Windows
Analysis Report
SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exe
Overview
General Information
Detection
Score: | 30 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 40% |
Signatures
Classification
Analysis Advice
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior |
Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") |
Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook |
- System is w10x64
- SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exe (PID: 5560 cmdline:
"C:\Users\ user\Deskt op\Securit eInfo.com. Win32.Bank erX-gen.77 61.21527.e xe" MD5: 5A12407FB09EEFA5A7734A316082A5DB)
- cleanup
Source: | Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: |
Source: | Author: frack113: |
Click to jump to signature section
AV Detection |
---|
Source: | Avira: |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Static PE information: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Code function: | 0_2_004082A0 |
Source: | Code function: | 0_2_004082A0 |
Source: | Code function: | 0_2_00408890 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Code function: | 0_2_00403370 |
Source: | Code function: | 0_2_004049E0 |
Source: | Static PE information: |
Source: | Key opened: | Jump to behavior |
Source: | ReversingLabs: | ||
Source: | Virustotal: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: | ||
Source: | Automated click: |
Source: | Window detected: |
Source: | Window detected: |
Source: | Static file information: |
Source: | Static PE information: |
Source: | Code function: | 0_2_00406270 |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Code function: | 0_2_00406390 |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Code function: | 0_2_00404170 |
Source: | Code function: | 0_2_00408370 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 DLL Side-Loading | 1 Process Injection | 1 Disable or Modify Tools | 11 Input Capture | 1 Process Discovery | Remote Services | 11 Input Capture | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Process Injection | LSASS Memory | 1 Application Window Discovery | Remote Desktop Protocol | 2 Clipboard Data | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Deobfuscate/Decode Files or Information | Security Account Manager | 1 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
32% | ReversingLabs | Win32.Trojan.ClipBanker | ||
42% | Virustotal | Browse | ||
100% | Avira | TR/Spy.ClipBanker.wffqn |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high | |||
false | high | |||
false | unknown | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false |
| unknown | ||
false | unknown | |||
false |
| unknown |
Joe Sandbox version: | 40.0.0 Tourmaline |
Analysis ID: | 1428515 |
Start date and time: | 2024-04-19 04:24:12 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 25s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 4 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exe |
Detection: | SUS |
Classification: | sus30.winEXE@1/2@0/0 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Time | Type | Description |
---|---|---|
04:25:11 | API Interceptor |
Process: | C:\Users\user\Desktop\SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1508424 |
Entropy (8bit): | 7.563280347600453 |
Encrypted: | false |
SSDEEP: | 24576:4fdKck1iYJtpFn0P1oeeXIU/o0BrafH1gdaCn3XKr8cAPvc1AJ:Dc4p7/o0BrafH1g8Cn3XKr8cA3c1AJ |
MD5: | 2289A480C51F721780A35F51D1FA587A |
SHA1: | 6D74E0094ECB48D41055D679761997CB3AA96252 |
SHA-256: | 193CE1571477B2CC46A271A4FD37B7DD7AF2F30A9BE8E80E974CEEAA9C3CF5C9 |
SHA-512: | BECC4BB3EC160D82463BF1DF7BC21F5B507F5B09437E2D9D510F3164D655E3D6B65262C299E0A8D1A90B58006DFD5481B556F145692E54F2AAF54D073609AAD1 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 2544 |
Entropy (8bit): | 5.11200618748028 |
Encrypted: | false |
SSDEEP: | 48:kTm8nySk0eNumY07ZVZCwzGR1GxKYpDNoJ0nJ00BcLpdJ0XJ0GsLcOJ0nJ00BcL+:JkySkflXtvCwSjI5ZNoJ0nJ0wcLpdJ07 |
MD5: | CA7CF7A52302F73C95005CFF040DCE7F |
SHA1: | 8EDF0D2632C400293D86F58BCC4E2D2B597FAF4D |
SHA-256: | 785A0E7D44E03F311161CCC8060E7843A3A4960BA50886BB2AA5FFCDEE4E72DA |
SHA-512: | 4ABB799F36CA0B4F3FC58A832775B213B3E6F8895B718F6E36AD864A64257378608688AEB9B0650052E54C65CECC39C870B11074484495A418501AC331206DC6 |
Malicious: | false |
Reputation: | low |
Preview: |
File type: | |
Entropy (8bit): | 7.414416598968228 |
TrID: |
|
File name: | SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exe |
File size: | 2'076'672 bytes |
MD5: | 5a12407fb09eefa5a7734a316082a5db |
SHA1: | fac732eaf01fca53435a85df588e7167369e5ebc |
SHA256: | 9a238485bc76356734188a4092838d33b12a4ff59969a243884ab034aba5d35d |
SHA512: | 8c36e15eee140e8e2dda67a16049974499f30621c46a3809c30d0b945584479e15ecb073cbd0872d38deb69fb49a54dcffd87592853ba09bdfaccb70765e407c |
SSDEEP: | 49152:xxTc4p7/o0BrafH1g8Cn3XKr8cA3c1A2b:Lc4p9BNtMb |
TLSH: | 94A5C04BCB8C8D7AD36071367D854000EA7C8072A5BDE1AEB9AC5C1C2FAA2D355F6C57 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.B.'...'...'...'...'...8...'...8...'..3;...'...8...'...8...'.......'.......'...'..H'..X8...'..w!...'..Rich.'................. |
Icon Hash: | 3ced4c494d1d3dcc |
Entrypoint: | 0x407066 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
DLL Characteristics: | |
Time Stamp: | 0x63739D5F [Tue Nov 15 14:08:31 2022 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 4 |
OS Version Minor: | 0 |
File Version Major: | 4 |
File Version Minor: | 0 |
Subsystem Version Major: | 4 |
Subsystem Version Minor: | 0 |
Import Hash: | 1f20046689ee6d926dc8f662c86113fb |
Instruction |
---|
push ebp |
mov ebp, esp |
push FFFFFFFFh |
push 0040BBB0h |
push 004071CAh |
mov eax, dword ptr fs:[00000000h] |
push eax |
mov dword ptr fs:[00000000h], esp |
sub esp, 68h |
push ebx |
push esi |
push edi |
mov dword ptr [ebp-18h], esp |
xor ebx, ebx |
mov dword ptr [ebp-04h], ebx |
push 00000002h |
call dword ptr [0040B2BCh] |
pop ecx |
or dword ptr [00411280h], FFFFFFFFh |
or dword ptr [00411284h], FFFFFFFFh |
call dword ptr [0040B2B8h] |
mov ecx, dword ptr [00411274h] |
mov dword ptr [eax], ecx |
call dword ptr [0040B2B4h] |
mov ecx, dword ptr [00411270h] |
mov dword ptr [eax], ecx |
mov eax, dword ptr [0040B2A8h] |
mov eax, dword ptr [eax] |
mov dword ptr [0041127Ch], eax |
call 00007FF1E99E4F77h |
cmp dword ptr [0040E650h], ebx |
jne 00007FF1E99E4E5Eh |
push 004071F4h |
call dword ptr [0040B2A4h] |
pop ecx |
call 00007FF1E99E4F49h |
push 0040D024h |
push 0040D020h |
call 00007FF1E99E4F34h |
mov eax, dword ptr [0041126Ch] |
mov dword ptr [ebp-6Ch], eax |
lea eax, dword ptr [ebp-6Ch] |
push eax |
push dword ptr [00411268h] |
lea eax, dword ptr [ebp-64h] |
push eax |
lea eax, dword ptr [ebp-70h] |
push eax |
lea eax, dword ptr [ebp-60h] |
push eax |
call dword ptr [0040B29Ch] |
push 0040D01Ch |
push 0040D000h |
call 00007FF1E99E4F01h |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0xc338 | 0xa0 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x12000 | 0x1ebe08 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0xb000 | 0x380 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x9016 | 0xa000 | ec70bea776dda6a9c8803144cc17696e | False | 0.3858642578125 | data | 5.681862831685634 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0xb000 | 0x1cd4 | 0x2000 | 20eaa8c8da1593494185a01a30628519 | False | 0.325439453125 | data | 4.518618835418624 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0xd000 | 0x4288 | 0x2000 | fa41d8b55a45a1f3b18c30cdf0f58467 | False | 0.34912109375 | data | 5.5733249291455085 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0x12000 | 0x1ebe08 | 0x1ec000 | 789c5ec37d413dfd3b0f2446cf60997b | False | 0.5980477681974086 | data | 7.425209272911492 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
TXT | 0x174c0 | 0x62e94 | Lisp/Scheme program, ISO-8859 text, with CRLF, LF line terminators | Chinese | China | 0.11910944364910896 |
TXT | 0x7a358 | 0x170448 | DWG AutoDesk AutoCAD 2004/2005/2006 | Chinese | China | 0.7506952285766602 |
RT_BITMAP | 0x1ea7a0 | 0x13628 | Device independent bitmap graphic, 288 x 272 x 8, image size 78336 | Chinese | China | 0.25306045340050376 |
RT_ICON | 0x12380 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5905 x 5905 px/m | Chinese | China | 0.43764761454888995 |
RT_DIALOG | 0x165c0 | 0xc6 | data | Chinese | China | 0.7171717171717171 |
RT_DIALOG | 0x16688 | 0x250 | data | Chinese | China | 0.5760135135135135 |
RT_DIALOG | 0x168d8 | 0x246 | data | Chinese | China | 0.5017182130584192 |
RT_DIALOG | 0x16b20 | 0x390 | data | Chinese | China | 0.5032894736842105 |
RT_DIALOG | 0x16eb0 | 0x1de | data | Chinese | China | 0.6359832635983264 |
RT_STRING | 0x1fddc8 | 0x3a | data | Chinese | China | 0.6206896551724138 |
RT_GROUP_ICON | 0x165a8 | 0x14 | data | Chinese | China | 1.1 |
RT_VERSION | 0x17090 | 0x310 | data | Chinese | China | 0.5216836734693877 |
None | 0x173a0 | 0xd1 | data | Chinese | China | 0.3827751196172249 |
None | 0x17478 | 0x48 | data | Chinese | China | 0.7777777777777778 |
DLL | Import |
---|---|
MFC42.DLL | |
MSVCRT.dll | __CxxFrameHandler, _mbscmp, fputs, _ftol, strstr, fopen, fclose, __dllonexit, _onexit, _except_handler3, ?terminate@@YAXXZ, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, _setmbcp, printf, __p__commode, __p__fmode, __set_app_type, _controlfp |
KERNEL32.dll | DeleteFileA, GetCurrentProcessId, OpenProcess, TerminateProcess, GetModuleHandleA, FindResourceA, LoadResource, LockResource, SizeofResource, Sleep, MultiByteToWideChar, GlobalUnlock, GlobalLock, GlobalAlloc, WinExec, GetStartupInfoA |
USER32.dll | ShowWindow, BringWindowToTop, GetWindowRect, MessageBoxA, GetWindowTextA, GetClassNameA, GetWindow, SetTimer, MoveWindow, FindWindowA, GetAsyncKeyState, GetDC, ScreenToClient, SetForegroundWindow, SetActiveWindow, BlockInput, IsIconic, GetKeyState, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, keybd_event, MapVirtualKeyA, GetWindowThreadProcessId, GetWindowTextLengthA, IsWindow, GetDesktopWindow, GetParent, GetSystemMetrics, GetClientRect, DrawIcon, GetSystemMenu, AppendMenuA, LoadIconA, EnableWindow, RedrawWindow, SendMessageA |
GDI32.dll | GetDeviceCaps |
SHELL32.dll | SHGetSpecialFolderPathA, ShellExecuteA |
ole32.dll | CoInitialize, CoCreateInstance, CoUninitialize |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
Chinese | China |
Target ID: | 0 |
Start time: | 04:25:11 |
Start date: | 19/04/2024 |
Path: | C:\Users\user\Desktop\SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 2'076'672 bytes |
MD5 hash: | 5A12407FB09EEFA5A7734A316082A5DB |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | false |
Analysis Process: SecuriteInfo.com.Win32.BankerX-gen.7761.21527.exePID: 5560, Parent PID: 4004COMMON
Execution Graph
Execution Coverage: | 27.3% |
Dynamic/Decrypted Code Coverage: | 0% |
Signature Coverage: | 44.3% |
Total number of Nodes: | 397 |
Total number of Limit Nodes: | 6 |
Graph
Function 00408890 Relevance: 429.8, APIs: 208, Strings: 37, Instructions: 1055filestringprocessCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 004049E0 Relevance: 182.9, APIs: 79, Strings: 25, Instructions: 906windowsleepfileCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00404170 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 234stringwindowCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00405F40 Relevance: 66.7, APIs: 36, Strings: 2, Instructions: 183windowCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00408590 Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 174sleepkeyboardstringCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00403F70 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 165sleepkeyboardCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00404610 Relevance: 16.6, APIs: 11, Instructions: 62COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00405E50 Relevance: 7.5, APIs: 5, Instructions: 37windowCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00405B40 Relevance: 7.5, APIs: 5, Instructions: 33COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00407210 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00409912 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00406390 Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 188sleepkeyboardCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00406270 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00403370 Relevance: 6.1, APIs: 4, Instructions: 74comCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 004046F0 Relevance: 28.7, APIs: 19, Instructions: 171COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00402600 Relevance: 16.7, APIs: 11, Instructions: 159COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00407066 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 004066D0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00406890 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 004065F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 004067B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00405940 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20sleepCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00406B70 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20sleepCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00406BF0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20sleepCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00406BB0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20sleepCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 00405760 Relevance: 9.1, APIs: 6, Instructions: 53timeCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 004044A0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
Function 004045A0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |