LIBCPMT ref: 00BA1685

codecvt.LIBCPMT ref: 00BA3F41
std::_Facet_Register.LIBCPMT ref: 00BA3F58
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3F78
Concurrency::cancel_current_task.LIBCPMT ref: 00BA3F85

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: da0890da82b980d113de953d62c3ae6d1cfd3edd926077ad88ad7160254439d2
Instruction ID: 61eb9af96c9e24ccf84042c3b5ebf141db22d839c4fc88bd2963d7529350e441
Opcode Fuzzy Hash: da0890da82b980d113de953d62c3ae6d1cfd3edd926077ad88ad7160254439d2
Instruction Fuzzy Hash: 6411B1719186159FCB05EFA8D8016AEBBF4EF46720F14059DF415A7382DF70AE01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BA908A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BA9081,00BA73F2,00BA6944), ref: 00BA9098
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BA90A6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BA90BF
SetLastError.KERNEL32(00000000,00BA9081,00BA73F2,00BA6944), ref: 00BA9111

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7715df194b133700e4ca5ce0bf8c73066ded9318f62916b55b35edc97d82de66
Instruction ID: 84bf3fbc863b42868886945ae8bc94bc9dc8b30e7c16e454e3039c1774b2369e
Opcode Fuzzy Hash: 7715df194b133700e4ca5ce0bf8c73066ded9318f62916b55b35edc97d82de66
Instruction Fuzzy Hash: 9701D47260C312AEBA2427746C8AB5B2BC6EB1777832002ABF514970E1EF624C11E169

Uniqueness

Uniqueness Score: -1.00%

Function 00BB06B6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,66377BDF,?,?,00000000,00BC1BE7,000000FF,?,00BB0646,00BB0776,?,00BB061A,00000000), ref: 00BB06EB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BB06FD
FreeLibrary.KERNEL32(00000000,?,?,00000000,00BC1BE7,000000FF,?,00BB0646,00BB0776,?,00BB061A,00000000), ref: 00BB071F

Strings

CorExitProcess, xrefs: 00BB06F5
mscoree.dll, xrefs: 00BB06E4

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: dc8a83381bff61ede5ecd3864524f21acf009c2f8bb61f245300f51a3c4d9c28
Instruction ID: 454037e62d1c90d759c525b9379a4ae18e5cec3aead9d7d667d690256cf396b6
Opcode Fuzzy Hash: dc8a83381bff61ede5ecd3864524f21acf009c2f8bb61f245300f51a3c4d9c28
Instruction Fuzzy Hash: B8014431914619EFDB119F54CC09FBFBBF8FB08754F040569E811A32A0DFB49900CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB8644 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BB86CB
__alloca_probe_16.LIBCMT ref: 00BB878C
__freea.LIBCMT ref: 00BB87F3

Part of subcall function 00BB2BC3: HeapAlloc.KERNEL32(00000000,00BB9BE6,45890008,?,00BB9BE6,00000220,?,00BAC25F,45890008), ref: 00BB2BF5

__freea.LIBCMT ref: 00BB8808
__freea.LIBCMT ref: 00BB8818

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: ae1304b653290e8c874c1a1b2449139b4f1c968fc03b88aef41a21726c094885
Instruction ID: aa55a3ac450afcbac8f8304ac6755f951d04416a250b56d28bb42f4675006bc6
Opcode Fuzzy Hash: ae1304b653290e8c874c1a1b2449139b4f1c968fc03b88aef41a21726c094885
Instruction Fuzzy Hash: D2517F7260020AAFEB219E65CC85EFB3BEDEB44354B6505A9FD19D6150EFB1CC10C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA313B Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BA3147
int.LIBCPMT ref: 00BA315A

Part of subcall function 00BA165A: std::_Lockit::_Lockit.LIBCPMT ref: 00BA166B
Part of subcall function 00BA165A: std::_Lockit::~_Lockit.LIBCPMT ref: 00BA1685

std::_Facet_Register.LIBCPMT ref: 00BA318D
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA31A3
Concurrency::cancel_current_task.LIBCPMT ref: 00BA31AE

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 01f8f34723e87342a297ee45976ab3d42886648bc720410cd36eef1c62345876
Instruction ID: 719e870a8cf5eab70676c8d96a10f631a8f6d092f3b622a154cd23a2b621aa0d
Opcode Fuzzy Hash: 01f8f34723e87342a297ee45976ab3d42886648bc720410cd36eef1c62345876
Instruction Fuzzy Hash: 1601A772908614BFCB14AB58DC1599E7BE8DF82B60F1441D5F511AB290EF309F05C790

Uniqueness

Uniqueness Score: -1.00%

Function 00BA35F8 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BA3604
int.LIBCPMT ref: 00BA3617

Part of subcall function 00BA165A: std::_Lockit::_Lockit.LIBCPMT ref: 00BA166B
Part of subcall function 00BA165A: std::_Lockit::~_Lockit.LIBCPMT ref: 00BA1685

std::_Facet_Register.LIBCPMT ref: 00BA364A
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA3660
Concurrency::cancel_current_task.LIBCPMT ref: 00BA366B

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3aa5e4aea0939fa0863f3b152576a18a39924d1f9665b3ee914ebc75d5a03f4b
Instruction ID: 1854335a241f5dce10a7eec3506cba4801dc0af363e6f0001427d59627e1ef76
Opcode Fuzzy Hash: 3aa5e4aea0939fa0863f3b152576a18a39924d1f9665b3ee914ebc75d5a03f4b
Instruction Fuzzy Hash: 1001847290C618BBCB14AB5CDC4599E77E8DF42B60F2445D5F91297291EF309F45C780

Uniqueness

Uniqueness Score: -1.00%

Function 00BA5327 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA532E
std::_Lockit::_Lockit.LIBCPMT ref: 00BA5339
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA53A7

Part of subcall function 00BA548A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00BA54A2

std::locale::_Setgloballocale.LIBCPMT ref: 00BA5354
_Yarn.LIBCPMT ref: 00BA536A

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 4533e50be918e901ba6d9f26deb4e7457206a6f0a082176903a2bc999ed1b4b3
Instruction ID: 589126677cd59a49d3221f30caad3d5defc4853a95ba6bd0b6ed2d249ffc97f7
Opcode Fuzzy Hash: 4533e50be918e901ba6d9f26deb4e7457206a6f0a082176903a2bc999ed1b4b3
Instruction Fuzzy Hash: 7D01BC71A08A119BCB09EB60D841A7C7BE1EFCA390B19008DE91267391DF346E42CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00BAA1D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00BAA183,00000000,?,00C0847C,?,?,?,00BAA326,00000004,InitializeCriticalSectionEx,00BC3BD0,InitializeCriticalSectionEx), ref: 00BAA1DF
GetLastError.KERNEL32(?,00BAA183,00000000,?,00C0847C,?,?,?,00BAA326,00000004,InitializeCriticalSectionEx,00BC3BD0,InitializeCriticalSectionEx,00000000,?,00BAA0DD), ref: 00BAA1E9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00BAA211

Strings

api-ms-, xrefs: 00BAA1F6

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 65c9a7350e7d3d24efde0dde4f553f8054e47730deae0493480eb0609a0c10cb
Instruction ID: a73d66340f19aca29b18f70f08282e71523912ebd0868f484274ab12e7f421ac
Opcode Fuzzy Hash: 65c9a7350e7d3d24efde0dde4f553f8054e47730deae0493480eb0609a0c10cb
Instruction Fuzzy Hash: 8EE01A302C4308FBEE201B61EC06F593E94EB11B44F504062F90CA80A1DBA29960C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 00BB5AEB Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(66377BDF,00000000,00000000,00000000), ref: 00BB5B4E

Part of subcall function 00BB8CD7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00BB87E9,?,00000000,-00000008), ref: 00BB8D83

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BB5DA9
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BB5DF1
GetLastError.KERNEL32 ref: 00BB5E94

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 63ddcaaf65efd54be75fa65580fdc94f26560febed242cceb9a006b8cf472377
Instruction ID: 0c2a64aa1318232fa5e3bb6a835519b77a70eba77e06224a432a1013ed6e2958
Opcode Fuzzy Hash: 63ddcaaf65efd54be75fa65580fdc94f26560febed242cceb9a006b8cf472377
Instruction Fuzzy Hash: 56D16975D006489FCF25CFA8D880AEDBBF5FF09300F1885AAE865EB251E770A941CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BA91A1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BA9268
___AdjustPointer.LIBCMT ref: 00BA928B
___AdjustPointer.LIBCMT ref: 00BA9327

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 103b79e3f7f990de047a049e032a75fd037c0787b1a3ba07bd253d00db01ac9d
Instruction ID: f564fe7ef345ef22247f82b5665b5208744b41fb82ef50d30404e04eb089f71d
Opcode Fuzzy Hash: 103b79e3f7f990de047a049e032a75fd037c0787b1a3ba07bd253d00db01ac9d
Instruction Fuzzy Hash: 3451F27660D306BFEB288F54C880B7A73F4EF46710F1480ADE81657691EB31AC44EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB90F3 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00BB8CD7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00BB87E9,?,00000000,-00000008), ref: 00BB8D83

GetLastError.KERNEL32 ref: 00BB9157
__dosmaperr.LIBCMT ref: 00BB915E
GetLastError.KERNEL32(?,?,?,?), ref: 00BB9198
__dosmaperr.LIBCMT ref: 00BB919F

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: af67d3795018a63b9fe026d680d1670e850f01b01e4180ea9179c335914079c6
Instruction ID: de457ac577765de0abca811cea439c6402cd972e7ad5723d749497842fc78041
Opcode Fuzzy Hash: af67d3795018a63b9fe026d680d1670e850f01b01e4180ea9179c335914079c6
Instruction Fuzzy Hash: F421B671604207BFDB20AF698C859FBB7E9EF4536471085A9FA19A7141D7B1EC00EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BAF726 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f4839e284dd07d2d04bcb8f850fe023aeccec6f4c93c081db21d646aa074bb
Instruction ID: 6085a4232bce828d63d285f45fd8f33a96def8a7996a36022150c8ea5c13fac8
Opcode Fuzzy Hash: a4f4839e284dd07d2d04bcb8f850fe023aeccec6f4c93c081db21d646aa074bb
Instruction Fuzzy Hash: 4E218E35608207AF9B20AFE1D8808FAB7EAEF0636471045B6F915D7141EB30EC00C761

Uniqueness

Uniqueness Score: -1.00%

Function 00BBA089 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BBA091

Part of subcall function 00BB8CD7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00BB87E9,?,00000000,-00000008), ref: 00BB8D83

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BBA0C9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BBA0E9

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 27053b1241ca32a6b8f79e169be28a101e66be722dcd88708baeab895bb44c6d
Instruction ID: c3e61f0c5a2b23f6aa9dd07779a80278ec78f8b858090d0317c6f21530896654
Opcode Fuzzy Hash: 27053b1241ca32a6b8f79e169be28a101e66be722dcd88708baeab895bb44c6d
Instruction Fuzzy Hash: BF11C4B29056167F6A212B759CCACFF6EDCDE4E3A5B1400A4F605E2101FEF4CD0085B2

Uniqueness

Uniqueness Score: -1.00%

Function 00BBFD66 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00BBEB0C,00000000,00000001,00000000,00000000,?,00BB5EE8,00000000,00000000,00000000), ref: 00BBFD7D
GetLastError.KERNEL32(?,00BBEB0C,00000000,00000001,00000000,00000000,?,00BB5EE8,00000000,00000000,00000000,00000000,00000000,?,00BB646F,00000000), ref: 00BBFD89

Part of subcall function 00BBFD4F: CloseHandle.KERNEL32(FFFFFFFE,00BBFD99,?,00BBEB0C,00000000,00000001,00000000,00000000,?,00BB5EE8,00000000,00000000,00000000,00000000,00000000), ref: 00BBFD5F

___initconout.LIBCMT ref: 00BBFD99

Part of subcall function 00BBFD11: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BBFD40,00BBEAF9,00000000,?,00BB5EE8,00000000,00000000,00000000,00000000), ref: 00BBFD24

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00BBEB0C,00000000,00000001,00000000,00000000,?,00BB5EE8,00000000,00000000,00000000,00000000), ref: 00BBFDAE

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7d8abe060195a50e1bd9c9b488c293dbfb9d34caf0ada92c7708480a5145ee9b
Instruction ID: 3b1d9af610319b2d2290626cb57c4310a75b6dc684d8ac863dcfac220b968357
Opcode Fuzzy Hash: 7d8abe060195a50e1bd9c9b488c293dbfb9d34caf0ada92c7708480a5145ee9b
Instruction Fuzzy Hash: D3F0AC3750012ABBCF226F96DC09DEA3F66FB093A1B044060FA1D96131CA728920DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BA8E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00BA8ECF
__IsNonwritableInCurrentImage.LIBCMT ref: 00BA8F83

Strings

csm, xrefs: 00BA8F6D

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 9a23ec63f3d780d73e890f329675fb67d1cefe7d91b06e60ced73de4088560f5
Instruction ID: 1a3aa7b15c02cc9da285b62099e23955fc35c3bb52f24016e6829e44f5f09b7e
Opcode Fuzzy Hash: 9a23ec63f3d780d73e890f329675fb67d1cefe7d91b06e60ced73de4088560f5
Instruction Fuzzy Hash: B8417434A04209DFCF10DF68C885A9EBBE6EF46314F1485D5F818AB792DB32DA15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BA979D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00BA97C2

Strings

RCC, xrefs: 00BA97DC
MOC, xrefs: 00BA97D4

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ea11244ef197d419e5da83d171e3575b15d1637abf791f8f96e7c84133584893
Instruction ID: 2d288e8286e927db24ef1e01d3281668b5407193b790a53881a68bdeb9d1a683
Opcode Fuzzy Hash: ea11244ef197d419e5da83d171e3575b15d1637abf791f8f96e7c84133584893
Instruction Fuzzy Hash: C4416431904209AFDF16DF98CD81AEEBBF5FF4A340F1880A9F914A7261D7399950EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BA1585 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BA158C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BA15C4

Part of subcall function 00BA5425: _Yarn.LIBCPMT ref: 00BA5444
Part of subcall function 00BA5425: _Yarn.LIBCPMT ref: 00BA5468

Strings

bad locale name, xrefs: 00BA15D2

Memory Dump Source

Source File: 00000001.00000002.2067273566.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000001.00000002.2067252678.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067303156.0000000000BC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067325321.0000000000BCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067353851.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067365493.0000000000C08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2067378954.0000000000C09000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ba0000_RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: a6cca2575ee7946d72377104c8efc2846a52aa06a5b4ccec2a7af2117c3103de
Instruction ID: 999fec821aa89952633f94dfddfc62bede30848ade13dd7273b4f9670b46fba3
Opcode Fuzzy Hash: a6cca2575ee7946d72377104c8efc2846a52aa06a5b4ccec2a7af2117c3103de
Instruction Fuzzy Hash: 99F01772509B809E83309F6A8481447FBE4BE29721790CE6EE0DEC3A11D730E544CB6A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6880, Parent PID: 5176COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	56
Total number of Limit Nodes:	9

Executed Functions

Function 02D1A958 Relevance: 2.8, Instructions: 2802COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d365e348af1ff4ed22f12a674acfc502d5d4e19c69cb4514181ac99397fac945
Instruction ID: def931d2e552bafcfd463b5615af2a0a97589ab9f4ce74faa53732e22c1a99d3
Opcode Fuzzy Hash: d365e348af1ff4ed22f12a674acfc502d5d4e19c69cb4514181ac99397fac945
Instruction Fuzzy Hash: 66530931C10B5A9ACB51EF68C880699F7B1FF99300F15D79AE45877221FB70AAD4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02D14A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7999ffa7632d3bd80c15493aed4f9bea6122531cd8150eafa73763dab1657e
Instruction ID: 34f8c403989c24fba7160d663ba3d322deb0c679158b5978955bebd2ef4ad3c4
Opcode Fuzzy Hash: 4e7999ffa7632d3bd80c15493aed4f9bea6122531cd8150eafa73763dab1657e
Instruction Fuzzy Hash: 1DB16C70E002099FDF10CFA9E9817ADBBF2AF88714F148129D815EB794EB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02D13E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9d7b87afa2a04b2c9f65abefbc74f61b7b86e831df9ff9d8d5620a0b0b16c3
Instruction ID: fa3f7581ea99927f35c1a45bc814a9f4a9c80ba4b77bc0650be08e8b573acde6
Opcode Fuzzy Hash: 5d9d7b87afa2a04b2c9f65abefbc74f61b7b86e831df9ff9d8d5620a0b0b16c3
Instruction Fuzzy Hash: 3B916D70E00209EFDF10CFA9D99579EBBF2AF88714F148129E405A7794EB749885CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05ABE968 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3324001454.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e32a6a3354252ff57ff791ace4257f9767ed90d5515036ae77143f904461c77
Instruction ID: bd896352e8e8c301225d80566b978efaa872d751e87a7ded3c72ac1808462850
Opcode Fuzzy Hash: 3e32a6a3354252ff57ff791ace4257f9767ed90d5515036ae77143f904461c77
Instruction Fuzzy Hash: DE41F472E043968FDB04DF79D8047DEBBF9AF89210F14856AD504A7242DB74A845CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 05ABE558 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,05ABE9BA), ref: 05ABEAA7

Memory Dump Source

Source File: 00000003.00000002.3324001454.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 20fed2bf65b6da35ea9e97e0bdb2bb2d434c576e3a87fe39c199ff2c70a1d036
Instruction ID: 3a5b63d86cb6c0c958c876939100ef9f53c620a13699edde0f2c1de6364ae454
Opcode Fuzzy Hash: 20fed2bf65b6da35ea9e97e0bdb2bb2d434c576e3a87fe39c199ff2c70a1d036
Instruction Fuzzy Hash: 961147B1C006599BDB10CF9AD444BDEFBF8BF48620F14816AD918B7240D3B8A950CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 05ABEA38 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,05ABE9BA), ref: 05ABEAA7

Memory Dump Source

Source File: 00000003.00000002.3324001454.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ab0000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: cbbd5be7849683274bb59044ea1c6fdfbeac5a66b8dfb0b370d1941936509ee5
Instruction ID: ef2c8842b36f82da6ab0b3bcb1d5088111e3daed968ac8f6229dfb62a4db9715
Opcode Fuzzy Hash: cbbd5be7849683274bb59044ea1c6fdfbeac5a66b8dfb0b370d1941936509ee5
Instruction Fuzzy Hash: AE1144B2C0065ADBDB00CFAAD544BDEFBB4BF48320F14852AD418B3240D378A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D10848 Relevance: 1.3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Co, xrefs: 02D108A4

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID: Co
API String ID: 0-3798529171
Opcode ID: 906fa81c8b020a6acdbdb4192f9cd779d7f8fd3a46a0ffa6c60bc4b2bffdcfac
Instruction ID: 5356727bb7e5f7aa2d7e60d3a969d06703a447913412bc5ecb1f4a745e3e1a7c
Opcode Fuzzy Hash: 906fa81c8b020a6acdbdb4192f9cd779d7f8fd3a46a0ffa6c60bc4b2bffdcfac
Instruction Fuzzy Hash: 4911BF31B08209ABEF247A79E41476A3651FB85256F20483AE906CFB85DE30CCC1CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 02D10838 Relevance: 1.3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Co, xrefs: 02D108A4

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID: Co
API String ID: 0-3798529171
Opcode ID: 21338022335273c743fb4235712d2fc0ddb2c8656672fe3ff929b8b6b3cef965
Instruction ID: ef0136f3fb29d971b8dcfbfa5ad13569701caee42831d3845ad51af93837afb1
Opcode Fuzzy Hash: 21338022335273c743fb4235712d2fc0ddb2c8656672fe3ff929b8b6b3cef965
Instruction Fuzzy Hash: F811E332A08209ABEF247A75B4147693651EB85256F20493EE946CBB85DE64CCC0CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 02D1867F Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c377403d5ea85668c9af43656a44622c463940b0e3fb95ef2969a19ab61c2d
Instruction ID: b598850624796b2a6a015f5dd2d411f0af627cc6935ff91a63251115b31d2d43
Opcode Fuzzy Hash: 34c377403d5ea85668c9af43656a44622c463940b0e3fb95ef2969a19ab61c2d
Instruction Fuzzy Hash: 35229036700202EBEB29AB38F59A6583BA2FBC5351F20592EE101CB754DF75EC46D781

Uniqueness

Uniqueness Score: -1.00%

Function 02D18721 Relevance: .6, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5763e7c9056f80ae9ee58ace8b9fa7748df527cc9030aeda8d8a0df1c2aeb012
Instruction ID: 4351344515886d6105354fb16bd61486c23448f541712ce661c4821c4883da5d
Opcode Fuzzy Hash: 5763e7c9056f80ae9ee58ace8b9fa7748df527cc9030aeda8d8a0df1c2aeb012
Instruction Fuzzy Hash: DF128E36700202EBDB29AB38F59A66C36A2FBC5351F20592EE105CB754DF75EC46DB80

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A217 Relevance: .4, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a561fa9283b31d342ad725015027acf1eb7e9fee83d25055e5e2d42709e05b3
Instruction ID: 2dae5b21e4f32802ab61ecc48ef02d9710cd85c0f70d303939c8bb91a93e86cf
Opcode Fuzzy Hash: 2a561fa9283b31d342ad725015027acf1eb7e9fee83d25055e5e2d42709e05b3
Instruction Fuzzy Hash: D4E16B35A01205DFDB14DB68E485BADBBB2FF89314F208429E90ADB755DB35EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D14A8E Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb66ee376bd9e4156f6aeb49c3920706349bd2b620c7979b543f608ead673e9f
Instruction ID: e1f0bc0c5d30c2231d470882c7d0b4b6da8d6e2c0bc878917ab2e4760d1c05a9
Opcode Fuzzy Hash: bb66ee376bd9e4156f6aeb49c3920706349bd2b620c7979b543f608ead673e9f
Instruction Fuzzy Hash: 05A15AB0E00219EFDF10CFA8E98179DBBF2AF48714F148129D815AB794EB749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02D13E76 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c93f540dc15647d54e69fd6e7a3159ed104a0ab0cd34f3852121ea4958128a7
Instruction ID: 2d085b7cab3d8d7cbffb3ac69f16db49cd76763983dc8ef59d146b5e4d1228d6
Opcode Fuzzy Hash: 2c93f540dc15647d54e69fd6e7a3159ed104a0ab0cd34f3852121ea4958128a7
Instruction Fuzzy Hash: C7916CB0E00209EFDB10CFA9E9857DDBBF1AF48714F248129E405A7794EB749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02D14810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510ce7e30cb736bb904c120a5a76d08f24875416a1d64c944bb9e58e42940b11
Instruction ID: def36fc920fb3fd625268fac4046159e87571859efb5fdef9336b393cecb2005
Opcode Fuzzy Hash: 510ce7e30cb736bb904c120a5a76d08f24875416a1d64c944bb9e58e42940b11
Instruction Fuzzy Hash: 88718CB0E04249EFDB10CFA9E98079EBBF2BF88714F148129E415A7794EB749841CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02D14804 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3217b6048b812bd03bc30d18d744ecc479613cde8bbe65affcd5d95d870c3f1f
Instruction ID: b53c92e4cc44b001ce0fdb815c52b6ccf5bcf4673ca2e8a5fb22fd6415359e91
Opcode Fuzzy Hash: 3217b6048b812bd03bc30d18d744ecc479613cde8bbe65affcd5d95d870c3f1f
Instruction Fuzzy Hash: 0E718BB0E04249EFDB10CFA8E98479EBBF1BF88714F148129E415A7794EB749841CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02D16ED0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f5427ca4794c6adf04411987b043f6116f5b7612252ac9fa089e5e67482c95
Instruction ID: d72e7fb71b8e538a88e9c9f8f0fb35e58ed41d588205e9829869222a8509de63
Opcode Fuzzy Hash: b6f5427ca4794c6adf04411987b043f6116f5b7612252ac9fa089e5e67482c95
Instruction Fuzzy Hash: 1D518C34700214DFDB04DB68E558AADBBB6FF89700F2044A9E406EBBA1DB75DC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A6B8 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea88eff9196a86f7d8dabf18638a28da59425c93c661ae1722b8a335735796c
Instruction ID: d5912f568bc48e1454f4e9c1126c513da7df1f06a500c18b120e07891b597476
Opcode Fuzzy Hash: 1ea88eff9196a86f7d8dabf18638a28da59425c93c661ae1722b8a335735796c
Instruction Fuzzy Hash: C1513875A01205DFDB04DF69E884799FBB2FF88314F14C26AE9089B356EB70D946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D16CD5 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95bcd330c3eebd6589c1bac992142571137e596291a2f71d1328985a1e4c0c33
Instruction ID: 40bacdc97308d8c5ac31ccda7c6d1763db38a9737e9536733b721e5ec9a98d08
Opcode Fuzzy Hash: 95bcd330c3eebd6589c1bac992142571137e596291a2f71d1328985a1e4c0c33
Instruction Fuzzy Hash: 9F5143B0E002289FDB18CFA9D884B9DBBB5FF48304F14852AE815BB750D774A844CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D16CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc84ed59cf16da02737e7fe479046adb24f123c3ac944c74eb499adf8023c5b
Instruction ID: beeeb0c2b05062f16249806fca64fd984d1b2ded550d6b605b23910d5ef06484
Opcode Fuzzy Hash: 6fc84ed59cf16da02737e7fe479046adb24f123c3ac944c74eb499adf8023c5b
Instruction Fuzzy Hash: 315123B0E002189FDB14CFA9D884B9EBBB5FF48314F14812AE815BB750DB74A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02D11138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f51665a288678ebe2fd170f539be939cf18fae1dcf50842d6c6274660418a30
Instruction ID: 58044d82c969cd5b26c811c1b78a9a9a98ec3f3c04ebce01d47afdcb47eea50f
Opcode Fuzzy Hash: 8f51665a288678ebe2fd170f539be939cf18fae1dcf50842d6c6274660418a30
Instruction Fuzzy Hash: 2551CD32A15346CFE70AFF28F8C09553FB1FBA5306304A97DD1545736EEAA06949CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02D1DE62 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c941212c0902fdb86adc50ebbe6b382065cf4079154ced426862ebd1d98755
Instruction ID: d565e97fe2777a60639ff6eb990a2b34314a40b0b762b27c66691f02001a1116
Opcode Fuzzy Hash: f8c941212c0902fdb86adc50ebbe6b382065cf4079154ced426862ebd1d98755
Instruction Fuzzy Hash: E2315E75B00616EFD705DB68D880E7A77B7BFC8300F648168E5459B299CB32EC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D17D90 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac71d20995f20721ee095eff909899fc393ba0318c526668395c35f1d1ec2f02
Instruction ID: 57b1ff09988ab9a369b04eadc31aca614d1eaaede6a0f93f4db25508b59f74eb
Opcode Fuzzy Hash: ac71d20995f20721ee095eff909899fc393ba0318c526668395c35f1d1ec2f02
Instruction Fuzzy Hash: 3B315E31E1021AEBEB14CBA4E4457AEF7B6FF85310F608529E506EB790EBB09D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D17D81 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4ac325fc5d18b75f0d63379e512119262fdc0d4fad13e11330e95c8316c59f
Instruction ID: 7a13ba27aaa0d8e4f908a5ba734ba760576f5fb5fad691801c9cff52cdc1f6ac
Opcode Fuzzy Hash: cb4ac325fc5d18b75f0d63379e512119262fdc0d4fad13e11330e95c8316c59f
Instruction Fuzzy Hash: 33314E31E1025AEBEB14CB64E84579EB7B6FF85300F608519F502EB790EBB09D42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D126DC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d3b9182ff3c87d043907d08613531cf3a2f5ca9e9151e9281994313136e42e
Instruction ID: 65d1d021a08db8f77dbd07bb911f463ecc751ee1b23a087cbb397b1da0cd0277
Opcode Fuzzy Hash: 38d3b9182ff3c87d043907d08613531cf3a2f5ca9e9151e9281994313136e42e
Instruction Fuzzy Hash: 41410FB1D00349EFEB10CFA9D984ADEBBB1FF48314F148429E809AB254DB75A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02D126E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c341ddf0633505c6f9ec8a2b84e4c1d3493cf1d0802339dc02c2bd0747e6080
Instruction ID: b767be46b431f1b37f6244fc0d449eed90fa1fc7a5ee3bafb4767c5b209f4609
Opcode Fuzzy Hash: 0c341ddf0633505c6f9ec8a2b84e4c1d3493cf1d0802339dc02c2bd0747e6080
Instruction Fuzzy Hash: 2641EFB0D00349EFDB10CFA9D984A9EBBB5EF48714F148429E809AB354DB75A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02D11878 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f064749c85ee2f02a4bea3ad28f774b61dfe4966507c819c7709dd1ef4a3aa
Instruction ID: 832097f577a4e38f15859d85c033382ac9b7cf46df02d60f9b975248d1c8554c
Opcode Fuzzy Hash: b9f064749c85ee2f02a4bea3ad28f774b61dfe4966507c819c7709dd1ef4a3aa
Instruction Fuzzy Hash: 9831DC71B00245EFEF24EB68E5147AD37B2AF49301F1004A8C20AEB794DB36CC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A067 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649420004cc5bb12790e8e2725b0098b3c62a330542f14c6b3a2c12323fa8e94
Instruction ID: 3f5baf567ce39061901bcc120199a0ebe0ff370c4483fcf9efd748a49bd08ef2
Opcode Fuzzy Hash: 649420004cc5bb12790e8e2725b0098b3c62a330542f14c6b3a2c12323fa8e94
Instruction Fuzzy Hash: AE31C076E012469BDB15CFA4E88079EBBB2FF8A300F24C659E415EB745DB709C86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A078 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89d80ba4e0b41dc825fb73fa6ccb02e237e67df30ed75ff5adbf9dce85fcee4
Instruction ID: c72d7e80d5a4c7c2ec0ee2b2ed4440b2a3bb254afc7b696e61eb7905948e7ba6
Opcode Fuzzy Hash: e89d80ba4e0b41dc825fb73fa6ccb02e237e67df30ed75ff5adbf9dce85fcee4
Instruction Fuzzy Hash: 53215135E0120AABDB15CF64E98079EF7B2BF89300F50C619E805AB745DB719D85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D116A2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac797a00bd119885948587f7c9fcb3db7d5c0e65563b314dd8daa74a4d6426c9
Instruction ID: 548c308fbcebc97f0773c41dd81386c141e0ccda3289a8f47c1e0ed91e8b96cd
Opcode Fuzzy Hash: ac797a00bd119885948587f7c9fcb3db7d5c0e65563b314dd8daa74a4d6426c9
Instruction Fuzzy Hash: D4219939610241EBEF26EB28F8847193B65EF84354F106929E20AC7755EF78DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A850 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d564ab218c43dafed3593fbe3b0447e42eda8289385b42bdb39e9e432aae99
Instruction ID: efa783b3f21ca0358ef35b1ceab2d60aa9dfbce8405001d3fe9b36d5f7ceadcd
Opcode Fuzzy Hash: a8d564ab218c43dafed3593fbe3b0447e42eda8289385b42bdb39e9e432aae99
Instruction Fuzzy Hash: 5E21D070B001189FEB14DBB8D954BAD77F6AF88720F118126E101EB3A4DB71CD80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0110D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3321715498.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8666e8d51f52c732f4fe0cb936aec0536e709d10995704365bb0811bcc2a1318
Instruction ID: dda42311ccd36f2cbafddabbdbcb182c44ff4937265e2ba592739423a7a5e9b8
Opcode Fuzzy Hash: 8666e8d51f52c732f4fe0cb936aec0536e709d10995704365bb0811bcc2a1318
Instruction Fuzzy Hash: D1213A75904304DFDF1ACFA4E9C0B26BB61FB84314F20C56DD90D4B296C7B6D446CA62

Uniqueness

Uniqueness Score: -1.00%

Function 02D16B99 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68af6e9feff11779bd468450ab2d0242856ee4de2629afa7ad5ef140a076f3d9
Instruction ID: 4d7483661c9dbc156985d4890142ee2110399bce4859fbcd3866847ce6fb11d7
Opcode Fuzzy Hash: 68af6e9feff11779bd468450ab2d0242856ee4de2629afa7ad5ef140a076f3d9
Instruction Fuzzy Hash: 7E2136327142519FC705AB38E8217AE3BBAEF8A210F1045AAE045CF795EE75DC46C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A84A Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768cea3713af7c71fec3024ab3ef11cab8a4a6943ccc84a44b40cd35a3d519a8
Instruction ID: b571145ad68b262601d32d575e094a2a37817e4bf05407c272d3cd4def2a3162
Opcode Fuzzy Hash: 768cea3713af7c71fec3024ab3ef11cab8a4a6943ccc84a44b40cd35a3d519a8
Instruction Fuzzy Hash: 9621BE71A001089FEB04DB68D954BAE7BF6EF88710F118029E506EB7A4DB71CD84CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D14F8A Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0dc677796c2ae4114e1dde33c6b81d2ad30b1ca933d34e240f1c6557b07890
Instruction ID: 8e2117a621889d2220ab18e03ec44ddb38e10ea5d3d654af38485f0287126463
Opcode Fuzzy Hash: 6e0dc677796c2ae4114e1dde33c6b81d2ad30b1ca933d34e240f1c6557b07890
Instruction Fuzzy Hash: B6211534A00214DFDB24DB78E599BADB7F2AB8D344B200468E506EB7A4DB75DD40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D19F68 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a44fbffdaba59f9ca4ad446da0b326fe56a5027e5cb99ad37f427a07a2e2751
Instruction ID: b1d4152d66e42829d1d2e195508cac874ca193576c1d7b3f467b38e57fc4e19e
Opcode Fuzzy Hash: 0a44fbffdaba59f9ca4ad446da0b326fe56a5027e5cb99ad37f427a07a2e2751
Instruction Fuzzy Hash: B0217131E00206ABDB18CFA4D4606DEF7B2AF89300F20855AF815F7784DB709C46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D1137F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f89fa229bce3a3483358d5d2e05f5bfd9946d4797b3485c0598329101ed758
Instruction ID: f218845a0b2f81cb24b8034089d512554fa2244e967da3a272413b5d0c520b14
Opcode Fuzzy Hash: 80f89fa229bce3a3483358d5d2e05f5bfd9946d4797b3485c0598329101ed758
Instruction Fuzzy Hash: B721B475614211BBEF356624F48A32C7A20EB42321F541829E74EC7BD4DF69CC85C742

Uniqueness

Uniqueness Score: -1.00%

Function 02D11888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7df4a4f3dc92f826592d556a8bfa41347625330cca00d943963bd6d8c1a5e6
Instruction ID: 8414a87244999699efdaef5b660b3cce06ad0eafcf2d18fbbb85de96d6708e49
Opcode Fuzzy Hash: 5d7df4a4f3dc92f826592d556a8bfa41347625330cca00d943963bd6d8c1a5e6
Instruction Fuzzy Hash: EE213C34B00215EFEB54EB78E554BAE77F2AB89305F200468C21AEB758DB75CD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D116B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca23ad7b2d7383b5f709a52758b3f35d9288f7c895a47b3d768a71faeadc4a4
Instruction ID: 51043edbc22f5c6ea248b0870e1849ca21337a6475126bfc36a54d7632afbf42
Opcode Fuzzy Hash: eca23ad7b2d7383b5f709a52758b3f35d9288f7c895a47b3d768a71faeadc4a4
Instruction Fuzzy Hash: DB21B739610241EBEF26EB28F8847193B66EF84354F106929E20AC7759EF78DC44CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02D14F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eeb8477cb6788fa82e4d631459791031ce2ab41112fe08c633cdb635f6d8822
Instruction ID: dd0b70fbf566ee777d9e4c1a2b56aef03cba18e5fb8d1b8a9b1b27538a5efc0c
Opcode Fuzzy Hash: 7eeb8477cb6788fa82e4d631459791031ce2ab41112fe08c633cdb635f6d8822
Instruction Fuzzy Hash: 0621E634B00204DFDB18EB78E558BADB7F2AB8D344B200468E506EB7A4DB76DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D19F78 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9966b645a55191b2847b4bf9c6e7dc0558b4a915e0ad626f2d97f59d44e380
Instruction ID: 4012ac15dc57fabc8c57f1992b8a5c46c6aaecd06e61dc01e3f481a66b629940
Opcode Fuzzy Hash: 8b9966b645a55191b2847b4bf9c6e7dc0558b4a915e0ad626f2d97f59d44e380
Instruction Fuzzy Hash: 83215E31E00219ABCB19CF64D4546DEF7B6AF89310F10866AFC15BB794DB70AC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D117C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bad95d4228ca1387671bd82634ad36a1d30febbaa57d27abcfb29898a7c96e
Instruction ID: 7b5dc079b49480e1f38f40c2ed245db41b80e922692216106eb33a6fe01debdf
Opcode Fuzzy Hash: 38bad95d4228ca1387671bd82634ad36a1d30febbaa57d27abcfb29898a7c96e
Instruction Fuzzy Hash: FB11CEB6F11351AFDB10ABB4A80966E7BE9FF48250F148865EA09D3340FA34C805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D11487 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c583fdc4a886f39b586ad0e5c9cd29c5654b0e92aca457c7d1d3cbae9f42bfeb
Instruction ID: 4bb833558a3355b9a61097b73aaf90f53417238b345c5b5f88baee6800a3a8ce
Opcode Fuzzy Hash: c583fdc4a886f39b586ad0e5c9cd29c5654b0e92aca457c7d1d3cbae9f42bfeb
Instruction Fuzzy Hash: A5118F72A00215AFCB11AFB8A85129D7BF5EF48211F1504BAD905DB741EB35CD41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0110D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3321715498.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 909f29962979abd33403a21703b077298d2959be037a04e777073eaf13c43b6f
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: 2F110075904284CFCB06CF54D9C0B15BF61FB44318F24C6A9D8494B696C37AD44ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 02D11498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434aa718d535fe0ac8d8569d08d6e5ea28e62dbb1500c0364e7d9eb8dc6bba68
Instruction ID: 7272f06caa689b85acf0fbadcfc90d0c2cb149fbeeaa3742eadfd0c13325a883
Opcode Fuzzy Hash: 434aa718d535fe0ac8d8569d08d6e5ea28e62dbb1500c0364e7d9eb8dc6bba68
Instruction Fuzzy Hash: 6A018031A00219ABCB21EFB9A4512AE7BF6EB48211F14047AD909EB740E735DC81CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 02D1A6B2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d978a40a968e013d50527a39a1b5f9961aabe0ceced1df76a4a6c57b42fb6ef
Instruction ID: 4d0d33a00fc9ebe437eaf0383d18166851e3b8afd2a46908ab97a6cd3e4c56e3
Opcode Fuzzy Hash: 4d978a40a968e013d50527a39a1b5f9961aabe0ceced1df76a4a6c57b42fb6ef
Instruction Fuzzy Hash: DE01B531A001058BDB14EF55E88479ABB75FFC4310F54C168D9086F79AEBB4ED06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D18F08 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4d06e8479080be2a392d5fead87101df2df767bfaa3a21669664d2ec6123a0
Instruction ID: 431dcd2e73628688fc9b00f9e3ce894106b93053eb3ab39a365a300bfcbe3fb4
Opcode Fuzzy Hash: 0c4d06e8479080be2a392d5fead87101df2df767bfaa3a21669664d2ec6123a0
Instruction Fuzzy Hash: 08016D3650028ADBDB06EBA8F991B9D7F61EB81340F406AADC1116F295DE752A01DB81

Uniqueness

Uniqueness Score: -1.00%

Function 02D17EA8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60fcfb4797841b9c87e3119e21b2d953cd846926c8b9a463c2fc77211b259774
Instruction ID: 0b5780d287334a38c15eb1cb88a8aa5a619ea97f96631ab51db820c6142ed25d
Opcode Fuzzy Hash: 60fcfb4797841b9c87e3119e21b2d953cd846926c8b9a463c2fc77211b259774
Instruction Fuzzy Hash: DEF0C43AB00209DFD718DB74E599A6C77B2EF88315F5454A8E5069B3A4DF31AD42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02D18F18 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3322192795.0000000002D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2d10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8078a8b1758ee9ffc7d04b41504e40f599ef522c8a2dfc8eca53e2f24a2313
Instruction ID: 277803c415038f0add0684c88e2a2829ed1529afd10f058197c83460e30ad058
Opcode Fuzzy Hash: 7c8078a8b1758ee9ffc7d04b41504e40f599ef522c8a2dfc8eca53e2f24a2313
Instruction Fuzzy Hash: F6F0313590024AEFDB05FFA4F850A9D7BB1FB80340F5066ADC104AB254EF712E049B81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

Function 00C0765D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 00BA1C39 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
synchronizationthreadCOMMON

Function 00BB511E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00BA3090 Relevance: 7.6, APIs: 5, Instructions: 70
COMMON

Function 00BB0620 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00BB63A1 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 00BB5FA3 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00BB42F4 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00BA4847 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 00BA1D5A Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Function 00BB51E9 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 00BA2479 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre