Edit tour

Windows Analysis Report
NUtec_FS01_2024-04-19_07_41_35.191.zip

Overview

General Information

Sample name:	NUtec_FS01_2024-04-19_07_41_35.191.zip
Analysis ID:	1428600
MD5:	096a94e8624bd59442405da29b2d0147
SHA1:	cbe3554a694025f725032b7736c5049794d3fb59
SHA256:	85c489dc78c95b2f19a534ab593412a9f5f0a5fa22e207f33db7d047d7049779
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Classification

Analysis Advice

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

unarchiver.exe (PID: 3724 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6500 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ysvq5c1x.zkp" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 0_2_00C8247C		0_2_00C8247C
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 0_2_00C8253D		0_2_00C8253D

Source: classification engine

Classification label: clean2.winZIP@4/1@0/0

Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ysvq5c1x.zkp" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ysvq5c1x.zkp" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip"	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: NUtec_FS01_2024-04-19_07_41_35.191.zip

Static file information: File size 3515136 > 1048576

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1160000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 495			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 9476			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3436	Thread sleep count: 495 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3436	Thread sleep time: -247500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3436	Thread sleep count: 9476 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3436	Thread sleep time: -4738000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 0_2_00C8B1D6 GetSystemInfo,

0_2_00C8B1D6

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ysvq5c1x.zkp" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip"

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	2 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428600
Start date and time:	2024-04-19 09:50:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NUtec_FS01_2024-04-19_07_41_35.191.zip
Detection:	CLEAN
Classification:	clean2.winZIP@4/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 48 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .zip Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:51:42	API Interceptor	4393015x Sleep call for process: unarchiver.exe modified

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3786
Entropy (8bit):	5.057120142080029
Encrypted:	false
SSDEEP:	48:5lflTy1VGMVGbMVGMVGpaVGjmVBVGMVGp3flTVGMVGBBVGqVGMVGbOVGCflTVG05:XtbmVGtzAt287kPvMHkhe
MD5:	5C59D5154111AA38BEC07AC84D3D7234
SHA1:	E2BBD5BA1FEBEBE9A50D50E1E6BF417CA631E543
SHA-256:	D9AED32E9FA5577A8960FC37D59B665EE6CDA5BA7736C5CF1B69E6403D2AAB17
SHA-512:	57A3C73B89B5B392B93838F14036776563347E779CC560196084EE36E3DCA85E58FDBA34FAE65DAFB11E1FA71B95547632C24417166A7D9A8A98AA242817D0F3
Malicious:	false
Reputation:	low
Preview:	04/19/2024 9:51 AM: Unpack: C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip..04/19/2024 9:51 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\ysvq5c1x.zkp..04/19/2024 9:51 AM: Received from standard out: ..04/19/2024 9:51 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..04/19/2024 9:51 AM: Received from standard out: ..04/19/2024 9:51 AM: Received from standard out: Scanning the drive for archives:..04/19/2024 9:51 AM: Received from standard out: 1 file, 3515136 bytes (3433 KiB)..04/19/2024 9:51 AM: Received from standard out: ..04/19/2024 9:51 AM: Received from standard out: Extracting archive: C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip..04/19/2024 9:51 AM: Received from standard out: ..04/19/2024 9:51 AM: Received from standard out: WARNINGS:..04/19/2024 9:51 AM: Received from standard out: Headers Error..04/19/2024 9:51 AM: Received from standard out: ..04/19/2024 9:51 AM: Received from standard o

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.999952871892463
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	NUtec_FS01_2024-04-19_07_41_35.191.zip
File size:	3'515'136 bytes
MD5:	096a94e8624bd59442405da29b2d0147
SHA1:	cbe3554a694025f725032b7736c5049794d3fb59
SHA256:	85c489dc78c95b2f19a534ab593412a9f5f0a5fa22e207f33db7d047d7049779
SHA512:	790b239da1f40a4791e37c5d3cee63653b7b257d89dccf27a5481f206abc3d83ed7c1c1b2bd38eb99bbeef96a98e29b77dd0e138de353568124036605b7aa4f4
SSDEEP:	98304:etbZ9byyWEhl+fkgzMhY1Au975hCpMX2lziSjJ+wrUXpmWkEr:eBWM0f90cAu9NMqX27+woXRr
TLSH:	E0F5339DE5246E1DDED3BD3A00B686ED464830F4142CAFE540B87383CDEA26BBD8D654
File Content Preview:	PK..-............J..5...8.}...Device/HarddiskVolume4/NUtec/R&D/Library/Manuals/iTech Axxis/Axxis iTech DVD/techsupport/DirectCut/SetupCutterDriver2.06e.exe......................]...(,..~.....-.{...rnj....:.!.......w..M......f.r./,.B...u2......,.x.......IN

File Icon


Icon Hash:	90cececece8e8eb0

Target ID:	0
Start time:	09:51:08
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip"
Imagebase:	0x690000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:51:08
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ysvq5c1x.zkp" "C:\Users\user\Desktop\NUtec_FS01_2024-04-19_07_41_35.191.zip"
Imagebase:	0xe90000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:51:09
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.5%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00C8B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00C8B208

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1eb738975dfe83d6525c2f7b72f550b9693c60f1b17206abc45a520bd5706cf2
Instruction ID: 2eb86dd489e7a5cccf36e59a1bf4c48945d5adcbfb667299fbb3ee1e49c42061
Opcode Fuzzy Hash: 1eb738975dfe83d6525c2f7b72f550b9693c60f1b17206abc45a520bd5706cf2
Instruction Fuzzy Hash: E801A2715042409FDB10DF15E989769FBE4EF05324F08C4AADD098F756D375E804CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C8B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C8B2F3

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fc4fcfcf230210ab83e67177e02e54adb778b28a57ea7f5a8a755361e8b815e1
Instruction ID: 6a0772dd77860ce4ab4558fe06cccc36df83b1dc9ce98b6daab8aafb51bcdce9
Opcode Fuzzy Hash: fc4fcfcf230210ab83e67177e02e54adb778b28a57ea7f5a8a755361e8b815e1
Instruction Fuzzy Hash: 0831D472504344AFE7228B65DC44FA7BFBCEF05314F0488AAE985CB562D374A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C8AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C8ADA7

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 66ef2d0b9b99db88c2582cabe5500ca7d5ae341ac7be579c2b3f1646192092ec
Instruction ID: 68d1b5ec7e4837804606c9fbcb7d6336a52da51dc00cd5793138f6a11e9edc97
Opcode Fuzzy Hash: 66ef2d0b9b99db88c2582cabe5500ca7d5ae341ac7be579c2b3f1646192092ec
Instruction Fuzzy Hash: 1631A172504384AFEB228B65DC44FA7BFACEF05314F0448AAF985CB562D274A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C8AB76 Relevance: 1.6, APIs: 1, Instructions: 91
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 00C8AC36

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: bcd57db3d4263b7941fcc63a7b11fc1ffe2c1dced069a0c331be92cda3f0dfd7
Instruction ID: 331c31a008121adc6b625342d98113b2bc77282ee470f1f669d08582c2b1c6bd
Opcode Fuzzy Hash: bcd57db3d4263b7941fcc63a7b11fc1ffe2c1dced069a0c331be92cda3f0dfd7
Instruction Fuzzy Hash: 2931907250E3C06FD3138B318C65A51BFB4AF47210F1A84CBD8C4CF6A3D269A819CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00C8A67D

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d76d4480dfc1c3bbacda76522a408619294f720a0947f7883cdf9e2b4cbf0713
Instruction ID: 12ef834a2730d4c24e463e82e6d816fd97c4e396e9b63fa2bffb7f9b7c41cd49
Opcode Fuzzy Hash: d76d4480dfc1c3bbacda76522a408619294f720a0947f7883cdf9e2b4cbf0713
Instruction Fuzzy Hash: 7931CFB1504340AFE721CF65DD44F62BBE8EF05224F0888AEE9858B662D375E918CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00C8A1C2

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8fb680b05fe185de6687708750cae43b1eb79262c7af5c6ea1de61d4c862c3c4
Instruction ID: d1181bf924f24e2fcc9e4ff4bac456a41bda4f35cfd105794cfc2f2a3113d362
Opcode Fuzzy Hash: 8fb680b05fe185de6687708750cae43b1eb79262c7af5c6ea1de61d4c862c3c4
Instruction Fuzzy Hash: 9E21E27150D3C06FD3128B258C51BA6BFB4EF47614F1944CBD884CF6A3D225A91AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A40C

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 33ff2b48b2c0d94df5cc7c64e4a87756bfa17f1a9ea1c384627b2b46eab4042d
Instruction ID: 7235cf8502b025f25e42f93ad05c57e880fa9c5ef2d2a4d22e869847ccf51fce
Opcode Fuzzy Hash: 33ff2b48b2c0d94df5cc7c64e4a87756bfa17f1a9ea1c384627b2b46eab4042d
Instruction Fuzzy Hash: 8B217C76504740AFE721CB15DC84FA2BBF8AF45614F08889AE9458B6A2D364E908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C8B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C8B2F3

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 76afcaa1da10426cd21319f2c43353dbec4ffc8bcd3752c0612fdc1e993a1ade
Instruction ID: b0505ae76eea29472587f1329c1c0c689239bfe5583b4ac116040ab431ce0b74
Opcode Fuzzy Hash: 76afcaa1da10426cd21319f2c43353dbec4ffc8bcd3752c0612fdc1e993a1ade
Instruction Fuzzy Hash: 6121B072500204AFEB219F65DD45FABFBECEF04314F04886AE9458B662D770E9188BB5

Uniqueness

Uniqueness Score: -1.00%

Function 00C8AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C8ADA7

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 793c970d1d6c888135565607de767506daec7e8961674bacfb13cb4966e1bbfc
Instruction ID: d24eb71bdd0d16dcd73d8910dde263fbd26064f1878e8798efd2258cceaa909c
Opcode Fuzzy Hash: 793c970d1d6c888135565607de767506daec7e8961674bacfb13cb4966e1bbfc
Instruction Fuzzy Hash: 5221B272500204AFEB219F65DD45FABBBECEF08314F04886AE945CBA51D770E5588BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A8DE

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5d906777ab0598ebac5c202ded7260ec4958326fc8de42e61650c30a0e9f6d1c
Instruction ID: 9aaa43493247c155ec288d180c573fe2c40be5f9080b9470196018d7f1d43771
Opcode Fuzzy Hash: 5d906777ab0598ebac5c202ded7260ec4958326fc8de42e61650c30a0e9f6d1c
Instruction Fuzzy Hash: 2C21D6714083806FE7228B54DC44FA2BFB8EF46724F0888EBE9848F553C274A919C772

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A9C1

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 826ac6a52fbebc916706758bf4c784ddad9d79946d5cce301a0e1ef09f6ad8b7
Instruction ID: aa2c3a04634bcfea979215f20b20cc9907393dce397e2f37e2b4e3ca34fc12a2
Opcode Fuzzy Hash: 826ac6a52fbebc916706758bf4c784ddad9d79946d5cce301a0e1ef09f6ad8b7
Instruction Fuzzy Hash: F121A371409380AFDB22CF55DC44F96BFB8EF06314F0888DAE9858B152C375A508CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00C8A67D

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7b993727eeccd3e033efb8baac06c13be9a47f0142502bf75b61b8a8e27af8b2
Instruction ID: 086440c601bd97e93c3e5062da282499637cbfab9013a6d64346e768f5944cff
Opcode Fuzzy Hash: 7b993727eeccd3e033efb8baac06c13be9a47f0142502bf75b61b8a8e27af8b2
Instruction Fuzzy Hash: C321E272500200AFE720DF65DD45F66FBE8EF08314F08886AE9458B752E371E908CB76

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A815

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 133ef8f8fea502644481d4b82422d46c464055a9fe2ddd3240710fd509045080
Instruction ID: 20c456b5767dffc2770f7e952d9927cdb0acfbc47e3f5bd59e91be40073e56c4
Opcode Fuzzy Hash: 133ef8f8fea502644481d4b82422d46c464055a9fe2ddd3240710fd509045080
Instruction Fuzzy Hash: 6821D5B54097806FE7228B55DC44BA2BFB8DF46314F0884DBE9848B293D264A909C776

Uniqueness

Uniqueness Score: -1.00%

Function 00C8AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00C8AA8B

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c976fd7f288bc14cf0004e46ede1be5b91b15a9f45acf2dc2c521aef59a84a8f
Instruction ID: 5a05144ab0f76d9c02de5520f721c1f98250483e76bf523bf3b8f6eb6762b921
Opcode Fuzzy Hash: c976fd7f288bc14cf0004e46ede1be5b91b15a9f45acf2dc2c521aef59a84a8f
Instruction Fuzzy Hash: 512180715083C06FEB12CB29DC55B92BFE8AF06314F0D84EAE985CB563D225D909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A40C

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 534443a6739f2e72ca2d5c808c6933d8b20fcfed7c3992054b73be31039c5275
Instruction ID: 064aae3e2cf86d3ec9c11231e51dae57c62202f189cac5a59764a07a55c1cb47
Opcode Fuzzy Hash: 534443a6739f2e72ca2d5c808c6933d8b20fcfed7c3992054b73be31039c5275
Instruction Fuzzy Hash: E421AE76200200AFEB20DF15CC88FA6B7ECEF04714F04846AE9458B691D3B0E909CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A6D4 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C8A748

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a53e83a7b663d6430ab137ddca625dd559356970bf9d1305723dbc35a68376f7
Instruction ID: 13e25c455e29690b2be3d2ccefe072c84e1a08553214f5890fbd0ea8d43059bf
Opcode Fuzzy Hash: a53e83a7b663d6430ab137ddca625dd559356970bf9d1305723dbc35a68376f7
Instruction Fuzzy Hash: 1F21A1B55097C0AFE7128B25DC94752BFB8EF07324F0984DBDC858B5A3D224A908C772

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A9C1

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c656f1a5a1cebd54f3500aa6f5d3597e54dd27f5fda29fc2c73aa15fae4ef364
Instruction ID: 8cbd3da9bb567d4a91bd905d93c3ae90685973374e3e4b9af228e115014177c3
Opcode Fuzzy Hash: c656f1a5a1cebd54f3500aa6f5d3597e54dd27f5fda29fc2c73aa15fae4ef364
Instruction Fuzzy Hash: 2A110172500300AFEB21DF55DD44FAAFBE8EF08328F04886AE9458B651C374E508CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A8DE

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9589a8769fd86163c7d6deb6afaf7f3123e4f8ef7a4ae5976d0510114cf06fd2
Instruction ID: d4256766de48727438b5328f72c89f2877907add293248d5ad77c6ebbf5a0ae9
Opcode Fuzzy Hash: 9589a8769fd86163c7d6deb6afaf7f3123e4f8ef7a4ae5976d0510114cf06fd2
Instruction Fuzzy Hash: 15110472500300AFEB20DF55DD44BA6FBE8EF04324F14886AE9458B641C374A508CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C8A30C

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 4ce8769417d2dde40570679cf1705c2e854f3bab0684210867d1971b48b70470
Instruction ID: 0453ca5576e65c192ba1908309e290e576e62c09ab872c7193bb9775ea39a882
Opcode Fuzzy Hash: 4ce8769417d2dde40570679cf1705c2e854f3bab0684210867d1971b48b70470
Instruction Fuzzy Hash: 4F11A0754093C0AFEB228B25DC54A52BFB4DF07224F0980DBDD858F263D275A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,86F9D00D,00000000,00000000,00000000,00000000), ref: 00C8A815

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 434ed1797d2c4909612f4a5236fbbc29c1f036aa9502493719d8ca407ddd3d1d
Instruction ID: c61e4996575eebc31b72a3e05c83f19781ae85686dd3dbfc0914ebf8a02cb334
Opcode Fuzzy Hash: 434ed1797d2c4909612f4a5236fbbc29c1f036aa9502493719d8ca407ddd3d1d
Instruction Fuzzy Hash: 4B01C472500240AFE7209B05DD49BA6BBD8DF04724F1484A6ED059B782D3B4E909CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00C8AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00C8AA8B

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 1d6eb00db7993274908491c888ddcf5c44d34c327ac33068e5f9478526f3cb9c
Instruction ID: 0012d56eed6307aafb06c1cf23e8a01e5c40161b528f81e3042dfbee7dae07b7
Opcode Fuzzy Hash: 1d6eb00db7993274908491c888ddcf5c44d34c327ac33068e5f9478526f3cb9c
Instruction Fuzzy Hash: 9611A5716002409FEB14DF15D9857A6FBD8EF04714F08C4AADD05CB652D375E904DF62

Uniqueness

Uniqueness Score: -1.00%

Function 00C8AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00C8AFE4

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: bd36c6f5bef237ef6195c2e63643b1259ef6170f58901c1b7f0bfd8ed464aef9
Instruction ID: e742ba35d4841697d1882304acc666a5a179b7ac5a7acc49704d954989517913
Opcode Fuzzy Hash: bd36c6f5bef237ef6195c2e63643b1259ef6170f58901c1b7f0bfd8ed464aef9
Instruction Fuzzy Hash: E711A0715093C0AFD7128B25DC45B52BFF4EF06220F0984DBED858B263D375A908DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C8B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00C8B208

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b15d5a52f703781fd7a97fb7b705086e4b7b73e82e013362c624f8914932487a
Instruction ID: 32a73596ad01f454d908feb93c00c18279e5c2547a7929b530d8b00a077756aa
Opcode Fuzzy Hash: b15d5a52f703781fd7a97fb7b705086e4b7b73e82e013362c624f8914932487a
Instruction Fuzzy Hash: 78117071509380AFDB12CF15DC44B56BFB4DF46224F0884DAED858F263D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C8ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 00C8AC36

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: d8ded0f760870c2a4dbd9c83dea79840069054bf15b9a802caeca3e7ad6b3e3f
Instruction ID: 051844daa0049bb102c64b0a8f4a89c57bb3e1c6df5ed61927bded2b7c89b0a5
Opcode Fuzzy Hash: d8ded0f760870c2a4dbd9c83dea79840069054bf15b9a802caeca3e7ad6b3e3f
Instruction Fuzzy Hash: 2401B171600200ABD350DF16DD45B66FBE8FB88B20F14852AEC089BB41D771F925CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00C8A1C2

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 12301a60cc14f3dbd2c48cfd44de7ff544163d31661cdd4b4d4d6057b36430e8
Instruction ID: 52f6cee5fa56f0933f9497ba580efd9afd13270ea2b4c0f63f3120cbb846ad87
Opcode Fuzzy Hash: 12301a60cc14f3dbd2c48cfd44de7ff544163d31661cdd4b4d4d6057b36430e8
Instruction Fuzzy Hash: 3901B171600200ABD310DF16DD45B66FBE8EB88A20F14856AEC089BB41D771F915CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00C8A748

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2a2438a9bfc871edb05333840d2dd07ed2482e9344a37bcf61807a3eb9e06a60
Instruction ID: 5f000e39a85bf5e25e4c97e1a65823840fbf8af5c308d6da300c5c7faa93f019
Opcode Fuzzy Hash: 2a2438a9bfc871edb05333840d2dd07ed2482e9344a37bcf61807a3eb9e06a60
Instruction Fuzzy Hash: 5301DF72A002409FEB10DF15D989766FBE4EF04324F18C4ABDD098B752D375E808DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C8AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00C8AFE4

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 4b64aef5114a140e19d77dd0e9568fe4197e4d9fdb31e9bc0c365b9b8b9685d0
Instruction ID: 1812040cc9719566c2ff77e3b7a878b214b686cc60ca36e79816995659b930d8
Opcode Fuzzy Hash: 4b64aef5114a140e19d77dd0e9568fe4197e4d9fdb31e9bc0c365b9b8b9685d0
Instruction Fuzzy Hash: 8701F9755002409FEB109F15D889766FBD4EF04324F08C09ADD0A4B752D775E848DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C8A30C

Memory Dump Source

Source File: 00000000.00000002.4541475768.0000000000C8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c8a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 1c5a933cd033f7f745a438669433ef9802e6e2987e15f40ac8134285aacfba15
Instruction ID: 4bde7c9d15e10d3843b3780707b7beb55618964583aad7f2f76efd72840e0048
Opcode Fuzzy Hash: 1c5a933cd033f7f745a438669433ef9802e6e2987e15f40ac8134285aacfba15
Instruction Fuzzy Hash: E7F08C755046409FEB20AF06E989766FBA4EF04724F08C09ADD094B766D3B5E908CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01260CA8 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

[M[, xrefs: 01260D43, 01260D48

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID: [M[
API String ID: 0-4074273043
Opcode ID: 7ba47f10b2dd8fb06ee3125bf9bfe2babe75ffb38ca21d22308de1d3251cd55a
Instruction ID: bab760a7440ae9b1566ac2f6397cf7218590d40b4d8145283c6482a0e5f076e6
Opcode Fuzzy Hash: 7ba47f10b2dd8fb06ee3125bf9bfe2babe75ffb38ca21d22308de1d3251cd55a
Instruction Fuzzy Hash: 9D2147317006018BCB14EB7984466AFBBD79FC9308B44882CD486DB345DF79ED468796

Uniqueness

Uniqueness Score: -1.00%

Function 01260CA5 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

[M[, xrefs: 01260D43, 01260D48

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID: [M[
API String ID: 0-4074273043
Opcode ID: 6e21c905b978195cb90b2b235f4683d8b1522b777da25924f211c5431970795e
Instruction ID: e7a473ad61dee6f37a539fbe062453e359ae2b781af56ff98dcd58a6a83e6df2
Opcode Fuzzy Hash: 6e21c905b978195cb90b2b235f4683d8b1522b777da25924f211c5431970795e
Instruction Fuzzy Hash: A8214531B002008BCB14EB7994463AF7BE79FC9308B44842CD486DB389DF79ED469796

Uniqueness

Uniqueness Score: -1.00%

Function 012602C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d1eaef718769e3c211e47da097412f32ba3af88b35a7ca184a013307b46786
Instruction ID: 8c096ad05d85bc4bc7186e9a08e99d2dd3e7b12d98305a436c5a7cd9a25cdd75
Opcode Fuzzy Hash: 08d1eaef718769e3c211e47da097412f32ba3af88b35a7ca184a013307b46786
Instruction Fuzzy Hash: 53B14136712110CFC718EB74F959B6E7BB6FF89344B108428EA06973A8DB349C61DB94

Uniqueness

Uniqueness Score: -1.00%

Function 012607A4 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67787d75a92e50603a1336eaa60ccfca60c0fc48bd81ac0b4686d82cc7df2916
Instruction ID: ebb9844ea7e00ecc211dbe36c5315bde1175c4f4699ada42ad9fee2231aec546
Opcode Fuzzy Hash: 67787d75a92e50603a1336eaa60ccfca60c0fc48bd81ac0b4686d82cc7df2916
Instruction Fuzzy Hash: E4A19032B012018BDB05AB74D86977E77F7ABC8308F148428EA0697398DF789C46DB95

Uniqueness

Uniqueness Score: -1.00%

Function 011507A4 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541936769.0000000001150000.00000040.00000020.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e60194c2d9f0520584e6e3c80a4f421ae24a2bc25e0aad173e6154185fe02c
Instruction ID: 2bb6ca149cd99c9daa7932102f1361f82d9b4d5214f02efc87248c3996286acc
Opcode Fuzzy Hash: 29e60194c2d9f0520584e6e3c80a4f421ae24a2bc25e0aad173e6154185fe02c
Instruction Fuzzy Hash: DE21A3B6804604AFD210DB45ED45CA7FBECEF85520F04C56EFC498B601E276A9198BF2

Uniqueness

Uniqueness Score: -1.00%

Function 01150882 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541936769.0000000001150000.00000040.00000020.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45eb7fc29e62a1e32a9d4b5a8104678bfb2b78082bb2778661f39003052a9a2
Instruction ID: c9a21d1529ac7a4c351008e080f2755b1909f18815dd34b62a739019b95aaa35
Opcode Fuzzy Hash: b45eb7fc29e62a1e32a9d4b5a8104678bfb2b78082bb2778661f39003052a9a2
Instruction Fuzzy Hash: 64113DB240D3C49FD302D7149C41896BFF8DF83220B09C9AFE8458B653D2596919C7F2

Uniqueness

Uniqueness Score: -1.00%

Function 01260B9D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7deb0225a099f45b6a17f4d133a48d1f12c04b14addaad2fde5ccf1ea94dc3
Instruction ID: 919c33ee1727f6fc59141bae0f6b4ecc6fa2eff3977aabf6f9fb8e098d5ba7da
Opcode Fuzzy Hash: bc7deb0225a099f45b6a17f4d133a48d1f12c04b14addaad2fde5ccf1ea94dc3
Instruction Fuzzy Hash: 9311B232A101186FCB049BB4E8559DF7BF6AB88304B248579E105E7364DB35A81A8B80

Uniqueness

Uniqueness Score: -1.00%

Function 01260BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9947461c4efc9e04163014d9e78998d037ec92125a638ae8eb7252223081f74
Instruction ID: 5c4b56c388728d19911f40be0a785db23fca06f25e68c7387a87caaca3df18ce
Opcode Fuzzy Hash: e9947461c4efc9e04163014d9e78998d037ec92125a638ae8eb7252223081f74
Instruction Fuzzy Hash: BA11C132A10218AFCB04ABB4D84599F77F6FB88314B108439E205E7364EB34A81A87C0

Uniqueness

Uniqueness Score: -1.00%

Function 01150807 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541936769.0000000001150000.00000040.00000020.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435a5129382eef3ddeae45dc4b295ab48bb7c6785cbecc7016036ef65899463f
Instruction ID: b370fceba6ca0bef2f8dbe29337d83bb07eb6394dfd893e0857f1892fc5ade4c
Opcode Fuzzy Hash: 435a5129382eef3ddeae45dc4b295ab48bb7c6785cbecc7016036ef65899463f
Instruction Fuzzy Hash: 2C01B5B24097846FD301CB15AC41C57BBE8DF86524F09C9ABEC448B642E225A919CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 011505E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541936769.0000000001150000.00000040.00000020.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1874b2570eb8a3b575ff2c283f86e9252a95b36f1151667e4e5e3e53bb79c8
Instruction ID: 852c29f238b6fa025e0334789490897064cc0e31b039d62d8ca9798404f7c62d
Opcode Fuzzy Hash: 9f1874b2570eb8a3b575ff2c283f86e9252a95b36f1151667e4e5e3e53bb79c8
Instruction Fuzzy Hash: E3018B7650D7806FD7118F159C44862FFF8EB86520709849FE94987752D225A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0115082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541936769.0000000001150000.00000040.00000020.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c2f2b82d8c20434a21e5e00ffbafb39d8bd980657151c0540b86848c685fe8
Instruction ID: 04b755d7c31b9510e44b622fe31bb309562d8195c7f01f1156d43dcfc9664ace
Opcode Fuzzy Hash: 77c2f2b82d8c20434a21e5e00ffbafb39d8bd980657151c0540b86848c685fe8
Instruction Fuzzy Hash: A8F082B2805604AB9200DF09ED45866F7ECDF84521F14C53EEC098B705E276A9198AF2

Uniqueness

Uniqueness Score: -1.00%

Function 01150606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541936769.0000000001150000.00000040.00000020.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c30c0fb377c2e33dfc5f3b07c7b40541ed8680bcc724b0df1c3f6a20cce0372
Instruction ID: dd45332dcf5ca10ce2c50b45e2bbc2efbb55a3bd0aa5a6c7c39bdbe6b5a04621
Opcode Fuzzy Hash: 5c30c0fb377c2e33dfc5f3b07c7b40541ed8680bcc724b0df1c3f6a20cce0372
Instruction Fuzzy Hash: A7E06DB66046009B9650CF0AEC85452F7D8EB84630B18C06BDC0D8BB15D635B509CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 01260C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8834f2aa742f3161171383da5f449ddb5089b1c0ea2ba470686cdb7c63d029d2
Instruction ID: 0805a7c966d0b080e873c2e991f97c97ee94c9041e091d4dcca80969c2baa81b
Opcode Fuzzy Hash: 8834f2aa742f3161171383da5f449ddb5089b1c0ea2ba470686cdb7c63d029d2
Instruction Fuzzy Hash: 77D01231F442182B8B48DEF9584159E7AEA9B84194B64447D900DD7340FE3998018791

Uniqueness

Uniqueness Score: -1.00%

Function 01260C5C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a86254a3bc46a39456c466ab2004edfd6e34fe8460ccea4f960d259d9a6fb2
Instruction ID: b3244507090fab0b09bbcafdd8697b2c002c4454f0821307e8ce8df69f583227
Opcode Fuzzy Hash: 42a86254a3bc46a39456c466ab2004edfd6e34fe8460ccea4f960d259d9a6fb2
Instruction Fuzzy Hash: ADE01231F542642B8B48DEF9545159EBAE69B851A4BA4447D900DD7340FE399D0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 00C823F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541458537.0000000000C82000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c82000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e892efd9bef3e7a3ae8a86109bcbe66cfb0b7da55542cf00e5361e1c3a64771
Instruction ID: fa609ad13a5cbf7f706626e3de90949bec63468f04466e96c205b3f55aaa4ed5
Opcode Fuzzy Hash: 6e892efd9bef3e7a3ae8a86109bcbe66cfb0b7da55542cf00e5361e1c3a64771
Instruction Fuzzy Hash: 2FD05E792096D14FD326AB1CC6A8B9537D4AB91718F4A44FAA800CBB63C768DA81E610

Uniqueness

Uniqueness Score: -1.00%

Function 01260DDC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3dab7db969ccde3bdbc694df8e44ccb1c7c02547e4d2dc64feb3114f8b8d911
Instruction ID: 76a0f3234baa666b03c1ba4ef2af7cf9071e25e58c34598abb7186c6827ce2eb
Opcode Fuzzy Hash: d3dab7db969ccde3bdbc694df8e44ccb1c7c02547e4d2dc64feb3114f8b8d911
Instruction Fuzzy Hash: 55D023303401008FC704DB34D855E6D3B525BE0304F14C15CD4098B3E2C778C488D784

Uniqueness

Uniqueness Score: -1.00%

Function 00C823BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541458537.0000000000C82000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c82000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f104a32902717ea506537a7d7813fd4177056eb4f4f0cb3ba837fdc4701b3c77
Instruction ID: b97865046da12aba7ea17e0d26fcf7052adea4ba3578c52762a6f4a9f1b430d3
Opcode Fuzzy Hash: f104a32902717ea506537a7d7813fd4177056eb4f4f0cb3ba837fdc4701b3c77
Instruction Fuzzy Hash: 9CD05E382002814BC726EA0CC6E8F5937D8AB40719F0648E9BC208BB72C7A8DAC0DA00

Uniqueness

Uniqueness Score: -1.00%

Function 01260E10 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff07e840e32a40dee24971035eec5af5335e3c6f8a569b2e71b78cc289cd97f2
Instruction ID: 97dc9fe6c8f5eb11eafe08e39d045c96514511a0333971e24782d2f85a5a3f5f
Opcode Fuzzy Hash: ff07e840e32a40dee24971035eec5af5335e3c6f8a569b2e71b78cc289cd97f2
Instruction Fuzzy Hash: D8D0A7202203408BC704A73494145287B9567D5304F44C054E6441B3A1C674D841D784

Uniqueness

Uniqueness Score: -1.00%

Function 01260DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24a64477edbb9c35cf79b305200e827e77317388dedd656335f0839c116f54e
Instruction ID: 7882adcaa141a7c1024941e471b9b0e535afb67b643094be72f6cd8d2f978bab
Opcode Fuzzy Hash: e24a64477edbb9c35cf79b305200e827e77317388dedd656335f0839c116f54e
Instruction Fuzzy Hash: B8C012302103048BD704AB78D819E25779A57D0304F45C164A5090B395DA78E894D6C8

Uniqueness

Uniqueness Score: -1.00%

Function 01260E18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4542022931.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1260000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22965f1a4a94d04b1366dc26c6749b37fe539325063c0e5d47c5655322047dcd
Instruction ID: 02a4acf0d1351e4ba23fe17df32fe38be7cc0ae20428f7cff04266564bfaf232
Opcode Fuzzy Hash: 22965f1a4a94d04b1366dc26c6749b37fe539325063c0e5d47c5655322047dcd
Instruction Fuzzy Hash: 61C012312103048BC708A778D919A29779957D4304F84C16465085B395DA78E884D688

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C8247C Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541458537.0000000000C82000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c82000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23dc496512b7a7cc92c8235c56f8bd776b120a2e431a8930d3b76e008f5737e
Instruction ID: 6abc8f14d780eaa2762c7c1d2e8201d6793c476627e2c2c627b0625faec6c56a
Opcode Fuzzy Hash: d23dc496512b7a7cc92c8235c56f8bd776b120a2e431a8930d3b76e008f5737e
Instruction Fuzzy Hash: D9A17B6540E7C55FD7178B3499AA044BFB0AE93224B0E4ACFC8D0CF1A7D3689959C726

Uniqueness

Uniqueness Score: -1.00%

Function 00C8253D Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4541458537.0000000000C82000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c82000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a7c6edbdfefb5fa159bb8f29bd1e250a2005428a1dea066ceed1ee1b62f804
Instruction ID: 93110a91723ed9e14ab5152c13d603a2771ee0198889e125765bc1bc5c8dd752
Opcode Fuzzy Hash: 80a7c6edbdfefb5fa159bb8f29bd1e250a2005428a1dea066ceed1ee1b62f804
Instruction Fuzzy Hash: 9B51476140EBC69FD71B8B3498A6048BF70AD9322471E4ACFC8D0CF1A7D359895DC726

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NUtec_FS01_2024-04-19_07_41_35.191.zip

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\unarchiver.log

Static File Info

General

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: unarchiver.exePID: 3724, Parent PID: 1028

General

Chronological Activities

Analysis Process: 7za.exePID: 6500, Parent PID: 3724

General

Chronological Activities

Analysis Process: conhost.exePID: 5264, Parent PID: 6500

General

Chronological Activities

Disassembly

Analysis Process: unarchiver.exePID: 3724, Parent PID: 1028COMMON

Execution Graph

Graph

Callgraph

Executed Functions

Function 00C8B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Function 00C8B246 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Windows Analysis Report
NUtec_FS01_2024-04-19_07_41_35.191.zip

Function 00C8B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 00C8AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00C8AB76 Relevance: 1.6, APIs: 1, Instructions: 91
pipeCOMMON

Function 00C8A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Function 00C8A120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Function 00C8A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Function 00C8B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 00C8AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 00C8A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Function 00C8A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 00C8A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Function 00C8A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Function 00C8AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 00C8A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Function 00C8A6D4 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON