Edit tour

Windows Analysis Report
WebSigner_SuiteMSI_Barclays.exe

Overview

General Information

Sample name:	WebSigner_SuiteMSI_Barclays.exe
Analysis ID:	1428711
MD5:	c469b3646fbddc8e03dcb9865b02e89c
SHA1:	46c0d0b632a9b2865cd79110f5549e3132cd313a
SHA256:	c5e809af345907819df2cebda858e8c9b5614de1f049bd347cebb6305281790d
Infos:

Detection

Score:	16
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

PE file has a writeable .text section

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

WebSigner_SuiteMSI_Barclays.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe" MD5: C469B3646FBDDC8E03DCB9865B02E89C)

_is23C8.exe (PID: 7304 cmdline: "C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\user\Desktop" ORIGINALSETUPEXENAME="WebSigner_SuiteMSI_Barclays.exe" MD5: C469B3646FBDDC8E03DCB9865B02E89C)

setup64.exe (PID: 7348 cmdline: "C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe" -embedded:EEFDEB78-A81F-4EAC-839B-C4BCB6470B9F -IS_temp MD5: 7686C19501FFA9DA709A98AF94C0C844)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: WebSigner_SuiteMSI_Barclays.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\eula.rtf

Jump to behavior

Source: WebSigner_SuiteMSI_Barclays.exe

Static PE information: certificate valid

Source: WebSigner_SuiteMSI_Barclays.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\CodeBases\isdev\redist\language independent\x64\SetupSuite64.pdb source: setup64.exe, 00000002.00000000.1667433443.00007FF6237D9000.00000002.00000001.01000000.00000007.sdmp, setup64.exe, 00000002.00000002.2923632394.00007FF6237D9000.00000002.00000001.01000000.00000007.sdmp, setup64.exe.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\ISP\ISSetup.pdb source: ISSetup.dll.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdb source: WebSigner_SuiteMSI_Barclays.exe, _is23C8.exe.0.dr
Source:	Binary string: signtool.pdb source: signtool.exe.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdbG source: WebSigner_SuiteMSI_Barclays.exe, _is23C8.exe.0.dr
Source:	Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe.1.dr
Source:	Binary string: E:\DEV_Encours\MESSAGE\Xmessage\obj\Release\Xmessage.pdb source: Xmessage.exe.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\language independent\i386\Setup_UI.pdb source: _is23C8.exe, 00000001.00000002.2924966445.000000006CF41000.00000002.00000001.01000000.00000005.sdmp, Setup_UI.dll.1.dr

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00EBFB60 FindFirstFileW,__CxxThrowException@8,FindClose,	0_2_00EBFB60
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0047FB60 FindFirstFileW,__CxxThrowException@8,FindClose,	1_2_0047FB60
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237D1B98 FindFirstFileExW,	2_2_00007FF6237D1B98

Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe

Code function: 2_2_00007FF6237C50CC QueryPerformanceCounter,GetTickCount,ResetEvent,InternetReadFile,QueryPerformanceCounter,GetTickCount,

2_2_00007FF6237C50CC

Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _is23C8.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: _is23C8.exe, 00000001.00000002.2924247309.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://logo.ve
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, WebSigner_SuiteMSI_Barclays.exe, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://s2.symcb.com0
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://sv.symcd.com0&
Source: _is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: _is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: WebSigner_SuiteMSI_Barclays.exe, setup64.exe.1.dr, _is23C8.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://www.flexerasoftware.com0
Source: _is23C8.exe, 00000001.00000002.2923886870.000000000140C000.00000004.00000020.00020000.00000000.sdmp, setup.xml.1.dr	String found in binary or memory: http://www.gemalto.com
Source: ISSetup.dll.1.dr	String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Source: _is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	String found in binary or memory: http://www.mozilla.org/MPL/
Source: eula.rtf.1.dr	String found in binary or memory: http://www.openssl.org/)
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: _is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	String found in binary or memory: https://mozilla.org/MPL/2.0/.
Source: _is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	String found in binary or memory: https://opensource.org/licenses/Zlib)
Source: _is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	String found in binary or memory: https://supportportal.thalesgroup.com
Source: _is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	String found in binary or memory: https://supportportal.thalesgroup.com/.
Source: _is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	String found in binary or memory: https://www.digicert.com/CPS0

System Summary

PE file has a writeable .text section

Source: ISRT.dll.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F44741 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		0_2_00F44741
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00504741 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		1_2_00504741

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F50066	0_2_00F50066
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3E270	0_2_00F3E270
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F4A226	0_2_00F4A226
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F5047E	0_2_00F5047E
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3A410	0_2_00F3A410
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F54576	0_2_00F54576
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F00520	0_2_00F00520
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F508B3	0_2_00F508B3
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00EC2870	0_2_00EC2870
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3C830	0_2_00F3C830
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00EFCA90	0_2_00EFCA90
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3ABED	0_2_00F3ABED
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F50CE8	0_2_00F50CE8
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F00DF0	0_2_00F00DF0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3AE43	0_2_00F3AE43
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3CFF0	0_2_00F3CFF0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F5B2D0	0_2_00F5B2D0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F51298	0_2_00F51298
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3D460	0_2_00F3D460
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F09450	0_2_00F09450
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00ECB630	0_2_00ECB630
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F3D890	0_2_00F3D890
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00EB5840	0_2_00EB5840
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F4FB6A	0_2_00F4FB6A
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F5FC1C	0_2_00F5FC1C
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F1DDE0	0_2_00F1DDE0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FA410	1_2_004FA410
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004C9450	1_2_004C9450
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0048B630	1_2_0048B630
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00510066	1_2_00510066
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FE270	1_2_004FE270
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0050A226	1_2_0050A226
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0051047E	1_2_0051047E
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00514576	1_2_00514576
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004C0520	1_2_004C0520
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00482870	1_2_00482870
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FC830	1_2_004FC830
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_005108B3	1_2_005108B3
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004BCA90	1_2_004BCA90
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FABED	1_2_004FABED
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00510CE8	1_2_00510CE8
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004C0DF0	1_2_004C0DF0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FAE43	1_2_004FAE43
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FCFF0	1_2_004FCFF0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0051B2D0	1_2_0051B2D0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FD460	1_2_004FD460
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00475840	1_2_00475840
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004FD890	1_2_004FD890
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0050FB6A	1_2_0050FB6A
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0051FC1C	1_2_0051FC1C
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004DDDE0	1_2_004DDDE0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_6CEE4A70	1_2_6CEE4A70
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_6CEE37F0	1_2_6CEE37F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_6CF00C50	1_2_6CF00C50
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237B2C90	2_2_00007FF6237B2C90
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237D2C00	2_2_00007FF6237D2C00
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237B9B10	2_2_00007FF6237B9B10
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C2B34	2_2_00007FF6237C2B34
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237D6AA8	2_2_00007FF6237D6AA8
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237B1A10	2_2_00007FF6237B1A10
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237BA220	2_2_00007FF6237BA220
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237D1968	2_2_00007FF6237D1968
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C298C	2_2_00007FF6237C298C
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237D30D0	2_2_00007FF6237D30D0
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237CB910	2_2_00007FF6237CB910
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C2130	2_2_00007FF6237C2130
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237B7020	2_2_00007FF6237B7020
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C25E0	2_2_00007FF6237C25E0
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237CD568	2_2_00007FF6237CD568

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00EB6D90 appears 80 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00F3FB96 appears 67 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00F4CC61 appears 46 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00F4C2E5 appears 33 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00EB4150 appears 287 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00EB6CA0 appears 107 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00F4D300 appears 31 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00EBB040 appears 324 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00F4CC2D appears 51 times
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: String function: 00EBDDE0 appears 140 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 00476D90 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 6CEA9160 appears 154 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 004FFB96 appears 67 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 0050C2E5 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 0050CC61 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 0047DDE0 appears 140 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 0050D300 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 0050CC2D appears 51 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 0047B040 appears 327 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 00476CA0 appears 107 times
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: String function: 00474150 appears 285 times

Source: ISSetup.dll.1.dr

Static PE information: Resource name: PUBLICKEY type: b.out overlay separate pure segmented executable V2.3 186 286 286 386 Large Text Large Data Huge Objects Enabled

Source: WebSigner_SuiteMSI_Barclays.exe, 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstallShield SetupSuite.exe< vs WebSigner_SuiteMSI_Barclays.exe
Source: WebSigner_SuiteMSI_Barclays.exe	Binary or memory string: OriginalFilenameInstallShield SetupSuite.exe< vs WebSigner_SuiteMSI_Barclays.exe

Source: WebSigner_SuiteMSI_Barclays.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ISRT.dll.1.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: ISRT.dll.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: clean16.winEXE@5/47@0/0

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F44741 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		0_2_00F44741
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00504741 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,		1_2_00504741

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00EEC2B0 CoCreateInstance,

0_2_00EEC2B0

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

Code function: 1_2_6CEE9680 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GlobalUnlock,GlobalFree,

1_2_6CEE9680

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

Mutant created: \Sessions\1\BaseNamedObjects\{783F36BC-63CA-4E74-ABA6-81C222D2C3DD}

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

File created: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}

Jump to behavior

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: IS_temp	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: runfromtemp	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: kernel32.dll	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: SuiteSetup.ini	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: SuiteSetup.ini	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: embedded:	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: IS_ProxyWaiter_	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: debuglog	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: newlog	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: SetupSuite.cpp	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: SetupSuite.cpp	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: SetupSuite.cpp	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: SuiteSetup.ini	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: SuiteSetup.ini	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: clone_wait	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: debuglog	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: /debuglog	0_2_00EE81F0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Command line argument: /debuglog	0_2_00EE81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: IS_temp	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: runfromtemp	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: kernel32.dll	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: SuiteSetup.ini	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: SuiteSetup.ini	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: embedded:	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: IS_ProxyWaiter_	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: debuglog	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: newlog	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: SetupSuite.cpp	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: SetupSuite.cpp	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: SetupSuite.cpp	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: SuiteSetup.ini	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: SuiteSetup.ini	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: clone_wait	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: debuglog	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: /debuglog	1_2_004A81F0
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Command line argument: /debuglog	1_2_004A81F0

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

File read: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\SuiteSetup.ini

Jump to behavior

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

File read: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe "C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe"
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Process created: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe "C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\user\Desktop" ORIGINALSETUPEXENAME="WebSigner_SuiteMSI_Barclays.exe"
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Process created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe "C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe" -embedded:EEFDEB78-A81F-4EAC-839B-C4BCB6470B9F -IS_temp
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Process created: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe "C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\user\Desktop" ORIGINALSETUPEXENAME="WebSigner_SuiteMSI_Barclays.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Process created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe "C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe" -embedded:EEFDEB78-A81F-4EAC-839B-C4BCB6470B9F -IS_temp	Jump to behavior

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

File written: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\SuiteSetup.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Automated click: I accept the terms in the license agreement

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: WebSigner_SuiteMSI_Barclays.exe

Static PE information: certificate valid

Source: WebSigner_SuiteMSI_Barclays.exe

Static file information: File size 3485736 > 1048576

Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: WebSigner_SuiteMSI_Barclays.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: WebSigner_SuiteMSI_Barclays.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\CodeBases\isdev\redist\language independent\x64\SetupSuite64.pdb source: setup64.exe, 00000002.00000000.1667433443.00007FF6237D9000.00000002.00000001.01000000.00000007.sdmp, setup64.exe, 00000002.00000002.2923632394.00007FF6237D9000.00000002.00000001.01000000.00000007.sdmp, setup64.exe.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\ISP\ISSetup.pdb source: ISSetup.dll.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdb source: WebSigner_SuiteMSI_Barclays.exe, _is23C8.exe.0.dr
Source:	Binary string: signtool.pdb source: signtool.exe.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdbG source: WebSigner_SuiteMSI_Barclays.exe, _is23C8.exe.0.dr
Source:	Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe.1.dr
Source:	Binary string: E:\DEV_Encours\MESSAGE\Xmessage\obj\Release\Xmessage.pdb source: Xmessage.exe.1.dr
Source:	Binary string: C:\CodeBases\isdev\redist\language independent\i386\Setup_UI.pdb source: _is23C8.exe, 00000001.00000002.2924966445.000000006CF41000.00000002.00000001.01000000.00000005.sdmp, Setup_UI.dll.1.dr

Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F20CE0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00F20CE0

Source: initial sample

Static PE information: section where entry point is pointing to: .rsrc

Source: WebSigner_SuiteMSI_Barclays.exe	Static PE information: section name: .orpc
Source: _is23C8.exe.0.dr	Static PE information: section name: .orpc
Source: ISSetup.dll.1.dr	Static PE information: section name: .orpc

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F4CBF6 push ecx; ret	0_2_00F4CC09
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F4D346 push ecx; ret	0_2_00F4D359
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F5BC7D push dword ptr [esp+ecx-75h]; iretd	0_2_00F5BC81
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0050CBF6 push ecx; ret	1_2_0050CC09
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0050D346 push ecx; ret	1_2_0050D359
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0051BC7D push dword ptr [esp+ecx-75h]; iretd	1_2_0051BC81

Source: ISRT.dll.1.dr

Static PE information: section name: .text entropy: 7.98362330850952

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISRT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Xmessage.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISBEW64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\signtool.exe	Jump to dropped file
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	File created: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISSetup.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

File created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\eula.rtf

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISRT.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Xmessage.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISBEW64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\signtool.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISSetup.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe

Evaded block: after key decision

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-67326
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	API coverage: 7.3 %
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	API coverage: 6.2 %

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00EBFB60 FindFirstFileW,__CxxThrowException@8,FindClose,	0_2_00EBFB60
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0047FB60 FindFirstFileW,__CxxThrowException@8,FindClose,	1_2_0047FB60
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237D1B98 FindFirstFileExW,	2_2_00007FF6237D1B98

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00EEEB40 VirtualQuery,GetSystemInfo,MapViewOfFile,UnmapViewOfFile,

0_2_00EEEB40

Source: ISRT.dll.1.dr	Binary or memory string: RFqEMUdUD
Source: ISRT.dll.1.dr	Binary or memory string: _GetVirtualMachineType
Source: ISRT.dll.1.dr	Binary or memory string: _IsVirtualMachine
Source: _is23C8.exe, 00000001.00000000.1662044743.0000000000471000.00000020.00000001.01000000.00000004.sdmp	Binary or memory string: hgFSd
Source: ISRT.dll.1.dr	Binary or memory string: AddIconCallDLLFnComponentViewCreateWindowComponentViewDestroyComponentViewRefreshComponentViewSelectAllComponentViewSetInfoComponentViewSetInfoExCreateFolderDeleteFolderDeleteIconEnableHourGlassEnumFoldersItemsGetCPUTypeGetFontSubGetHandleGetPortsGetSelectedItemStateIsEmptyIsNTAdminIsOSTypeNTIsObjectIsPowerUserLangLoadStringMessageBeepPPathCompactPathPixelPathCrackUrlPathGetDirPathGetDrivePathGetFilePathGetFileExtPathGetFileNamePathGetLongFromShortPathGetPathPathIsValidSyntaxQueryIconReadArrayPropertyReadBoolPropertyReadNumberPropertyReplaceIconShowFolderTextSubSubstituteVerGetFileVersionWriteArrayPropertyWriteBoolPropertyWriteNumberPropertyWriteStringProperty_AppSearch_BrowseForFolder_CCPSearch_CHARArrayToWCHARArray_CalculateAndAddFileCost_CleanupInet_CloseFile_CmdGetHwndDlg_CmdGetMsg_CmdGetParam1_CmdGetParam2_CoGetObject_CompareDWORD_ComponentAddItem_ComponentCompareSizeRequired_ComponentError_ComponentErrorInfo_ComponentFileEnum_ComponentFileInfo_ComponentFilterLanguage_ComponentFilterOS_ComponentGetCost_ComponentGetCostEx_ComponentGetData_ComponentGetItemSize_ComponentGetTotalCost_ComponentGetTotalCostEx_ComponentInitialize_ComponentIsItemSelected_ComponentListItems_ComponentLoadTarget_ComponentMoveData_ComponentPatch_ComponentReinstall_ComponentRemoveAll_ComponentRemoveAllInLogOnly_ComponentSaveTarget_ComponentSelectItem_ComponentSelectNew_ComponentSetData_ComponentSetupTypeEnum_ComponentSetupTypeGetData_ComponentSetupTypeSet_ComponentTotalSize_ComponentTransferData_ComponentUpdate_ComponentValidate_ComponentViewCreate_ComponentViewQueryInfo_CopyBytes_CreateDir_CreateObject_CreateRegistrySet_CreateShellObjects_CtrlGetNotificationCode_CtrlGetParentWindowHelper_CtrlGetSubCommand_CtrlGetUrlForLinkClicked_CtrlSetHtmlContent_CtrlSetMLERichText_DIFxDriverPackageGetPath_DIFxDriverPackageInstall_DIFxDriverPackagePreinstall_DIFxDriverPackageUninstall_DefineDialog_DeleteCHARArray_DialogSetFont_DisableBranding_DisableStatus_Divide_DoInstall_DoSprintf_DotNetCoCreateObject_DotNetUnloadAppDomain_EnableDialogCache_EnablePrevDialog_EnableSkins_EnableStatus_EnableWow64FsRedirection_EndDialog_ExistsDir_ExistsDisk_ExistsFile_ExitInstall_FeatureAddCost_FeatureAddUninstallCost_FeatureGetCost_FeatureInitialize_FeatureSpendCost_FeatureSpendUninstallCost_FileCopy_FloatingPointOperation_GenerateFileMD5SignatureHex_GetByte_GetCurrentDialogName_GetDiskInfo_GetDiskSpaceEx_GetDiskSpaceExEx_GetFont_GetGlobalFlags_GetGlobalMemorySize_GetInetFileSize_GetInetFileTime_GetLine_GetLineSize_GetObject_GetObjectByIndex_GetObjectCount_GetProcessorInfo_GetRunningChildProcess_GetRunningChildProcessEx_GetRunningChildProcessEx2_GetSelectedTreeComponent_GetStandardLangId_GetSupportDir_GetSystemDpi_GetTrueTypeFontFileInfo_GetVirtualMachineType_InetEndofTransfer_InetGetLastError_InetGetNextDisk_InitInstall_IsFontTypefaceNameAvailable_IsInAdminGroup_IsLangSupported_IsSkinLoaded_IsVirtualMachine_IsWindowsME_IsWow64_KillProcesses_ListAddItem_ListAddString_ListCount_ListCreate_ListCurrentIte

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F5222D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F5222D

Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe

Code function: 2_2_00007FF6237BDEB4 GetLastError,IsDebuggerPresent,OutputDebugStringW,

2_2_00007FF6237BDEB4

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F5551A VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

0_2_00F5551A

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F20CE0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00F20CE0

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F55CC5 mov eax, dword ptr fs:[00000030h]		0_2_00F55CC5
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00515CC5 mov eax, dword ptr fs:[00000030h]		1_2_00515CC5

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F5A39A GetProcessHeap,

0_2_00F5A39A

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F5222D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F5222D
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F4CF12 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F4CF12
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F4D112 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F4D112
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00F4D2A4 SetUnhandledExceptionFilter,	0_2_00F4D2A4
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0051222D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0051222D
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0050CF12 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0050CF12
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0050D112 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0050D112
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_0050D2A4 SetUnhandledExceptionFilter,	1_2_0050D2A4
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C9CAC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6237C9CAC
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C6224 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF6237C6224
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C6764 SetUnhandledExceptionFilter,	2_2_00007FF6237C6764
Source: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	Code function: 2_2_00007FF6237C658C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6237C658C

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

Process created: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe "C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe" -embedded:EEFDEB78-A81F-4EAC-839B-C4BCB6470B9F -IS_temp

Jump to behavior

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F43200 __EH_prolog3_GS,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetTempPathW,

0_2_00F43200

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

0_2_00F43200

Source: ISSetup.dll.1.dr	Binary or memory string: ?OPTYPE_PROGMAN_FIELDSWWW
Source: ISSetup.dll.1.dr	Binary or memory string: ISLOG_VERSION_INFO..\..\..\Shared\LogServices2\LogDB.cppOPTYPE_PROGMANISLOGDB_USER_PROPERTIESD

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F4D3C8 cpuid

0_2_00F4D3C8

Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\gemalto48.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\gemalto48.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\gemalto48.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\gemalto48.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\1reader.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\40LE.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\EzioBLE.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Typical.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Custom.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Application.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00ED2D20 CreateNamedPipeW,CloseHandle,GetLastError,CreateEventW,WaitForSingleObject,CloseHandle,new,CloseHandle,CloseHandle,CloseHandle,

0_2_00ED2D20

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00F4D572 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F4D572

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe

Code function: 0_2_00EC2400 GetVersionExW,

0_2_00EC2400

Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00EB10E0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	0_2_00EB10E0
Source: C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe	Code function: 0_2_00EB1040 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	0_2_00EB1040
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_00471040 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	1_2_00471040
Source: C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	Code function: 1_2_004710E0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	1_2_004710E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	Boot or Logon Initialization Scripts	13 Process Injection	1 Access Token Manipulation	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	13 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WebSigner_SuiteMSI_Barclays.exe	0%	ReversingLabs
WebSigner_SuiteMSI_Barclays.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISBEW64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISBEW64.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISRT.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISRT.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISSetup.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISSetup.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Xmessage.exe	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Xmessage.exe	3%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\signtool.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\signtool.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://www.flexerasoftware.com0	0%	URL Reputation	safe
http://logo.ve	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	_is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	false		high
http://www.apache.org/licenses/	_is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	false		high
http://www.symauth.com/rpa00	_is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	false		high
https://mozilla.org/MPL/2.0/.	_is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	false		high
https://opensource.org/licenses/Zlib)	_is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	false		high
https://supportportal.thalesgroup.com	_is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	false		high
http://www.gemalto.com	_is23C8.exe, 00000001.00000002.2923886870.000000000140C000.00000004.00000020.00020000.00000000.sdmp, setup.xml.1.dr	false		high
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d	ISSetup.dll.1.dr	false		high
http://www.openssl.org/)	eula.rtf.1.dr	false		high
https://supportportal.thalesgroup.com/.	_is23C8.exe, 00000001.00000002.2924656843.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, _is23C8.exe, 00000001.00000002.2924765043.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, eula.rtf.1.dr	false		high
http://www.flexerasoftware.com0	_is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/cps0(	_is23C8.exe, 00000001.00000002.2923780076.00000000012F5000.00000004.00000010.00020000.00000000.sdmp, ISRT.dll.1.dr, Setup_UI.dll.1.dr, ISBEW64.exe.1.dr	false		high
http://logo.ve	_is23C8.exe, 00000001.00000002.2924247309.0000000003930000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428711
Start date and time:	2024-04-19 12:55:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WebSigner_SuiteMSI_Barclays.exe
Detection:	CLEAN
Classification:	clean16.winEXE@5/47@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 43 Number of non-executed functions: 260
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISBEW64.exe	PathWaveBenchVueDMM-2023-1-Setup-Basic.exe	Get hash	malicious	Unknown	Browse
	Nexus58_driver_cert.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISRT.dll	PathWaveBenchVueDMM-2023-1-Setup-Basic.exe	Get hash	malicious	Unknown	Browse
	Nexus58_driver_cert.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISSetup.dll	Nexus58_driver_cert.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\1reader.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PC bitmap, Windows 3.x format, 209 x 338 x 24, image size 212264, cbSize 212318, bits offset 54
Category:	dropped
Size (bytes):	212318
Entropy (8bit):	4.79068125174595
Encrypted:	false
SSDEEP:	1536:bmIoYHQeXPmtyu6tIgrQmWRZ4XEF/OeYtqQw9t3dVe:bzPygHc/OeYtqQw9tK
MD5:	54A78E9E9425552D9D7B6C6AF8B53291
SHA1:	AC9F618FC2FC670E7C9B2AB05F6C0BAA4C873CBA
SHA-256:	6B54A2F93264B546277D851CE3FF94BD2BC9460D577544B3CA204A3FBEC29E25
SHA-512:	259504F7D0A0EB9C3FBD772CF02D66144C27AF52E662C1FB85815E795BC077B2CB15D6DA771F9079E5FB0795F59C2D02AC32778E428E31554B321B5D0F769304
Malicious:	false
Reputation:	low
Preview:	BM^=......6...(.......R...........(=....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\40LE.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PC bitmap, Windows 3.x format, 193 x 183 x 24, image size 106140, cbSize 106194, bits offset 54
Category:	dropped
Size (bytes):	106194
Entropy (8bit):	2.720687192031943
Encrypted:	false
SSDEEP:	1536:E9fAclyd1vgIXID/pI5LIiwqhkYjcXkvnpw3ecHT:0Yclyd18
MD5:	A4A7B646270B6E19F4B850404733BFEE
SHA1:	D9D393BC3A1B47FACD4039D29A352BF5EDCCD66C
SHA-256:	1B470E24DCF84FBA748FE33A4E0C1A61FB5803F481FC55E8B9B97A383E512EB0
SHA-512:	8474784F540AC29FF21B96BE02DF2185C281135D25189DE0FB2A70D99FE06198E2366D15DC1E2687E7276C84045919E521BF881987364C3AE66F12F855BA794D
Malicious:	false
Reputation:	low
Preview:	BM.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Application.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 47 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	7.917734280322567
Encrypted:	false
SSDEEP:	48:o/6Bxy4lYT3qV2a7WB32HU/EsZ5m4t3kODuOnjae/7H09wz2DyL8/LmLkVJK31hc:oSBxtaTWhcWXsZYg3bube/7HqXcovKPc
MD5:	B7562722E5218EFA4B4ABBF70725B8D4
SHA1:	5647FD4E44527CA2ECA6746E0FEDBD4A998B460A
SHA-256:	2F160F74D10BD366B022FB3AC8FEFA6783A925633C5C0511D44FE3B5B83D83C4
SHA-512:	C0A1DF973B8F28F0235FE684137F90670055D7A75BD57B28FEED8E5614F0EA26A46978CD8DA6A1D930C35FDEBACFA845E7B371696DFB2E5B6901B525859E79CF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR.../...3......3QL....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..ZKl.W.....?c;.j.6....U..))!. ...Q...v..u...+.h...R!.K.!.HH...JAUUJ!]...(M.:N..;1..}}..9..uf..\.A..i\|.qf........kB.p.n.n....n......p._{i..X.`...P.-..X.....5.m........{...?...z`..;.\|3s.....9..y7..V........{.L..x..........}.?y...u...9..`...0..J.]C"./HT........JG.=Z.{..s.....VV..^%P........I\|.#...............l2..?...y!.0Z.....e....jI...@#.#Bm...m[......>......B......FU...UG[...<o....."...../.......m.,w......@.8KgqM....b...Z..x.M.....-d.......}....:...p...M...s.#.4.Dl...!..e2.5tnx.:.<d.(..O..'..:.3~X,n.....z..-....A...@./h...#G.7..;.<.'..f..m.Q...........UW...$..H.$.b%.....%.......<~.}5.v.H...~..}.. S.IX.6..?......}.Y.#..u^.*2.I....X:T-.#.$../..W. ..$Bb...yo:.\|..5T..@.......hd..[.U..3.....@(..-.=.#.f3.....5.... H.\.B.-....=L...7E..I....fj.\|.....$.H.>i.I.>......i..$.WZ..].Q.......h...&..K).g...pJ..6J".....L.\|..e..5}!.6I.d..M<.S.O..j..o4....RO.%

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Custom.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 59 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.9340424811774914
Encrypted:	false
SSDEEP:	96:OSBEcovLMuvMQTys5RIxIHEglEJ9yTLGVY0HMrlMl:OSOcovLMuvMts5QI5yJ9yvEsrWl
MD5:	2C2D11D76ACCCC73633B7782D430DDB7
SHA1:	3449C08F23DA8D657C075A66394FCB9530450954
SHA-256:	5E25814B728687E17C31572DA4B93CD6BA34E6D30C9760FDEDD8AE8598DA7720
SHA-512:	DE556D4ECB5C830D81DE149E889D9B67AA613118FC4FDE19660F38C989962C408E65209D5C746514C35A0F4237D8F0E76F1F3F660E5ED5DCD6A6BB001ABC6BE5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR...;...3.....)vp.....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.pT.....nH .A.D@.G.(.(.Xp.lG!.TKu..P@[A..Z.X.h...Q.Xi.R.P..L[.<...P.(".....<6.{.=..s.{.n.K....=.3..s.9......g.)%\|U...P.t.....ya..}.... .\b.......j..l.2...U.U%G.\|V.<......%N^.......>.=....=...........:.:..#..m...n.aY.\:........u...z..b.0...3..`...'..Q..p.N..u..$pj.I.7R.~...k.<w....g_EqZ6k.T..A..h...IRQ.G.J...VU2..1P{...S....]u..1.~W.ER..=I..Tf.3o..CSSc..=.i...@.\..3....A.6K.o.uF.....`......B..i.......A.}...w.q..h$........[...b.<..!n...$a..<.*.Y.D....z...Pf...7@$F.....I...'Y..:,..<G....04....F..f.5.s.... !.w.........oI.......Y...C....'{`....m...pV.x..E/._....l.r.n.um.:h..U...N.....X#....!.n.[0.wItnk> )+....4xp..g..j.%...G.Cf(...s`...0e......V...wM..9[\...j...0..%-"3C....Z.&/.Mm..m..n..W".Z.ZI.k7.n.2.23..H}.`.q[.2..;...&.........A.....!I.8Gp.......]VW...v.S.g.f......7.[........^....%....n....HIGO./"2\.."&.Map.......I..%x`....+[{..c.>T\<g..

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\EzioBLE.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PC bitmap, Windows 3.x format, 399 x 55 x 24, image size 66000, cbSize 66054, bits offset 54
Category:	dropped
Size (bytes):	66054
Entropy (8bit):	1.0171720269723423
Encrypted:	false
SSDEEP:	96:sB7U1+6jPAQhQoy+hqhx2dR5Tx56GjVrgdWXyZO7gfZcWXQWXOSr2MT0l65IYZJU:vd
MD5:	AC74F17963C8D9F061A0BF83FD05FF16
SHA1:	EC09F2F54C95AD7EEDBC7B2E9BB9ABB573CCCDD5
SHA-256:	495AD32760185A0AA33D5C844F7841A7D0B8AF9200A80C31A64F9A54A9D02FCD
SHA-512:	C97403918E52B5E059F6DA392FD95180560805D4940538690C5DAE17A8B5CEA1BD441E9483D7710EB00B0FCEC474069E5DBCBEC01B0BC39E039655D5E8ECA0C8
Malicious:	false
Reputation:	low
Preview:	BM........6...(.......7.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 37 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	620
Entropy (8bit):	7.47932737435809
Encrypted:	false
SSDEEP:	12:6v/7ND/6Tog8XMl8iUnGTazYbDJ3/whlQSRWT68davud7jz:c/6BxZUGmzCDZNSREb
MD5:	80582D4A22429E1D5AD512A2131361B1
SHA1:	18B3E0A3F74E9CD4F27BDB5B4358E540B8DC093A
SHA-256:	84A93202B47055C01412F0A485BAE56A187BE0AEA99DA9A91916FC9E76E30526
SHA-512:	F2DD048E2ACB5CC1B1520E61B87B92BC80DBC231370CB0FA595B5E48AF8ED8808AB7E135150891F93C03E9785DC07F1A45446643F90C8981C9F0B98AB0AFCFB6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR...%..........Y......pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..K.@..s.."B;.h.v...Z\:.tpshq.....]t.....C....D.\O.B.-.J.TjQZ._j.P.k...=.x!...w..+2MS....1..%..._.{_..v..}...mp..,.&...<.+{......VA.....{)..2.@..fW..\..m.......E.9...........J^.<M....H......#0....a...(.....:......h-v.1.0..Z..J.L(...J.....l..s`....S.K.zJ...Q...F..$.e].Z.P..U.V1..8.F....P..5.Btx..t........(G(v..`..de.R..Y.+.".#..2....+.pm]..l.e...J.P.$..8...<.5.Q.P..eb..2.mrv...+U..y..l7.#TasI'./.L..D..*.XP%N@..........\|C..KH7#.{.....8t.iH.!.\|..A...w.C.?8....P.J@./~.......x......IEND.B`.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\GBDM.rtf

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	78277
Entropy (8bit):	5.018317951652924
Encrypted:	false
SSDEEP:	768:/1JW6eZAGSk49mebE1ag9FI6ICnoSseQOMjjv0dp+IHvVR6Tv/JJAJFJtGU8EKen:/emXVjm
MD5:	3EAFA59668EEB751792467F428BB807B
SHA1:	70A8D4591FE1CA4E03BEDDD2C744714D3992C8FB
SHA-256:	15075A5EE41B2EE5A849954B81D738418F4C1FB1DD816E3FB137BA8F979DA64B
SHA-512:	068AEB08658CCF6185D897FC34DEDD32331FBB76311CEF696C05F26D3E0370921DBE90B93B0DD756D407E01C06DF3C127F99EA5916B43EDE640A25B45EDFEC72
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1036\deflangfe1036\themelang1036\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\f40\fbidi \fmodern\fcharset0\fprq1{\\panose 00000000000000000000}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fr

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISBEW64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	183016
Entropy (8bit):	5.751899917626374
Encrypted:	false
SSDEEP:	3072:VIFNKUw8ALJ+C2T0FSmmiYQT4zF2E+JYSdeZ2bgA/qQ6vj:vUn0mT8Sc/T4x1b0xg84j
MD5:	FC6B38A02516871EC641E99FB18F448B
SHA1:	58754875D6B068D4C076363531674B5D8164E4DC
SHA-256:	9419696372F4460FDC12D96ECD9F3A9489E9070CCAB7CCA4B51602C051DB31BF
SHA-512:	9A9BB2AD036BA9141FE312AB199ED2EB75BB132F69CB4B1FE98F4DAAAC8698DEBF2F72FC4B7969B1386FD849EF857E6861F66B14CF43A86328CFBAC3617C6B98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: PathWaveBenchVueDMM-2023-1-Setup-Basic.exe, Detection: malicious, Browse Filename: Nexus58_driver_cert.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.*.!.D.!.D.!.D../..D.D../..(.D../....D.... .D.!.E.[.D......D.....%.D..... .D.!.. .D..... .D.Rich!.D.........................PE..d......].........."......X...v.................@.........................................`..................................................J..........`.......$........ ..........`t..8...............................p............p...............................text....W.......X.................. ..`.rdata.......p.......\..............@..@.data... B...`.......D..............@....pdata..$............`..............@..@.rsrc...`............v..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISLogoBig.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 100 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	7.873980167633021
Encrypted:	false
SSDEEP:	48:6/6Bx9Q7GbedZecHGF39sqCE8vIpJckD3yZ5dC:6SBz/yCcHGtCE8vIpJcMenC
MD5:	04FF43EFF306751E225EAC0C0D9AE6BA
SHA1:	BBA8A277930659563EFEBE42E1CFC77F16D45192
SHA-256:	995FF2F37E8688D9D65AA1219753A01078FB3CBD17B75B114AF56A61E3B63988
SHA-512:	A989D83F5E9C57EFCACA3AA8E146F34B19FF45E197C27B8A6D87C7EF38E1FD4503AF7C5583C485BBB81450DD86A82482635721FE8462B36445705A4040FB9F68
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR...d...e.......F.....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}LUe...]W.m.(..@o..h*.....j.T6...H...R.m..6..m.s...R.[..9K....2.KB.D71..J.....};.s...v.{..=......<.....W2.c.P...9.JC@@HaL..?......C.b........\|....L#e.F.y....".B" ..D@..y.t....8D.S....8D.'.f..&Q...=.7......nE..f9C...[.[.d.E.....C........D@.TiQ....C}?qd.]p....=......l..86.w....?3......cUa......91.daF4....EA.=7........@0hk........3@...q@........G..}8..d.2J....0#&1..d..W.g....('-......_.Oo.S.o;%.8..2...2..QYI..\|.s.;R..'.~.(.Ni...jb...k.....M...o].2.9.x{N..L2Y.B.j.u.`.'x]...d..I...:..agG..r..=...{.C...:8Q-(....`.u.."0#.HH@.......?,.....XI.r...Ag]8..$.`R0h\|.Z.>..`..)i}C...`..I@."....!....kV..PG.....N..R.....e@H....~.%..W.yu.@v...M%{'.b.........&.IkD......#...t\...m...5.qA9....ly..'....*tC].....Z..w2.......@......y.wJ.+...d6{rF..]......o;7.D;[.Lj.%/...&[......+.)..K.d...._]@`......sTz.....B%V.O......@6...^.9..../7.....o.......e. ,S..[q..

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISLogoSmall.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.704601238804259
Encrypted:	false
SSDEEP:	24:8/6B94nwJezZEEkKnz1jf+Af6g+dw1Jg4tqH5oaNAfSo2gBs:8/6B9HMNEE9z175f6Bdwv/qHyaN4S13
MD5:	0DE9D9BD4AE583015157D5D3BC77801F
SHA1:	6201C31BADAB2C50FD0C619704622E0E0CAD9F5E
SHA-256:	3039E1E23AFC42BD3C07A8F4B65FB5D0377CA70F9F4FFB6FD7E7F33D82D837D1
SHA-512:	B393AD1DADB60723B6032C0DC6CB9C50709B516C5F5D414B788E79B944E8A4C988C2425798F4A9B8BD05BC6D18F37CB3FBA55CE93228E13D38E974EB18EE3BA2
Malicious:	false
Preview:	.PNG........IHDR...2...2......]......pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b\.r....L......g.....$.Z.&>xCkx9.........$...E...<..,5.......a..9...2..H..p(..c.f....Y.l.K..}. \w%1L...:.s..hm.g.b...qg.#..,LU..@..L.B.5........B.@'...,...r40.............o.-;..{...o>.@S`#-.....L.B...o?........&s`..F..."0.{...y....3...p6W`Xs.....DmAh2..b.LU.... P..r`.D..[.<..?...%...f&.kU.LO..\|..5.R-.....C_...-.A...d..>....-kE.l.(r.0^......l...pAsQ~+..=%QHz.c.P.....@.H.Z........\`a....O.~..o..'h4....-...y.g6.G1....Q.....0...v....0.)l.0+Zd7.9......7..9k.k...NX.S.u..7.#..@s....KZ.ws....>g...d.0....W.....'.......R...k....0sVg....&>Y ;.X.aU...}`.8....e.....`I.71aF<..a..V...&..?......5...3.....q.t..h.....2..o yxb.0.R.8..v.....0.g.....[...c..@.]...Y<i.kq.L..'D`.>9.J....{..K./.9tz.+...ng...t...;/..-Z..R1.H...B......\|-01.c..}@..@.^....\.`........3...`....X'..M."i..g$....Y...m.*...B.X..h...@`..........o.z...b..@.G&....Um.....6.H..J.p...p"...Lp.h."`...#k.'..u...........

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISRT.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	436968
Entropy (8bit):	7.970462355107799
Encrypted:	false
SSDEEP:	12288:dquBBoy1WkagdDUwknDIPBVn+ClyIf/J+fHW:8ywkBhaIPBVJl5nEvW
MD5:	6142481421BD6CC14ADDF9606137973D
SHA1:	97686F0E3254C3C245256AE280ED36F9457B3EC2
SHA-256:	650D006D2F4F62D740D7D198F7FEBE201D3F528EE87E089958B5C4E1CD27E748
SHA-512:	21E9BD11B931BA20DFF2E30F3301FCB5FC119535A6428C175224E1A35E6C6C14B07F437A416D53787635CE8B8AA042D4DC514BEED41B0575591AE79C1592993B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: PathWaveBenchVueDMM-2023-1-Setup-Basic.exe, Detection: malicious, Browse Filename: Nexus58_driver_cert.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A.YA.YA.Yf.mYG.Y..nY].Y..XC.Y..mY@.Y..mY..Y..lY..Y...Y@.Y...YE.YA.Y..Y...YV.Y..lY..Y..iY@.Y..jY@.YA.4Y@.Y..oY@.YRichA.Y........PE..L......]...........!.....x...@...............................................@......Ag..............................p.......t...........h................ ...0.........8....................................................T..@....................text............P......PEC2MO...... ....rsrc....@.......4...T.............. ....reloc.......0......................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISSetup.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1628672
Entropy (8bit):	5.912689265243494
Encrypted:	false
SSDEEP:	49152:hUiWx78RtgmwjQs4o6C5WZ/l0+VChSV9TE2:uZ8RtgmwjQj/HZ/+eCh
MD5:	4050114269619342AF2B3001406953A4
SHA1:	C9FAE87B5E7C0C4377F12D1DA3B4F01B233B4E3A
SHA-256:	80A16734E6E89BEB17B3D12164E49D5FA5D5806846E2529C653871937F5B9301
SHA-512:	9955D1B17F5AF35C5581CB1BC0E0B8DCBBC1C36E33E8BA071313165A5BDAD9613F24021D011AD6AFB323E848F5A2D8BE247428649D6A96D0C78DE493704B3923
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Nexus58_driver_cert.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........v'^..I...I...I.......I.\|....I.\|....I.\|....I.q`....I.q`....I..IM...I...H...I.q`....I./....I./....I./....I./....I./....I.......I./....I.Rich..I.........PE..L......]...........!.........p............................................................@......................... ...S............0...........................D......8...............................@...............<............................text............................... ..`.orpc... ........................... ..`.rdata..s...........................@..@.data....b..........................@....rsrc........0......................@..@.reloc...j.......l...n..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Remove.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 58 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1766
Entropy (8bit):	7.858990597945124
Encrypted:	false
SSDEEP:	48:N/6BglEcNs+cI4BltCD6MgbSFAPimHf27v4k7D0PReadiANU:NSBZcNSI4Blt5bogHf0v4k7wiANU
MD5:	A96BBEFB78F0C3DBEA0C24163A7071B5
SHA1:	E88BEF00865C1786CE35532F0BF06FFEDC4A86C7
SHA-256:	B83531648D506073C9E0A0481977EE378DE0D57EF2508145A7F23AF9E3344A41
SHA-512:	4263888FE08253E2334F8F50ED6E03BA76D077137521BD4F6B0DDCCC5824F9110C0E32B09E0D69FE6C66842B9D9661A553CE8E078515583779E1F91150FE4335
Malicious:	false
Preview:	.PNG........IHDR...:...3............pHYs.................tEXtSoftware.Adobe ImageReadyq.e<...sIDATx..ZKO.W.>..x<....Q.`.TmH...IU.%j.(.?H..:../.}7,..J.&R.I#U.T..EH.G[..=x...{...{,.J.c..tt.....s.\.P..0x8$....[.C...!.fP&Ko%P.....l..s..KKK...c.c.{{zA.e...8..uH&....17==..@...pRU..N..UY..a..J%.........f.666!..\|{..s...tqa!....8q.=%..C4..\6..K7K[.._..B..?....D................l...o}......=w....pUU'...@.\|......{...$J.....H.,...I....LB._nln.$I~\|}.c.e....FM..z..K....%p..]O@:..(..t.P...<t........W.....5.....>y..)...h.....\.d...2...T...@.$Q..-...+.....q..8...6Z@....7..-.A(..&.iBWw...H.=?{........_,.....iJ......"p..<.. .(.`.....t3]...&p6.6.).$m...M.^..f.. 9:. B....._\|.K\|+..$..>.i ..0.p.........$...c1.:. m.Q.....H.g.Y....@.=.P.;.G@....=\@].)...h..;..]...E-.q...TSB.Y..}......E.!S:b).H..SF..qpK.n........C..EB#.(?..x.....8.\|5.i.}..J0.V.._.E!v.3.&......e.%A@Vy.\|Z..?i.U)x..cu#.....u..R....m!.........W/.......T.5.2...w..!ip..L.LF........-dV<j.@%v!.....wP...v =

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Repair.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 59 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3160
Entropy (8bit):	7.919840334162329
Encrypted:	false
SSDEEP:	96:OSBhOktNWeePn34ZwudEYki0CeDjA5pI0hUG:OSnTNWeePYw8E1zCkapPhX
MD5:	260D3EDFC4ED042A8E152613CFC0D59C
SHA1:	E5DBE0736915D6E40F5DB8392C5001B57D98406E
SHA-256:	5B4CC813A251FBBE0C2EA6BAB31C512DA865BAA9B20FA61B46CA8A30D302BBFA
SHA-512:	5611AED5498591F97F6D145E36D106104317379D8A05436E169872CA52F354DB39972C1BBEB74C1E1AFF7779E7CD829D5631E3E7E5BAD7796D514B25CD549DCC
Malicious:	false
Preview:	.PNG........IHDR...;...3.....)vp.....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..yl.W...7...].q.'..:..&H..HH8..F..!U.J.(.......D.B.UHi.E.B.?8.PE.@"-j".@.B...@.ql.v._.>vw...}.....k{7NT.....fv..}...Y!..[e3...n).H97.....X...c...!@..+...M..cA.zO..;.~...........\|...M....\|v...u.uAJ.0.w\....4-...../=.G...............^.b......t...........<l.....x.....3......Q...g..$.'n....'.P..C.ah...+.......=.....W.45...$C<.x.......\RC}.....@;.....9.]............l.n.,J.......k..8..~.m.....MAo.i..P..k....^..hDxA..7R.R.kPj..........&..BC..&..lh.w..S......\|d.m.ra+....#.o...s"Y.../.Z..y.B.7.R...H....wWd..Q. p[....}5...=. ......=..N1...O.p....#.g....u.WZ......K...H.V?.:...A....bM..M.C.>.s...?...g..@...........X...:.r.......l.vBKT..........>.z...G?.v!$.4t].~x(.....+u6\|....5.%Kj..Ax.w.!..1.5.....5.BGTB..68$=C...4..C][W....7@....7....>..nG.@.vT.Tx..*k,.o..o=.....B..o...W.......77p.x(.E.....y.J......l..AJ...2.wB.......+.40.R.E..n.j..v...F.....r#g

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup.inx

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	data
Category:	dropped
Size (bytes):	79670
Entropy (8bit):	7.37547764849457
Encrypted:	false
SSDEEP:	1536:jSeiZO/9RNbESS9fbiiEt4HGjwlv/54rMhU6:jpiZS9RKmiEt4LJ54riU6
MD5:	63E9EE20B35DC23FC91F0A6AA6D3E3F4
SHA1:	E578E9B4C8D7BF02E1109BB4D6D7042D497DDAF7
SHA-256:	004FBA43413D533B95AF09F2C0284EEB488C382EA7EA3D3A2D127805EFDCCA04
SHA-512:	741528736AA0C339A6FF488790D08F33253CC819CF6E6209E753914644B6CF68D57748FC42ECC1105DE7EFA09D4B85DC74EA1F442EA8A87C2D67B1E7D90766B2
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}aGMmQFY]AV.M1.!!0)........................................}.m.m.au]}IeMm5U=]!E-M%5.=!%.-.......G.k.'.## T.....$.X..........x...}..4.....]i]UU.].....g....g.S.c+{.....7.k3L<.P(.L((..........X........Y..\|... ....1II.1....W.k[k.......#...d<$@<<........xh(.....p...H..}uuM}.8...s...%==.%c.woWG.{3;W33....L,@0T..$\L......x.$.....\|.Q..]q..h,T......MMM.5s.oCs....S.s[3#....L.P(.LXD.\H,.,.........\....X...y}}1e.,...s.w.Ss.=!!.)g.GsK?.........@hP,..........................1yQee.m.......{.8kok..CC.G.....C7._+[o`.(,(HP..H.....8.......p......}uu5}.T...... ...g.%%.-cW.W;k3KKKo7.....L ....H...(. <......e..l.....<...]UU.].0.......c_._3.S.....3.gK..0 .8$...D(0.H.....T...P..q..!q.(..$..@...,.c.cW.w.....W..o?.k'.3......h.l< \\H,..<$$T ..y.Qe..0...,..=Q..].o4....w...g..K7W;.......#.<4hT..(...H (. <.......]..T....0.<........5MM.5s.kc.._CWG.+Kc.....?.80dP,.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	927976
Entropy (8bit):	6.432430631858935
Encrypted:	false
SSDEEP:	12288:7BejzJoCzwNzqfZiCYEaMosQMth9F+52QXQVCid+JEG7SBFLCEMe:umC2wiEaMAMtvFnQXQVY7SBFLrMe
MD5:	6400100A51918A66E43E63049FAAF71B
SHA1:	737608EA45152BA40A74BEF5E1B4B3F2756B942B
SHA-256:	2C34F5032DD9794B7ABFA931D785281B6CA8111239009AC9B072D8C423602C25
SHA-512:	AD2C5C7B373697FE41895F65EEB8AFD12E910A1051D3086AEA0167A2BFEA00CB147EBB7CDC4C14148188079529C9959421D0D282EDAFD436827711E7EC535510
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......(...l..l..l...S[.}...SY.....SX.v......m......e..W...z..W...}......h..W...\..e.).j..e.9.w..l..~......q......m....U.m..l.=.m......m..Richl..........................PE..L...X..]...........!................EF.......................................`.......1....@.........................`...l...........`..h#............... ......h...P...p...............................@............................................text...\|........................... ..`.rdata..>...........................@..@.data....[.......N..................@....gfids..T....@......................@..@.tls.........P......................@....rsrc...h#...`...$..................@..@.reloc..h............8..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22153
Entropy (8bit):	5.556237125471998
Encrypted:	false
SSDEEP:	384:JVaXrX16Ggxyf4dCyZ2r7YGmb7fgECDJsE7hhK7SVrxwlNG7CMSG7CvJ1GJfTo7s:JVCrX0GDf4dj2JPhKrIx3uB7BmtIV9Xg
MD5:	25445F8616C400FA7CCA249BBE735748
SHA1:	59BD4FA45C22F0F2C7553C63E0B076B48B1650EA
SHA-256:	61F69AE665728A786828E65F8F329EDA5A41DB5C5D6AF01144E7DBF2D2A7AFD3
SHA-512:	470C7E3EE74A06ABF24461F231FEC0EDAE2DCDEE2DB34287292E255B28B6319AD214F69DA7ACE721E2E9E3B508386E278108932B7EFAA557542E96D7F57DAABD
Malicious:	false
Preview:	<UserInterface xmlns="installshield/2019/bootstrap/ui" ScaleFactors="150;200">...<Resources>....<FontSet Name="BodyFonts">.....<Font Name="Microsoft JhengHei UI" Size="10" Language="1028"/>.....<Font Name="SimSun" Size="10" Language="1028"/>.....<Font Name="Meiryo UI" Size="10" Language="1041"/>.....<Font Name="MS Mincho" Size="10" Language="1041"/>.....<Font Name="Malgun Gothic" Size="10" Language="1042"/>.....<Font Name="Dotum" Size="10" Language="1042"/>.....<Font Name="Microsoft YaHei UI" Size="10" Language="2052"/>.....<Font Name="SimSun" Size="10" Language="2052"/>.....<Font Name="Calibri" Size="10"/>.....<Font Name="Verdana" Size="8"/>.....<Font Name="Arial" Size="8"/>....</FontSet>....<Class Name="Header" Pen="0x000000">.....<Class.FontSet BasedOn="BodyFonts" Size="180" Weight="400"/>....</Class>....<Class Name="Body" Pen="0x101010">.....<Class.FontSet BasedOn="BodyFonts" Weight="400"/>....</Class>....<Class Name="BodyItalics" Pen="0x383838">.....<Class.FontSet BasedOn="BodyFon

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Typical.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 59 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3932
Entropy (8bit):	7.941643377438535
Encrypted:	false
SSDEEP:	96:OSBUmbti17Hq2MwVBhJSPxiVMHZJIM9Gfvgpv7nT+kMj:OSiKUK23X2ioZJJMgpv7nT+
MD5:	18E81590AD31A376D07F0356505E9C18
SHA1:	F79801FB955797AD8790184B1700D0228C642882
SHA-256:	E5CBE9FC7F2CCDA733BEDBD355DC14EEEE83303D14E04CE09AD5DD08B3359C4E
SHA-512:	B0799BB3F1D3118967B77D1CE953F3DDFAFF2389F31C0A09657A661F08F2F854669E9E472B8872BB24AE5BB90D6D84B33B9063B2991FDBC3B9A34A482BCEBA40
Malicious:	false
Preview:	.PNG........IHDR...;...3.....)vp.....pHYs.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.p....w..$7...%$A.(....j.. `..#.a.QPF......Hm.#....a$..\|.NA.-6......X.!..B..y..{w....9.w/..wT.v3'.{v.........^.4M..l\|.6WW?........L.E..R...cE.U~.....y..o.c...:>5k...........c.b...,..6q,..>..U...8.#.&.....hr..=`c%...-....Q...1..L..@1...t....a...........>...:..V....Q.h.....np......B...h~M.....<.....6we.%..,...hU....j.;...zd..U.+gd..9;....TN]..Jl.C.G..=n.j7..e;..'h..Hg....7m..e...7.yi..m.v.XZ.....K#F....,..... .....9+.{a....(...y%.....v.c.<.o]lhh..k......Z.>.X8L.c..g.$..E.uDo.u.._.z...g..;a..tE.$x.i.p..a}el4F..u.....aP.....b..e...Qt..Y.7.k<5.{.k..DTrDt..U...\....Bcc3TT..>}2.{....<..`....1.E....2i.`P.4.\|.r0.c..-...\Vr..9....V.M.dbVCC....p...(.....=0x`/...{.eh.0Z....d.?..+b.#U<.rw....h.....0..y..5...BB...<....V.y.n..-....B..uX..$..W......7.E-%e[S.b.l.8..Y.O....@...].....c..,..\|..G.).(H....u...hl`..`.HcF...9Z.4..m*<.p..%..)i.-g.@....}....@..)./.-&..

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Xmessage.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.244439963558431
Encrypted:	false
SSDEEP:	384:eKt1FH0CDLxnpVlFHzAHYV0ewoJ6ftCZR:eKt1FUgNzlwoJFZ
MD5:	975C4DEEC479BDDC701ED8CF150074B3
SHA1:	F8276D88CB375EB057B14836FA0B1B73EBD1C764
SHA-256:	A602B12EC70A2DFA928A95E646C540ADFC824E0FA67A0FEE7502AD9644C7CC4F
SHA-512:	B6392F35D881BEF7B83921A3A8DB85F476A4418856C6AE6E3352BAF24B568E347D866A2CED9BF2F95872F42FEDA940512E13CDAF81C5AA44984B1FDC3D1E7864
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 7% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......[.........."...P..,...........K... ...`....@.. ....................................`..................................K..O....`..............................XJ............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................K......H........%..$#...........H..p...........................................Z(....(....(.....o.......(......(......( .....(!.....("...F.(....o....(#.....($....s%........s&........s'........s(........s).........~....o....~....o+....~....o,....~....o-....~....o.....~.....(/...,.r...p.....(0...o1...s2........~.....~............s....(3...t.........s4...(5..........(6...^(....o7...,.(....o8...*.0..R.......~....-E~......(9........(:...~....-.(...........s;...o<.........

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\_is24E1

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9014
Entropy (8bit):	3.7602495449790565
Encrypted:	false
SSDEEP:	192:tVVLb08GhNKwlyLEtD1fdLTYVUkthCzHC:Jq+RLqD1fdLqVthCbC
MD5:	74DDDB1E51CA93A61A908243EA2EA945
SHA1:	08693206736E895DCDBD28EBC473D97E2B9C3492
SHA-256:	955A547F40CCEC5733371CDD54D8CDA9A657CF82D44F86E77C567B89394D4EBF
SHA-512:	2537E0E04E616EF40BBFD6D79816E0990591B1895F68A2C0E3F4E6C5EFC450B1DBFD5BA93346E11F46CACC3B71AD5FF1625434B73DA259410F663845686D8625
Malicious:	false
Preview:	..[.P.r.o.p.e.r.t.i.e.s.].....I.n.s.t.a.l.l.M.o.d.e.=.0.....I.S.S.e.l.e.c.t.e.d.L.a.n.g.u.a.g.e.=.1.0.3.3.........[.F.i.l.e.s.].....C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.D.2.9.D.5.C.0.3.-.D.2.3.1.-.4.2.8.0.-.A.B.2.D.-.8.B.9.9.5.F.A.7.A.B.B.9.}.\.s.e.t.u.p...x.m.l.=.Y.e.s.........[.F.e.a.t.u.r.e._.C.u.s.t.o.m.].....A.c.t.i.o.n.=.1.....D.e.t.e.c.t.=.0.........[.F.e.a.t.u.r.e._.C.C.].....A.c.t.i.o.n.=.1.....D.e.t.e.c.t.=.0.........[.F.e.a.t.u.r.e._.C.C.I.D.].....A.c.t.i.o.n.=.1.....D.e.t.e.c.t.=.0.........[.F.e.a.t.u.r.e._.e.S.i.g.n.e.r.].....A.c.t.i.o.n.=.1.....D.e.t.e.c.t.=.0.........[.F.e.a.t.u.r.e._.W.e.b.S.i.g.n.e.r._.B.a.r.c.l.a.y.s.].....A.c.t.i.o.n.=.1.....D.e.t.e.c.t.=.0.........[.F.e.a.t.u.r.e._.G.B.D.M.].....A.c.t.i.o.n.=.0.....D.e.t.e.c.t.=.0.........[.F.e.a.t.u.r.e._.M.D.].....A.c.t.i.o.n.=.1.....D.e.t.e.c.t.=.0.........[.P.a.r.c.e.l._.{.C.8.0.6.0.0.5.8.-.5.2.5.1.-.4.9.6.8.-.8.E.A.4.-.7.C.A.E.6.9.6.9.1.F.7.E.}.].....A.c.t.i.o.n.=.1.....D.e.t.e.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\addExtension.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PC bitmap, Windows 3.x format, 152 x 52 x 24, resolution 3779 x 3779 px/m, cbSize 23766, bits offset 54
Category:	dropped
Size (bytes):	23766
Entropy (8bit):	4.627080165762752
Encrypted:	false
SSDEEP:	192:Pr4V7k+9KIHgkqk626VaIAEVOUNStI3AMoSXY:z4ek/HgdvZz5VOHtI3AMoSXY
MD5:	D4A6FB8E8C69D5A29D3AD2B88D2DF629
SHA1:	19E2CCD49B0197E882173957BD74D62AC515CFB1
SHA-256:	8D397F35C16FA96D4A56E0D05930ACA16AF121F072431D2650306AD7449F6188
SHA-512:	BE0CAA933705376763E1E3A973BFDB74A9399502EEF8A60B9F01275169AA63B08D9DAE57D065859BD9A2C1DE352D928324292D50ADEA47FD1F619E9A7079BFEA
Malicious:	false
Preview:	BM.\......6...(.......4..............................................................................................................................................................................................................................................................................................>99........................>99..........................................................................................................................................................................................................................................................................................................................................................................................................................................(#$........................%!!.............................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\eula.rtf

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	126694
Entropy (8bit):	5.194344968900601
Encrypted:	false
SSDEEP:	3072:VseX+IZ+YfEBy5DM37J9JtlXOSNc9OMTDlhK9jiYCDz:h/+YfOZtlXOiyhz
MD5:	342A53750A9D93AE3B9BE13A904064FD
SHA1:	FE56962DFABBEEEC19E22F1F0ABEF68FE7480682
SHA-256:	582218EA11A4600450C1FB6B9DA7BF416BC8A8C48A398DDCFD8F4B774335E123
SHA-512:	4AF1713CE1A7A73895C8BBD5C6BC8C13E954ADAFE57EBBBD1EFBE2E626767F4172A8820C85E9BA2003224AC9D5F0E719C8BC91D21E89E31459A413BDD6B3241D
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1029\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0302020204030204}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Rom

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\extensionOK.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PC bitmap, Windows 3.x format, 344 x 198 x 24, resolution 3779 x 3779 px/m, cbSize 204390, bits offset 54
Category:	dropped
Size (bytes):	204390
Entropy (8bit):	4.40753311126912
Encrypted:	false
SSDEEP:	1536:4hMMUYU9999998t9999999999999999999H99999999999999999999999999997:4jo11bOA5v6
MD5:	64A4F560C6A5034D0B6014361BFC21A8
SHA1:	BCB36C8B1EB82FEC40ED494F88107A9C50BB334A
SHA-256:	10FF3C5EBC089ED5EC30CEEB8B968C05BF648FEAB2F8A2D18A7FB18E204102F5
SHA-512:	014DD17822BE6FB0158E9971FDD4BE4A49E08EE02E2C35F983683FBF1F7D4BC4F6556194EC5EE3DA65A67CFADAE607E31882F9DCD677ADF3116646361AC3263B
Malicious:	false
Preview:	BMf.......6...(...X...................................pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\gemalto48.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	7.85825458770264
Encrypted:	false
SSDEEP:	48:IM0W5zbdfhy1nLbo0EhqYOw1C7UAuVQEEqAsL:35tdfk54qYVY7VuVRAY
MD5:	AF59B44E26F8772206188C03E8F8F8D7
SHA1:	DD175E75CDC34CA05782EBCBA6297CDD19D251A9
SHA-256:	5EED99BCA0D1B646B3285AA84AFBE819D5A5D988A6C08F3640AB15141872B903
SHA-512:	AF8DE6E76154C6C7040055B146360CFD72367C60FBE6F573ECD465CE0160D4CAF12121286ABA16702E908FF72FDA6411AA81886C9B2CEDA546FAC40F68A055BD
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..X.PT..>....]....!K..@$....1>......&.&c.T.@k-..L.....c..m.&F...:.....U....7....>..}.....w...g.{.......'.!..X..{..JE....K....o.I.yT+.\|.........\|f.R...7.n..#$ER......$..i......!....../$..Qxb....0.\|.Y..tr.E.G...-x..c.m1..3j-.9.._.=....[.?..S.P.S....<ao8...^....d.f....7.Vu......n;......qQ....t4..h.`eu.....X....r._E..I....2..^.........K..@G...v6%.=..,.......)....Z3.` ....[.....>....;..w......L..-{.F.!.8.. ...a...(n.%..PZ...mQ?.........g.....g...Dlz#1.....!..1i....#.........@$bHJ...........X...2......Y.L...3..R5.hC7........G..ki...2..b....v..h.L......n..-..x..pT.eCK..@..X.....:R..+ U..'+t]_.`o.h.hN<s..^.S.o.`.n.M..h....b.&..\|`-.s..O..}7.z.o...4....Ig.....jll\|R.ky...{.>.U.....lp..[....h.....(.o<Y.....0...x(.:.-..xL'..bG._:>....fe.l.'.N.....JK?]......b.7+.B..R...e.`(.)=.....2.....k...7............~..z.....)..ha..........2....kkjS...............A....M........../..

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\Application.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 61 x 69, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4260
Entropy (8bit):	7.942367623306922
Encrypted:	false
SSDEEP:	96:Ym2UwQ4wmqsePU+EA0lWhtXZqbTonlkhy71RwcSOVdz0jdUjqSZ9h:bmqHMvAB7XgTHhy71KEX0juT9h
MD5:	46B2EB6C23572DA87ADA5A342F854641
SHA1:	A7F8188701C82DC7EB9D5F5A2B7FE2348AB462A2
SHA-256:	016604E80FFC9921EE9CA036B6DDE317094C9D1CD8BF4928087317C708EB7C84
SHA-512:	9377719AA40E352EA47002FDF9264A461E292CEA2CD21840F792409F6E6A59786D10234C3F8762C1E347618B2243DC6B604645A39A8CDDDC1328D391FE7407FF
Malicious:	false
Preview:	.PNG........IHDR...=...E........E....pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<...1IDATx..\[l^G.....%.c.....)jI/I)MKK..P.V...<.x...R.z.T..U..JA..B.T..@+..U...AKC/m..6..9n......23;.g......I.....{.3.....Z...w..o.@.CO.\|t.k...Z.Q..?..,....f....,...K...._..h....>....,....Y.~z.K....4.h.:[.ho)m..S4h..ep...I@.1.........>mJ6....9...>..}Z>O...?......p....6.R....}. x.(....^-...O0M............h.$l#.5.7.8..xI.....O....2....}.A;A.p6.J..<o...=y.:I....U..<m.0.....r!...M.z...IO.#......Mr..a.....Y\|F....h.':E8._................Q.n.I.......\|.>(mg..x.......m I..-..]cU7A......6b.l..8.y..P.,.....'.I.:.3E...w.5J..T.T.W..lX....S.T....y.Q.2.p..9.cn.>..A...Y.D.T...a...f.2.$.FSLV.J:.j.B..8..Q....W..y...O.H2..\..#>.....r......%.8.......~Y.c.(...Yi{.....#.N.G#c.4ez+.m.y..\..K....j.6m.1}A...(.D...6..._......a.L..b..3n..Z.b7.....].'.VGI... N...Ww...z;..:..pN......)..E}<....l:1l.m..3.N....r.'..F..~<...3.8...SHy"..vKA%...`....<./&ib.i.bJ@....b..jf.....k.l....cc".(.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\Custom.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 78 x 69, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6044
Entropy (8bit):	7.9451860868796595
Encrypted:	false
SSDEEP:	96:tmVOnl+3YAzkUN1KKlUpfHT4jBGADFxNPa/v7jEFBH4w4wtyBpLCD:MAn4IAzdvKKlyfEdDJPaX7jELH4wTtyM
MD5:	41404BDC8ACC738078A96E03836A7017
SHA1:	CF09E2F6454A20089B809AF16C775ABB38907907
SHA-256:	2760DC6DA4DA352973B99D8209E54DC68C679D8C2800408F6D9481E03D9D3D9B
SHA-512:	14C218AC361BDACBDD1D67BF6AA58E6BA81700B853B295E8606D6722F4D48113D9FFC48C74B41EE0D125B3B433A9030769DBA00CE4666FF10F4DF185B7210EF9
Malicious:	false
Preview:	.PNG........IHDR...N...E......m......pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<...)IDATx..\.p.U......@..........D...u.1 >(....Q...q.Q.t.UkW.-....d.]..8J.QG.......O.U$<.. ...s...sN..}o ..ve.u.}.vw......88RJ..x...f..[p.S....yc+..p....uA..8.:..s.5%.v...3...].G....~.....u.1.........'y.... vw.X.7.....G.............q[.w.M..SX.t.9O..p.........6..y...}.?.....M..N.2+...0.....6...&...Hc......8.i.N..&-)..P..!........0......c.@.f.....;77.....I/]R2....9&...y>.6.N.8.@..0~s.....m...3.9.T...S..7..9......i........v...r...q.S`S.k....V\|]..[....SiC..p.$...G......w]2v.p.o...[..Y....o..q..S..r...L.y..;KW.U......8. <..i[.f.....1...E/...........'.....<..'?.8y..o/.qr.N...Uj........@.3..#......2.\|..z....Sn.m.....!....qs.8.m....n......{`.s...M...<3.@.e.To.v...M.vc5.[.B"..T.B3-W..)O.a....D..n}'.....T..9..a...G.e...8.._..z.q.T.m.T.r.l+.}..m.&...y..JX.a3.X.!.byx............h4.K..9..3...s..9(u}..?\|pd.....w.....m.>V..&T...r.....;:.0...k:..#..e..D..)t.h..`

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\Folder.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 46 x 39, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	703
Entropy (8bit):	7.595889559578325
Encrypted:	false
SSDEEP:	12:6v/7+tR5rAXrHXaCUH5xnwiSsU3pSgTFu44wjI1p1pq20edfOSSOTi5JM63SKClg:xdWHKC6j1SsUrTFtls1p62ddfN9lg
MD5:	F3F9575A23F7C4CD35C8324231F5BD9E
SHA1:	CD69AF64528F48A8DD6652A04D4FD1C930D63A3F
SHA-256:	2EE9AA1DDA88CD9964D342DDA3FE56164C9906D5441E8381297F4DCDAE6C3E9D
SHA-512:	079CD249A9149AFBCCEA7993672D384FC896E86BEB8AAF374636B92466DCD26EB2B7E7FD0063316154A8427AFEAF1A3AA3B4A6E9FBEB7FEF03BC9A66C36A5B8F
Malicious:	false
Preview:	.PNG........IHDR.......'.....p.z.....pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<...LIDATx..?H.P.....7t....{nq.f.A*:........"..:.....tU..<..N..q.(..R..+t.....^.w.^O.............=b..kE...&<^.....!....D6......\.C..2ti......!.......n.L\|.{t.3r....+'5..G.m.g.&.....d.Zr\|y.9...M.W...3.@a..]z5.].._....kO..^......24..C.S..Tz..;Ge...xR....r...cE...Z<9..2H\|.@....Gh!.."Xh..bpF.4H$...M.REV..o.Q.m\.@..I.;.\Vt""S..I.+.A....n..K..>B.......!.O.AqE+....b .U..V.q.l....8.l/....:..QT.d..i...Y.q-.SL...:....3.oc..P.b...qV#..?...y...,....>..6.qGGO...STvt)......@...F%...)..t...t./+.].\|...O..K...M.J..(....^......?m...8..o..."...7.'.0...O..&..^... ..7..;...{Z.....]....IEND.B`.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\ISLogoBig.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 150 x 152, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	2919
Entropy (8bit):	7.890433217220344
Encrypted:	false
SSDEEP:	48:j78fWYtwYtCmV7Ec31HHeHoxToD3WRZ1aKtnqbaI/MoxUQGzuDNMTJVNkY:j70WQwYtPBt1btoDmLNtn4aI/nmzvNT
MD5:	D1EF62B54F9891D47FC45CEC0DC3BA66
SHA1:	B111B25F31DE42B0DF8033A4B900567D3EBB8D3D
SHA-256:	C2CC87D11211DBC67AE85BF317393912A4DEB092A70A4D1AA746F31F4E127A18
SHA-512:	AF4AB16181E98D0484518DC61B9DA66C36C60AD66BD9FD8C1B25267D9DBE5C91BA42812A3F73918518B4215FF051A7694CC598AE6217563E573726B91547B3A8
Malicious:	false
Preview:	.PNG........IHDR..............i......pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..oLU......(...cAo.y.!.).z.a&Xh.."....mu...E..K.L...jlk..`R...L,&F'.a..-e.N.sV4...L..{}.....s.....7....{....=..yN..5H$;k.].BH".$BH.I.V....}.w..u.."..9u...W.:H.._..:}:9R..$BH".$BH.I..D.I........'B......D.'D.0.#L.....G.l..6oeF...T.].hQ..E..o......()..)N.&f.DX.>...vR8.!B8..>...O..pK...~.Y..D.6;!....)s.'.....N.?X......,O.G.l..8.]...0.......:."D..uU..0...F..f..X.E..J...s.>.$.h9x.#.W..B...\|e.x..G.mZ.....L.I......SQ.#.`...x...2..h..ZVX...w.-.o$...f.!......Bd(.j.k+V(....O.!.5..B(.s....e_INz...z!o!..P..U.L.X...$9.4..f....#..%...4....s.....\|.....kv..v...T.J.k.c..1.}B.....'Q.E.O.38....!...)\.....J.p..S.i..hKOg..+7......j..8.X.H(..{o.%5u ...H....\..T...w.f<\|.....!....i....I...<.m....&..B.I.7<xq.DZ.$.!..Wqz..:..i8..l...G>V>...Q.X..:B(.'...S.P..I...P..-N....K....e.".9P.....!....Q..a.d...=;.1..O.......IG..\|e..W...X.$*.M..\|..W.x...1?..]q....Q-?...OA....

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\ISLogoSmall.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 75 x 75, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	7.842174890806451
Encrypted:	false
SSDEEP:	48:YE1fChxC9ZQNefvGdsVivJQEJVBW/f0stN:YE4HCboqvGssxQEJVBWJN
MD5:	A7D73D5BFF3EFF52325A53642FD31552
SHA1:	5ED0006EE052295E01091588C366952B4C185E29
SHA-256:	8B4F5BD1C8F01EF4775453A53FC827621B6FD2F2723D52DF6CE64E5D66595C33
SHA-512:	230A01C4230D0A5A08F02126FEDE6E8F2FDDFA19FAE6F6116130AA4DD5C9368FBC608F4ADA145AD2B3C2FD059A18643DEF9D3E8A5BBB62DB767043E59A8D222B
Malicious:	false
Preview:	.PNG........IHDR...K...K......,.....pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}L.w..;..[a......XeE..qt:.A.Y2e...H.:.F.e..-sY...1........... 2.......P2K6.ix..\|....].w...6......~.y~..}~W...$.-L......./..V.\|+...t..Q...!MX.81.....L.....J.4S....S..g.jV....-....C.p...Iq.@..GJc... #.L...\|..K...L.3W.L..~.I..\..f.L._.d^.."8....c...W..%.E.......p...n...M+....%.1`.6.P.qld,..Q...#.c...(...c..\.c..}.6.JT.....JS.q..y,.s.....O.......J...}#....2..N..2.L;..T.....&}c..CV.E...l8.4.../d;vq_.F.'@..i....`.j%\|.Q.@..L_...m.. .....aO!w........}G..A............1.....o.2yv.."sZ.=CvT.Ty..y............\|.\..'..;.'.-!.u.ep...J...9....>..B..p........l.+..._.2. .d.(M.Bp...\|.....p...:..B......y.9P<......\|==....#..WE.%.A.K!\.R..X.....w.8}..e38.H.....c.;.....6\tw....ZGp.S...k7n.7..T......j`.6.`.;.Nj1Z....yo..:..5......qI.<..c.........24~.g...=.N].....?.V.r.....8...J8........F..s...[...R.".\.1H..:{j.. .).\|.k.:.l.....n.............+o.<....`..=#..

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\Remove.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 50 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2868
Entropy (8bit):	7.906731719242294
Encrypted:	false
SSDEEP:	48:ujzZtSeGixozvbg1THbW3zR66DDGVxsJHoJ3XtbjPeqMN8NnpDRijK2frbP3gABc:uPHjGiOzuHa966DDGj2k3RjPNM+NpYjg
MD5:	3935F5F99E5930A26FF9C78E7004EF1E
SHA1:	1776AF49DFAF8A863E6A8E8989911D69D4D68364
SHA-256:	759A320B1B41F49D95333AE9636AB772C64DDE712208BBAE1850D134F870A70E
SHA-512:	A3B1D182A56D4508DD7DA1F07299FC155BD33F4DAA551634996BEB4C38CCB566BADE75C3D900CC3E07B83D7B702FB0006D2849462213BE0D864D0D142A42E5D8
Malicious:	false
Preview:	.PNG........IHDR...2...F........f....pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[[....>..s...f.&.(v..1XB&F.,..l......#...Hb....<..BDd..H..".,.8/.y.;.....ugv./9....t.=0...T.....[.SU.X.E.,.]...Q..n.{\.z..Y..w...]e\@.~.9.. ....f7P.....$.BZ.O.^.r.L....h6...W_...r....p...-[h....Y^^..o... ..{...Q ./_>.J....;....k6.T\\......{,)...L.hz:.y.X\...yHgv.}_~#@.^.x2.I..e...,..R.&...B..u.fg(.2..4...W.....}............b..33[.]-q-.....7N...[.?....W..U.%.-...;..@.?..23...Tb...j.-\=x.`).......m..TE.B.@+...~........v.u~......D%2...5....w.........Za{.........X@..8.iaZi6.&..z......8.q....2U.52-..R..;.avM..E.M..Q...d...C.~vv.a....{...\|....*..8...9...h....s.........g1F.....fu....2..~.Y..vW...R...UEe.Q.U....U..]..5.t..#e...T:...q.j..\-...1q5..iH.0..lk......aPg.....0.V[..s..N.....!.H..N^.......~....]b7Zf7...\..3..J.3..#...(.ap.....^B..D. ..e.l.D..5m.F. ..h.U....#.....x...k"..X4.m.k%.........@..j.J.J..... .....0...'-lKJ....s.....a...,[..%...MW:.-

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\Repair.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 79 x 69, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5091
Entropy (8bit):	7.94632076328756
Encrypted:	false
SSDEEP:	96:a4lF0XeOh219Yd8r7D3stFSeCXz7Mlh3s/rIa46R7xhvrqpePc9:XFlO419Yd8r7DkVCD7GhGB1VhvrUePc9
MD5:	C404CB5D0854361968716C3AB8630F92
SHA1:	03C73C5400C3E51620D403F5FFB37C1959115B31
SHA-256:	ABDCECCB0963B6A2621BC1C1477C5D7FA0743E6656275FF1E3402464D7946C87
SHA-512:	70C253A88D6A9E3033AB47A67B420E22E2F875E388554A7DB532A90F8D48F73910ED2B5D4B5156CA1F519BF8AA2A2CF417E827BA64DEB4CE868E4DA149E26EED
Malicious:	false
Preview:	.PNG........IHDR...O...E.............pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<...pIDATx..{l..y....;.).OQ..R..d...i.F...n...6Ha.A.6(.9(..\#u..i..H..N.(....6....6R..q.....$.H..x...N....;..x.......~.%..z............gr ,..m.....}<...t....6..y....W..6.<N...O..9\....S.;t...b7rQw"...X...[.z.\...s.r.>..x.T..x_n.>_...t..N..p.....\|..c......S.....;..k.y......O."D.&.QT.hU..xO..H._#.o.+...<O.Q0.A.<Q...%+.Q..C.@.C.ay.........[1e.y-....C.]..iB.B..i...>..;o..R.]m..K.... 2`....U .!z....0.....~o..i\.l..h..P.T#q}.o?........\|../~Ty...7.....%.f.s...>..2..P'.v.V[.)5cUz..l.A.\..3.z......qZ...'.W.1z.cs.R}F~.b...X~..{..&..e[..@.,K.W..,(....U.B..HG9.Z....\|l{..N...O.%........Y...?.n./?....j+..I...C.....)...%..5.GWY......7g%.Np.RY.^o....J.C...Ft......'..W.{a......G..SO..j.*..2..ov.6AD..W....J..{._.O.....m%I..A...i.5...H....@`..S.....E..$!j..K.......q.........._......l9...h{...Ax.mQ.\.:...>.[[.n..t.....A.."}..,.H...OKc....]...3..J...

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-150\Typical.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 78 x 69, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.942394504787228
Encrypted:	false
SSDEEP:	96:tuQCbvBTE1UhXkAy5caRX8Idg2CwVRH3o9UOjSdbIZEif894jK2AXwIkguWRnoi8:/OKc25ZXhdg2tVho93E5mXlAX6u2R
MD5:	BE7A62B3CF3AA240CCBB2E8CDF60F29F
SHA1:	3FB97D5AAF9CBBF8C3489C26CC14A406FFA1819A
SHA-256:	1D21BEA5C93FCED9F777A86F2B7D9EE11B697BCB4D9306794A81BEBA60CA7AAC
SHA-512:	F73EF2173138F08EF0264BC9CB64C80C9BCEE927C50D70A0F2587D8B535E98EDA42FB8F31542A2421A34B89ACC19153F0EFBB0113593B22ED1C906FF548888ED
Malicious:	false
Preview:	.PNG........IHDR...N...E......m......pHYs.........&.:4....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..\.x..^3..$$.$`.....S#._.J@+.. ....U....Z{{{...{.....k.....(./. E..%$@.@y..$..r.3.....3..9Ar.w.v.m3g.93.....%........G.=./....V..........x.e.i.S....8.....{...Y..9.Z..9...g%.Y.'...Gy..\|.[A./.rB..t....)\....#?....o..].,.A....6...'.5...9...y.o...q.s.............i[d.P...P....................]4..j`..m.."#........ .>.........v4@...Y..pR.<...)i..L.P....v..D.@+p.. .#0~3....r.....xe8+U..u.}..H.,.+..-.A....]v..t...c+.........".....[.w.......E8......u..;i..:...<..{...>...z..~\[....d....8.2..I.w...z>...Q..x01.-.3...M.6..G.s:..]..{..OO.{....d...7.....f.=g.....U.m...`.u=.d:..=#.hS.=..^..Su...&O..}....:...x>;[.s.mb;...M....`.T..v....x.-.>N......j.R..O$....A,v...x.$..sC..'.....n]#Q._.+.I...*.....-.;..7.}...2....J........`[..#.lC..6..+&N,...^~u1...9}`?.+..}.9D.-.....U+........sp.9Hu}..7.......g....Ut.`.F.@^......n..B;.0.iy..<d..#...M..AS........?>

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\Application.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 81 x 92, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6213
Entropy (8bit):	7.945846271751275
Encrypted:	false
SSDEEP:	192:zBuUbwRzq3ByQgJ0NMFaJYyuCbDsKAbedY:z3wRzq83J0WFw8oDK8Y
MD5:	5CB34DD612581AB996FF4141E96140D2
SHA1:	72E44BAA670048725DAE89626091809E06648F35
SHA-256:	A057F7981A7932ADB78268F111C3100186B0DED651B1985F4DF969E786B481C8
SHA-512:	56C4CAF195DBF20257D3539F328B95F577ABF9FB72B61EBA151F1378625086B0AB9012E740E8D473ECB89A992307D52705A960842AD5BCE8EC34BCFEB4A3C421
Malicious:	false
Preview:	.PNG........IHDR...Q...\.......Y.....pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..y.].]...Y...m...z.8..&j.4.-.$.!.A....... (.D...@a.. 5..J..B.P.M..DIQ[.m....n.=c{.3..g.{.......;..7..b..e.o...[..w~.Zh..........]..W/....9..@....y^..... .{.yh.......>.........m.^.>G....{....6...s{.....-.^ .....8..;...."`..?...._.......p.r...S.9.@......p.:..s..>....-..C..as;..?..hn;Z..Z.......!.......a.".:...~!PU...U.s....i.......S.C....8.u?P...a.".Z.Bh.L..S....a...jE0......K....q.....*...........b...`.....:......(. L.....].Dte.,.~4...3...C.........L....\..8..~..,.Y{..4..G..RZ.V>{.T>C....0.c.>...\|...eh.....5ew.j...S+.`.v...gd.N.Mb......C1dv...T...Hc...........P/C"L./......L: .S;.".F._....&X.:..~....'....!...?ci..#m%.D.)..@........Kp.n_.?..R...`>U.;.,jN..>.xS.pWo1...(..}...Bw.$5....c6EIL. .b..+...Vhu.....w..J....`:.La.......rr.~..o.....9._..7.....$r..c../.@0..O...>...}..^1.8^..^e.5.Y.D.H....#.{..<v...,((...P.......e...............(!.D.......

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\Custom.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 104 x 92, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8672
Entropy (8bit):	7.962843219146717
Encrypted:	false
SSDEEP:	192:53WFMLVwn/cVqRma/aLt+WTyDX4oI9Yf9cL7/t6woauPYTr9:1w/cdXL0W+NAUhfc9
MD5:	CA50DE91FD398EEA3960EEA2D5DFAF48
SHA1:	0F429F6CDD21E2C9E4E699D1AEB52CB9881033D3
SHA-256:	6274061D9A16D293D32E1EFEDEB149E6EB17370ACD9F5D597CE9E5EB746F4881
SHA-512:	B99E7E95F296A2AB7F23275CE297ACEEE9DAA66BC4210AA8B3883348FE267CF220F86F178D15D5E3E12F25326DA89E71F8CA77C70E3C942B63DAD1F1897FD80D
Malicious:	false
Preview:	.PNG........IHDR...h...\.............pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<..!mIDATx..]..T.>.UA.....I7.BC.D.A.1.L"m....pP.#.u.DP'_.a4&...I.....`\X......}.f...z..=w{..zU.K.....{t.W.....9...#.1..xns...{......V}.0.@...7..N.#..~ .x.............u.~.y../....y....?G.5..:.k7.m....c..........;..U..."..1...:../U.."`.?v.>..k........._g...fc.l.5..c.Q.x...~....6../..5\|....(.ws....... Pr.$PN.P...X.C..!@.`Q.<..Y...1....T.......T.W.x..H...5.....@\|@.d...d...w.B;.T..Vs..~b...I`.j........+........K...b.R.0.T.u....E....\...}tvv.R.Y..'D...P~..m......e.S..K..Qw..Z@...>IZ.U.\|.m..X<.2.5.....$....,....>.IS.L.........X..(....c....s......R.B.%s..D@....y@..#d. ....(3.$.E...mi.<.s..?.\|C...............t\...1AL......$.....WM..)..JO....4....<.............?............k.../..... K.<s.}...s.X.....CI.S..V...8....g;.YI..t...f..1.Rc..B..Q.....:.H..w...TY.pfs`V..{..eW$.~.TC.......w^..._.......W.#....../;.n..8.O.....4.!F. ..Cp..z....A~~^.G..Y.\|...N.?\|..~.G..

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\Folder.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 62 x 52, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	925
Entropy (8bit):	7.703310262967306
Encrypted:	false
SSDEEP:	12:6v/7J8VnSLnJCSSxY/fPD/wMjN/3tb3KmUqGViOmJluXDwLAFYhpxVy4z4AO9+PY:qinvSS0sUt33xmQluckF8xPEGp2n
MD5:	6C1C6B0901943F054FD7E8D0B9C25ACB
SHA1:	8EBD624F9D014EBA0A87DF3483509E5236C745E8
SHA-256:	BC18AAFA7D628B9C25E6BC8C114236D53FEB488A15D6B6B6420B1298BAC44ECD
SHA-512:	03EA6FBF0214E9B34DB78C93E6ACD6B92EF40623B70707DD37A989644BEDED2A4A10A8ACCE4E90D97485D6582197FC30E1B5B2800F1CD23AB7E62AA6A5782022
Malicious:	false
Preview:	.PNG........IHDR...>...4......Z."....pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<...IDATx..?h.q..........].M.\3.6.`..)..:....... YD......QP...D..,.^.....Nu....9.K~.r.%.J.w..\|9.k...{..}/.b.8y&_.B....\...x).g.k.]..y../+f..A.h(1a....`..Qb....?J..<...0..G.:..v.O/<....Uy....BMz...z..}.`...m...&k.f.Z.8.U.w..C}?..$.k.+.".UqziC.;6K......8s.a..m.......S.M...U....PF.[..f.....i..r....s6^.0.>.........JS....&.(..L.S..}.\|,&.%.\.x...r..C..9.m.u.........cT...?.!....x...B.....dk....C.....l..../..T.z.%`..4..9.]p\|...x....=...0.z.....My...O S....g.q......\'..997..<&.g...B....kn.[-......!.1.X..q.....cNe..W...m.58.R+J.............BO.cc....y.;.zx.....p[U.(.76.8}!A&.bol....#cl.k.p.wcs...,....fol.QW.H$.!p...........cs....5......9.....o..c.r..JE......8....3.........7...3.n...q......v.....\|....e-.~1.~..4}..?..9.O.Q.;...U..Ba.=.(.XH..Y{.@.~......dq.,S]..'`.GP.Q.r.K.}......,J...*.....IEND.B`.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\ISLogoBig.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 200 x 203, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3927
Entropy (8bit):	7.867628022986832
Encrypted:	false
SSDEEP:	96:DgcRZq+qXbjAxA446PygFDI63vK+Jo9QZuSkievB:kKs/ACCyi06LJPudiOB
MD5:	8DD8875C148136F4FAB3C3CF8CF7EED5
SHA1:	D83120EBA14A85CE48A2917601E6B4D97877F116
SHA-256:	3D58BDBA085344511994581785DEED8A66C05297F095FAEDD1FEF2D3692DBCE2
SHA-512:	3B25AB04395DE85AC101501AA3AFBEDBE74ADB31307A743B3EC9CE8B69F8D4CF6210BFC50AF41BC733623930EB480F2FDB359B0229A8C85D284A90E0390EA539
Malicious:	false
Preview:	.PNG........IHDR.............+..0....pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...lV....IA.(....+P.-6./C@......zE.fs...,.Y]t.l\b..8.@&(...r3D.....2...j.TgqHP.%....+.\|m..y.9..~..K`{z....{}..<......H.#...]. .... .... .... .N..._64}aj7...A,.sN.)-.C...... .... .... .... .. .... .... N.o@?.Oon..@2...2U%.....d.j.c.."n..@2..2.Q..!...3.........!.@.s...E.A..S*..~=..q..@;..4........A.h.:eXA....a.... ....Gt.....1.....i.i..J........G'...qs...,z.....M......k&v......&!Hn..h]9..p.!.l. ..)..\_..@Ao...\|F)..A.A/...&yc.T.z.....B.\..f....1'.....>...P"........C.......B.\.....wWw9....v..9....-......v.:...w]kbl..-....'....g%.........f.{..Z.jI.....).Vu.U.....)cKC.\..C.yn.iz.Z3s../.$.b.{.._..B.."..S....W.y.L.%jtzy-o.Ww..u...r.X'mP.........V.h.../\|m...?y...#.;...MF..............5.^.......]."..t.r.....S>..;+..hl..i.~..k..v..mG..qL....}=nt..nS.h...An.>=... .!..]\.......W.l4KW...}...r..F..."... .D...Z....q......+..E.._\|...LD.0"..d..Y..T. .6.....o..

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\ISLogoSmall.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	7.87633508703651
Encrypted:	false
SSDEEP:	48:lU2gwgdgYGMaT1kyhq09/YJJuoyD5+UZXmxI84cTyump0qZc:i2gwgd/2mQqEgJJFykoXmxICyumpU
MD5:	B948E2717C6283CA2339EAEF8102837F
SHA1:	452459A3450A68D5A0EB7990918F85175957E696
SHA-256:	52C335337012024AE9742DD044FE673C3E26E2D2C83B0995E4BFC44884758650
SHA-512:	AF3646AB58BF9342059E03FA9A967D1BE7DCE3FE0EAB8B55A076844FBEED7980206A3892C99A87CBC28AD2E43C3A39E8211F531A71DD69BF849299A699CF20C3
Malicious:	false
Preview:	.PNG........IHDR...d...d.............pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..}L.w..+/N.LEa..Z..B...Q..B....2.....\.[&F\...L.2.n...L..6....(.._.....H....D./......w./..\.A......}...;G.=^.Ff....Eay.,{m]...z).k....^.D.Y4.),.....y.V.$.6...bB....(,"K...3..".%..rRU...%.C_...N.:...%.X....p+K...+(,..<:....sg..7.G.,.6..V..#.D...Y.H....$m..VChHa..!..0...........G.%N!<.\.....Z;;.cO>..O..$..."$.{....1..o.+...0....9...T.Yo.(.D..Q.%.F.'..\l.....1h9.N...]...)L.....H,s^.D_.r..x.9Y..5po......!. .#...C............d}).A....l.R.9.e./.U;..9.E.}..N.?.r.\J\dQ.5..p.Wm~9W=..a..C..\| x......n...).....,Np..6i...:cJ{....1..mgV.C.._.W...o.......&....6......X\|.1.....X.?2....D..D.CmI.m;.%!e]Z..g.).?....wP.&.Nht.b.A..D.....Y..e..\8..y.._....+ ;.....@.K......FU^o.]_j .#....\+..+J/..{.k...0..np.>..d.g..ajE.@@.j.C. ^.sr.B...i.rx0.....x..'..{.j....:..u....d)>......hd.p.\|.g...p..h...L..Y.......7W=Y.8.v........CR.I.*[.'6!...pyGV....U........GgL.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\Remove.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 67 x 93, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3713
Entropy (8bit):	7.939409223387352
Encrypted:	false
SSDEEP:	96:6qOeZUWFbbopicOUY9zwrINNQvrxb4ttw/dGZ4Oe:6/eZU8swcOpZwrLyttw/oZ4V
MD5:	87B76436D9D1EBCA360F2ADC79BC7053
SHA1:	61199A4BED5EE2BA33BA55696BA486372D9CA40F
SHA-256:	87B0A0B42F2973CF9AF958022438AB4B350DAE7700897204816E16A62E223433
SHA-512:	7F2236CF60B4783BAB5F7CEF7FB783701EDA3C4EEFCE52E134CCE3649CB4A8B2DF772465F5E80163B22BE060907E2515B82A3A9A79B0AE429A69C84827FF18E2
Malicious:	false
Preview:	.PNG........IHDR...C...]............pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..\Mp...~..V.%K..#....S..P..8@L.)...T.\|.G\|Knq.......W...E...e..@.0.R.11.....JZ....}o.gG...Q.]3.........1. .......\|y.......W./q<.x....F....0>..Q..T@.'.....Q2...l_...R.......%.\|..>...W6=...x. .0-....m4<<L.tf....2.....o.R.".5......6....\.J..L...!...I.e.....4MNL..{....<..M..... ......Qr.......R~.J...B1J..).1..K.........<......ao..:t...8?6&@d...;w.$..+.....LS....7...p<.R.........999A......#G.u5....s...{.....Y.........j..........}Y.h.,%.4.}0.o.......2G..w...x....e.i.;.T">.....A.N......kT.&..N.ipp0.wrb....k.....w.A.^.14...G......M8..O.o!_.F...8....4..T.t..u$..\|;..B.....m..,..b...-........I~...G.[.4.o..&...d...90<..$..-...cp..W.[;y.;v.$.q...)...;)v.8....h.q....DkU+..1....x..O?..C>:O.]a).8....=.5`p/qD.G.Xd..,=..O.}...N\|.....B..[.<K..._....0\......[b...:...n..;.........w"..#.....Y. .J.O.u..;c1`DU..r....Z...e...r.#..Ke.CD...}..Q...'....=.....>V...

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\Repair.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 105 x 92, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7385
Entropy (8bit):	7.958336818666451
Encrypted:	false
SSDEEP:	192:O4Va0+8xvosHz4ksTQCoechkWiuItjouth:/B+8xg4kksTxobhPPwouL
MD5:	47B0CE02632A248ECFAF538E910C33F1
SHA1:	3B156CE941E2B4BF339C86C5AE64C075738127B1
SHA-256:	490FEC5151E23B7A00CBEF9B5874244E65E0B9D0384786B298AD58C7E2CBD55E
SHA-512:	EC43C79F0E90C61EAC6BAF88672737A0ABC612C79736D7C892AFE135E906E1358F2FDEC604F9778F35606AE150E911F007F27030B97EECC7B86B324933C73B1C
Malicious:	false
Preview:	.PNG........IHDR...i...\.....m5.$....pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<...fIDATx.....Wy......sV...vu...4&....J8D...........p$..al .RN.!....H....'...!.>..pXG.%.nk%..]iW..f......zzfgwz...f...g.}....!.1Hb.....tE{....#.....F..!@....)..k..$.../.k.......x[..>.....b.p..9.1.C...G..`.g.._.....7w.._..$q...}.oWu4.e.@7.a....T=..(...mT..............pU...Y.{....Z).\|Nm.=.m\|}?_O.....\|]y]B...&9p.... .....'a.q...E...h.,....1......;...A.. ....U.b...P....E..P....a..h......`..........PS...jJ.6.._........jX...8.eT.+.....N..PV....i..K..Ru. =(..8.\|;.mXh`..(,c...b.4,.........I....$..,9H..U....c...c`.Ava..`1..+..>......`...i..a..$...zQ.,j`.3..,Z.K@Q................L.r..(......&!..B..e.....W}.V7.......'.S....]..k.u....(.W..u./..^<.j...KL.I..U.q....\3.ee.X.>$.2.x...sF...c.T.XN.M....I._....Rat1.F....W7..E~M?.<...#.Z..bw.. ^.........w.>../....o.ZA..... .4P.o{US.\|...w.7>...Pn...z.......\...U.D...oHyM8._..,.A'L.2..Du2.M..D....m...#.n3..1.D.......D\|.j.L....U.....E.

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\scale-200\Typical.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PNG image data, 116 x 102, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	7.962526995464065
Encrypted:	false
SSDEEP:	192:N1KsfwPzkcK4pqQ/PabiFYqfpiEHomJthKoY8UQp5Xi2Ovu8DL:NoXPz9dqUiGomqQHy2Oh3
MD5:	A8EA2F7480FDA95BAB21A0E86386C551
SHA1:	3E124DB825B3CFF40F5C661C53C889132925FB1E
SHA-256:	57EE9024DD4BF02492C9750960D258AA7AA8DF94D528D266D8B5A18C3640B363
SHA-512:	FE9095BD54DE216146C13D9B89309C674E51974F48F30D72E101FE3CCBDA77FF53BAB7213D3B96AC2513A8C42D215C188DC3CA2E94AC5A3FDB5D772FEEB01903
Malicious:	false
Preview:	.PNG........IHDR...t...f.............pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<..$eIDATx...\|U.........+$......m-`m.z....Z;3.hQ;3W..7.....wj..}!......X[.".mm.. .GB......o.....w<..%....>'.o}.........i.......~....h..V....<..3.\|.Jny9......>!..yGQG.W.#..:..cb....9....kx-~.x..,....qf]?..-.........n.[}.......?...Lv.D!.Q..#..9R..._t3s. y-....*...\|....d.5.....$X<S....&m./...[....-.o.ry_.d...E..B.`.7.x.;.`...q.)\)<.....A.O..5...z.?......\...}..v...pK.6.#..@``:\w~.,..`.....Y`.\.,M...X.l..5....o...8P.....h`&..?..k...K..j..o....k.....6\I.0PK.T.%..,...hy....<........M.Z.y....6Jjf_.;\vfE.$...T...T....t.......R....%.%.M.B.z.qh......>}...Emm...S.T.. :..T....d.X...0j.X...,...N..%.:.`)k.l'...."....U\|[..e\|Kx.[...o......-T.o...p...n.I.GT......`.._i~Q..:.:...y..."uZ`.Q.K.........c.....P..:.Z.....\..\|...r.-^b.W.;...y._.)J;...... ..G.......Z..q.;.j......_B.-..]..P..".r...a.UW.........t.'.zan..;...7<aN.$T.m..g2....soZ.{..............

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	63695
Entropy (8bit):	5.731507911827756
Encrypted:	false
SSDEEP:	1536:DJH1x+nQPnOsiFn1Jntj992wXpeC5NSCnN5Wfib7X:DJHv+QPOsO1llr2wXpe1iX
MD5:	3C650419E132B96A3636BA2109655D6F
SHA1:	05B04065A7BF674702BFFE4B3166180837C1DE49
SHA-256:	1814DB6F6C3B65F62C41CDD7F5D6A6080796507E2A1F841812B834F1C845E0DB
SHA-512:	E9E3ADB769DD92925924C8A75A6171197A9610576FA0A77DCB734C6697290619D570723A2430B870F7DE96A91BC0ADF5F94EEEBC0C283C0D1FC6AEF70A84B1B8
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<Setup SuiteId="{783F36BC-63CA-4E74-ABA6-81C222D2C3DD}" xmlns="installshield/2019/bootstrap">...<SetupConfigurations>....<Config Name="SplashScreenDelay" Value="500"/>....<Config Name="LoadingScreenMessage" Value=""/>...</SetupConfigurations>...<Resources>....<Resource Stream="Application.png"/>....<Resource Stream="Custom.png"/>....<Resource Stream="Folder.png"/>....<Resource Stream="Remove.png"/>....<Resource Stream="Repair.png"/>....<Resource Stream="Typical.png"/>....<Resource Stream="ISLogoBig.png"/>....<Resource Stream="ISLogoSmall.png"/>....<Resource Stream="scale-150\Application.png"/>....<Resource Stream="scale-150\Custom.png"/>....<Resource Stream="scale-150\Folder.png"/>....<Resource Stream="scale-150\Remove.png"/>....<Resource Stream="scale-150\Repair.png"/>....<Resource Stream="scale-150\Typical.png"/>....<Resource Stream="scale-150\ISLogoBig.png"/>....<Resource Stream="scale-150\ISLogoSmall.png"/>....<Resource St

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	286720
Entropy (8bit):	6.1981981749862
Encrypted:	false
SSDEEP:	6144:EXJqVC2DC02/5EttvTg0q6UMccu7VD3i1:sqrDshEzTKvMccu94
MD5:	7686C19501FFA9DA709A98AF94C0C844
SHA1:	C9B0A876CFBB092E55010D260A9A91389ABF91B7
SHA-256:	C65B3839BFF49D4D18AC37DB73F1E23637ABC256961F2F07FBA657E5948D4D96
SHA-512:	5CC82B9CB741881AC196C6B43958B3C5AC0163B9CE42947E7D7522D4873266BB8186D2EE100576058EEC920EF04E1516C5BDE6837CAC6896090593CD7E5D6BE1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........:L..[".[".[".!...[".!....[".!...["..!.["..&.["...&.["...'.[".p.'.["..'.[".H...[".H...[".[#.Z"...+.[".....[".[..["... .[".Rich.[".................PE..d......].........."......x...........`.........@....................................6.....`..........................................................@..(C.......'...2..........(...p5..p....................5..(...0...........................@....................text...Pw.......x.................. ..`.rdata...$.......&...\|..............@..@.data....*..........................@....pdata...'.......(..................@..@.gfids....... ......................@..@.tls.........0......................@....rsrc...(C...@...D..................@..@.reloc..(............(..............@..B........................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\signtool.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237392
Entropy (8bit):	6.3464030744891975
Encrypted:	false
SSDEEP:	6144:Wk4PcUOd7ZYKsN4JR7cFnNBPHgeUe3NmC:Wk4/Od7ZYvOD7cFnNBqC
MD5:	6581581A1F2EDA52D49DC1FB0619FF82
SHA1:	C1FEE5C60F43CCFCB1D9F0A72D914446E02BB5E3
SHA-256:	F91D5E8CC6F208E56660292B80AC3837787100306C786B9FEBA8F0152E1EB1A5
SHA-512:	DACD128A9195EABD9D8980064ADAF28AC9740281D63E78B663D0CE43DD6C45FD3DF5E041C325074F89AF6CC9F8940DD5BC7A571E913BC27CF7BD696C086BE81A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........us.x. .x. .x. ... .x. ... .x. ... .x. .x. Rx. ... .x. ..e .x. ... .x. ... .x. Rich.x. ........................PE..L...,.[J.........."..................z...................................................@...... ................................... ..................P.......0....................................3..@...............<............................text............................... ..`.data....L..........................@....rsrc........ ......................@..@.reloc..$!......."...f..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\welcome.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
File Type:	PC bitmap, Windows 3.x format, 499 x 312 x 32, image size 622752, resolution 2835 x 2835 px/m, cbSize 622806, bits offset 54
Category:	dropped
Size (bytes):	622806
Entropy (8bit):	2.463890393534144
Encrypted:	false
SSDEEP:	12288:lzP8Kr5hkczq27KVG5P5wVVwsx33ijLXLYS+:lzP8Kr5hkczq27KVG5P5wVVwsx33ijLG
MD5:	4F98D754BE22A34C4C317C7F40EA954B
SHA1:	75CBB537AFA903997C9BF688354FB6820AF5069E
SHA-256:	95AA33FC5D79A3A0B48B1B3CE0050B331871FAEA65047280AC54D2E3DEC7BD49
SHA-512:	5C1F123BDD64A618EDD926C1FA772B10DB1DFF1935866C54CD5D29EA3A5F96229098A3C6571888243958051FA9D8386E5546F269979563C7884A054FD1FF4F95
Malicious:	false
Preview:	BM.......6...(.......8..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\SuiteSetup.ini

Download File

Process:	C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.738975458387928
Encrypted:	false
SSDEEP:	3:l4yNQal+53+HH8wvAGlFIAKEqdyhiXpu9Bil6:lh+53+n8wvAGUAKEqdyAXpu9Bil6
MD5:	FA448580C46C4B2955854B6168665F77
SHA1:	56C2E110E52685C5A0161D74438E047711167558
SHA-256:	98E5BB436F6F02F151C0C15BA30A509836AA63909CB4C730C399E6BA33E7C415
SHA-512:	CFD10D81CC9B55789E67A9A80D1F578F36EF5AF4F02FB29703E45D6B695344E1C535576290D86348A67FB7C42612F5E999FE6772BA5F5714070E0FFB67081C88
Malicious:	false
Preview:	[Settings]...Clone_Wait=Y...CreateDebugLog=N...SuiteExecutionTimeout=60000..DebugLogName=InstallShield.log..

C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe

Download File

Process:	C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3485736
Entropy (8bit):	7.618651309177703
Encrypted:	false
SSDEEP:	49152:3euedMsr34wuN1ddBV+1rfQ8T9H1iM8qZCAupNaMbRu7HyvKqeAZZXQkEuxQeYYS:eMI5QEHcTlpxlbO3yqxreGV
MD5:	C469B3646FBDDC8E03DCB9865B02E89C
SHA1:	46C0D0B632A9B2865CD79110F5549E3132CD313A
SHA-256:	C5E809AF345907819DF2CEBDA858E8C9B5614DE1F049BD347CEBB6305281790D
SHA-512:	42392843AF4BC024AC8F29907C32487B44F6E38D4F0C590A163F8659C3BC24A92BF740BDD055F4900FBF79197D326AD21FB5E8873309005049307752564AF439
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........&..jG.ZjG.ZjG.Z...ZfG.Z...Z.G.Z...ZrG.ZQ..[\|G.ZQ..[yG.Z...[kG.Z...[fG.Z...[hG.ZQ..[RG.Z...ZnG.Z...Z{G.ZjG.Z.F.Z...[ G.Z...ZkG.ZjG~ZkG.Z...[kG.ZRichjG.Z........................PE..L......].................8...................`....@..........................p......".5...@..........................................................5.(....`..@....]..p...................@^......0o..@............`..(...\|...`....................text...N5.......6.................. ..`.orpc........P.......:.............. ..`.rdata.......`.......<..............@..@.data....f.......Z..................@....gfids..4............8..............@..@.tls.................:..............@....rsrc...............<..............@..@.reloc..@....`......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.618651309177703
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WebSigner_SuiteMSI_Barclays.exe
File size:	3'485'736 bytes
MD5:	c469b3646fbddc8e03dcb9865b02e89c
SHA1:	46c0d0b632a9b2865cd79110f5549e3132cd313a
SHA256:	c5e809af345907819df2cebda858e8c9b5614de1f049bd347cebb6305281790d
SHA512:	42392843af4bc024ac8f29907c32487b44f6e38d4f0c590a163f8659c3bc24a92bf740bdd055f4900fbf79197d326ad21fb5e8873309005049307752564af439
SSDEEP:	49152:3euedMsr34wuN1ddBV+1rfQ8T9H1iM8qZCAupNaMbRu7HyvKqeAZZXQkEuxQeYYS:eMI5QEHcTlpxlbO3yqxreGV
TLSH:	7AF5D031F285E52AEAB201325A7DD65A512CBC350F6190CFE3D45A1E29F19C35B32F2B
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........&..jG.ZjG.ZjG.Z...ZfG.Z...Z.G.Z...ZrG.ZQ..[\|G.ZQ..[yG.Z...[kG.Z...[fG.Z...[hG.ZQ..[RG.Z...ZnG.Z...Z{G.ZjG.Z.F.Z...[ G.Z...ZkG.

File Icon


Icon Hash:	497971328ce1634d

Static PE Info

General

Entrypoint:	0x49cbec
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DFC1BBB [Fri Dec 20 00:54:19 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	f989b4d9f8f6c3499d2c7b1b89767a69

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	17/06/2021 01:00:00 22/06/2024 00:59:59
Subject Chain	E=NIS.Support@gemalto.com, CN=THALES DIS FRANCE SA, OU=BPS, O=THALES DIS FRANCE SA, L=Meudon, C=FR
Version:	3
Thumbprint MD5:	13D59590A6693D28C83B26073D425555
Thumbprint SHA-1:	8BD773156B284388331CD4DB74BFBADD14E586D0
Thumbprint SHA-256:	C2A1BF9C0F2109EECB77CD4C1812DC65438B0A3C7C51EA294A1E7B80301BC59D
Serial:	0E146E0631E80E5F85E2CFF9E87F433D

Entrypoint Preview

Instruction
call 00007F43C4DD3826h
jmp 00007F43C4DD2D33h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F43C4DD257Ah
jmp 00007F43C4DD2E80h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F43C4DD2569h
jmp 00007F43C4DD2E6Fh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [005210B0h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [005210B0h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [005210B0h]

Rich Headers

Programming Language:

[ C ] VS2015 UPD3.1 build 24215
[C++] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11eadc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12a000	0xb5e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x350200	0x2e28
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x136000	0x10e40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf5dd0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf5e40	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xd6f30	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd6000	0x428	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x11e47c	0x160	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd354e	0xd3600	7d293e09dd530ce1ab3194b1b139e310	False	0.42576854486989946	data	6.418801187506675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.orpc	0xd5000	0x1a2	0x200	4664b98c4a3972bd841bf18db12ee7e1	False	0.51171875	data	4.751976711186061	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd6000	0x4a0bc	0x4a200	ef1d4615d3babe5c2924fb3cfe1a6598	False	0.3147232029932546	data	4.470296685515313	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x121000	0x66fc	0x5a00	31ad777bf0f5389751929649c5e24a23	False	0.15421006944444443	data	4.752972087258717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x128000	0x134	0x200	54d065222d6adb1f68aa7bb6c76f80b5	False	0.380859375	data	2.4607224828089094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x129000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x12a000	0xb5e0	0xb600	d78213cf2ff2341670ba40b47c534cb4	False	0.26122510302197804	data	4.7072002633550625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x136000	0x10e40	0x11000	9c4489d743c1bf86f85c80794335417e	False	0.5521455652573529	data	6.566139626301982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0x12a260	0x6814	data	English	United States	0.35325026272331483
RT_ICON	0x130a74	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.21808510638297873
RT_ICON	0x130edc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.099906191369606
RT_ICON	0x131f84	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.06109958506224066
RT_STRING	0x13452c	0x48	data	English	United States	0.6666666666666666
RT_GROUP_ICON	0x134574	0x30	data	English	United States	0.8125
RT_VERSION	0x1345a4	0x45c	data			0.4211469534050179
RT_VERSION	0x134a00	0x428	data	English	United States	0.40977443609022557
RT_MANIFEST	0x134e28	0x535	XML 1.0 document, ASCII text, with CRLF line terminators			0.46586646661665415
RT_MANIFEST	0x135360	0x280	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.553125

Imports

DLL	Import
KERNEL32.dll	ReadFile, LocalFree, FindClose, FindFirstFileW, QueryPerformanceFrequency, CreateEventW, SetFilePointer, SystemTimeToFileTime, FileTimeToLocalFileTime, GetVersionExW, GetTempPathW, ReleaseMutex, CreateMutexW, GetExitCodeThread, CreateNamedPipeW, GetDriveTypeW, SetEvent, EnterCriticalSection, LeaveCriticalSection, CopyFileW, GetUserDefaultLangID, OpenEventW, DeleteCriticalSection, RaiseException, DecodePointer, GetCurrentThreadId, InitializeCriticalSectionEx, HeapFree, FileTimeToSystemTime, HeapReAlloc, HeapAlloc, GetProcessHeap, CompareStringA, VirtualQuery, GetSystemInfo, IsBadReadPtr, GetFileTime, WriteFile, FlushFileBuffers, GetUserDefaultLCID, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetACP, GetSystemDefaultLangID, LoadLibraryW, GetFileAttributesW, GetModuleHandleExW, ConnectNamedPipe, GetCurrentProcessId, GetStringTypeW, GetStdHandle, FreeLibrary, GetEnvironmentVariableW, ResumeThread, SetThreadContext, FlushInstructionCache, WriteProcessMemory, VirtualProtectEx, GetThreadContext, MoveFileExW, TerminateProcess, GetCurrentProcess, DuplicateHandle, ExitProcess, WaitForSingleObject, CreateProcessW, GetWindowsDirectoryW, SetCurrentDirectoryW, GetSystemDirectoryW, GetModuleFileNameW, RemoveDirectoryW, Sleep, DeleteFileW, CloseHandle, UnmapViewOfFile, WideCharToMultiByte, MapViewOfFile, CreateFileMappingW, GetFileSize, CreateFileW, lstrlenA, FormatMessageW, GetModuleHandleW, MultiByteToWideChar, SetLastError, GetLastError, LoadLibraryA, GetSystemDirectoryA, GetProcAddress, HeapSize, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, VirtualAlloc, FreeLibraryAndExitThread, ExitThread, CreateThread, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, RtlUnwind, EncodePointer, InitializeSListHead, GetSystemTimeAsFileTime, GetStartupInfoW, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, WaitForSingleObjectEx, LocalAlloc, GetCurrentThread, QueryPerformanceCounter, lstrlenW, lstrcatW, lstrcpyW, lstrcpynW, lstrcmpiW, GetTickCount, ResetEvent, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, FindNextFileW, FindFirstFileExW, GetOEMCP, IsValidCodePage, GetCPInfo, LCMapStringW, VirtualProtect, LoadLibraryExA, IsDebuggerPresent, OutputDebugStringW, InitializeCriticalSectionAndSpinCount, GetTimeFormatW, GetDateFormatW, InterlockedDecrement, GetVersion, GetProcessTimes, OpenProcess, GetExitCodeProcess, SetFileTime, CompareFileTime, LoadLibraryExW, GetTempFileNameW, GetFileType
USER32.dll	CharUpperW, wsprintfW, GetDesktopWindow, PostThreadMessageW, DispatchMessageA, DispatchMessageW, TranslateMessage, GetMessageA, GetMessageW, IsWindowUnicode, PeekMessageW, MsgWaitForMultipleObjectsEx, MessageBoxW, GetGUIThreadInfo, WaitForInputIdle, ExitWindowsEx, CharLowerW, MsgWaitForMultipleObjects
ADVAPI32.dll	LookupPrivilegeValueW, OpenProcessToken, AdjustTokenPrivileges, AllocateAndInitializeSid, FreeSid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegOverridePredefKey, RegEnumValueW, SetEntriesInAclW, OpenThreadToken, GetTokenInformation, EqualSid, RegDeleteValueW, RegQueryInfoKeyW, RegEnumKeyExW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegOpenKeyW
SHELL32.dll	SHGetSpecialFolderPathW, SHGetFolderPathW, ShellExecuteExW
ole32.dll	CoMarshalInterThreadInterfaceInStream, CoInitializeEx, CoUninitialize, CoRegisterPSClsid, CoRegisterClassObject, CoRevokeClassObject, CoGetInterfaceAndReleaseStream, CLSIDFromProgID, CoAddRefServerProcess, CoMarshalInterface, CreateStreamOnHGlobal, CoUnmarshalInterface, CoCreateInstance, CoReleaseMarshalData, CoCreateGuid, CoReleaseServerProcess
OLEAUT32.dll	SafeArrayCreate, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayGetDim, SafeArrayDestroy, SafeArrayGetElement, SafeArrayPutElement, VariantTimeToSystemTime, VariantChangeTypeEx, GetErrorInfo, LoadTypeLib, LoadRegTypeLib, VarBstrCat, SysAllocStringByteLen, SysStringByteLen, SystemTimeToVariantTime, VariantChangeType, BSTR_UserMarshal, VARIANT_UserMarshal, BSTR_UserUnmarshal, VARIANT_UserSize, VARIANT_UserUnmarshal, VARIANT_UserFree, BSTR_UserFree, BSTR_UserSize, SysAllocString, VariantCopy, VariantClear, VariantInit, SysStringLen, SysReAllocStringLen, SysAllocStringLen, SysFreeString, RegisterTypeLib, UnRegisterTypeLib
SHLWAPI.dll	SHCreateStreamOnFileW, PathFileExistsW
RPCRT4.dll	UuidToStringW, UuidCreate, RpcStringFreeW, IUnknown_QueryInterface_Proxy, NdrDllGetClassObject, NdrOleAllocate, IUnknown_Release_Proxy, NdrOleFree, NdrCStdStubBuffer2_Release, IUnknown_AddRef_Proxy, NdrStubCall2, NdrStubForwardingFunction

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	12:56:01
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WebSigner_SuiteMSI_Barclays.exe"
Imagebase:	0xeb0000
File size:	3'485'736 bytes
MD5 hash:	C469B3646FBDDC8E03DCB9865B02E89C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:56:01
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D2FDF4C4-7908-4D9C-B7E2-6F8659460A24}\_is23C8.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\user\Desktop" ORIGINALSETUPEXENAME="WebSigner_SuiteMSI_Barclays.exe"
Imagebase:	0x470000
File size:	3'485'736 bytes
MD5 hash:	C469B3646FBDDC8E03DCB9865B02E89C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:56:02
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\setup64.exe" -embedded:EEFDEB78-A81F-4EAC-839B-C4BCB6470B9F -IS_temp
Imagebase:	0x7ff6237b0000
File size:	286'720 bytes
MD5 hash:	7686C19501FFA9DA709A98AF94C0C844
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.2%
Total number of Nodes:	1695
Total number of Limit Nodes:	22

Executed Functions

Function 00EE81F0 Relevance: 69.5, APIs: 18, Strings: 21, Instructions: 1207libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories,00000000,00000001,00000001,00000000,00000001,00000001,00F8B388,00F8B386,33A37B94), ref: 00EE82CC
GetProcAddress.KERNEL32(00000000), ref: 00EE82D3
CoInitializeEx.OLE32(00000000,00000002), ref: 00EE82E8
GetLastError.KERNEL32 ref: 00EE830E
SetLastError.KERNEL32(00F908E8), ref: 00EE8379
GetModuleFileNameW.KERNEL32(00000000,00000000,00000208,?,00000208), ref: 00EE83B2
GetLastError.KERNEL32(?), ref: 00EE83FC
SetLastError.KERNEL32(00F908E8), ref: 00EE8458

Part of subcall function 00EE6AC0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000FF), ref: 00EE6AFC
Part of subcall function 00EE6AC0: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EE6B3B
Part of subcall function 00EE6AC0: GetLastError.KERNEL32 ref: 00EE6B68
Part of subcall function 00EE6AC0: SetLastError.KERNEL32(?), ref: 00EE6BA4

GetLastError.KERNEL32 ref: 00EE8614
SetLastError.KERNEL32(00F908E8), ref: 00EE867F
OpenEventW.KERNEL32(10000000,00000000,?), ref: 00EE8707
SetEvent.KERNEL32(00000000), ref: 00EE871A
GetLastError.KERNEL32(00000000,00000001,00000001), ref: 00EE8FEA
SetLastError.KERNEL32(00F908E8), ref: 00EE9051

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

GetLastError.KERNEL32(00000000,00000000,00000001,?), ref: 00EE91ED

Part of subcall function 00EC7090: PostThreadMessageW.USER32 ref: 00EC70B1

SetLastError.KERNEL32(00F908E8), ref: 00EE9254
CoUninitialize.OLE32 ref: 00EE94F2
SysFreeString.OLEAUT32(?), ref: 00EE954F

Part of subcall function 00EB4CA0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F610C1,000000FF), ref: 00EB4CE2
Part of subcall function 00EB4CA0: SetLastError.KERNEL32(?,?,?,?,?,00F610C1,000000FF), ref: 00EB4D21

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Strings

SetupSuite.cpp, xrefs: 00EE8A6A, 00EE8AF6, 00EE8B9E
ORIGINALSETUPEXEDIR, xrefs: 00EE8918
kernel32.dll, xrefs: 00EE82C7
,, xrefs: 00EE945D
debuglog, xrefs: 00EE879E, 00EE9081
runfromtemp, xrefs: 00EE82A2
/debuglog, xrefs: 00EE912B, 00EE9193
-IS_temp ORIGINALSETUPEXEDIR=", xrefs: 00EE931B
Failed to initialize bootstrap interface, xrefs: 00EE8B0A
newlog, xrefs: 00EE8A2B
*** InstallShield suite engine (Unicode) started, xrefs: 00EE8A74
SuiteSetup.ini, xrefs: 00EE8491, 00EE8574, 00EE8E56, 00EE8EE1
SetDefaultDllDirectories, xrefs: 00EE82C2
IS_temp, xrefs: 00EE828A
" ORIGINALSETUPEXENAME=", xrefs: 00EE932A
clone_wait, xrefs: 00EE8FA7
Initializing engine..., xrefs: 00EE8BB2
InstallShield.log, xrefs: 00EE88F0
IS_ProxyWaiter_, xrefs: 00EE86E2
embedded:, xrefs: 00EE86AF
InstallShield Wizard, xrefs: 00EE8865

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$String$EventModule$AddressAllocFileFreeHandleInitializeMessageNameOpenPostProcThreadUninitialize
String ID: -IS_temp ORIGINALSETUPEXEDIR="$" ORIGINALSETUPEXENAME="$*** InstallShield suite engine (Unicode) started$,$/debuglog$Failed to initialize bootstrap interface$IS_ProxyWaiter_$IS_temp$Initializing engine...$InstallShield Wizard$InstallShield.log$ORIGINALSETUPEXEDIR$SetDefaultDllDirectories$SetupSuite.cpp$SuiteSetup.ini$clone_wait$debuglog$embedded:$kernel32.dll$newlog$runfromtemp
API String ID: 1432346620-3601580038
Opcode ID: c8d1bb1700195cbbd063e6c44cb1f8ddeab289148e634f77159e7c9f879fa7a5
Instruction ID: 6bda86212c2be54f9ccedb41234e882d88d149465ee2192c16fb6de41e36d42d
Opcode Fuzzy Hash: c8d1bb1700195cbbd063e6c44cb1f8ddeab289148e634f77159e7c9f879fa7a5
Instruction Fuzzy Hash: C2C2B870904298DEEB22EBA4CD95BEEBBB8AF15304F1441D9E009772D2DB705B88DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F43200 Relevance: 12.2, APIs: 8, Instructions: 244
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4320A
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0000014C,00ED15F0,?,?,00000000), ref: 00F4326C
AllocateAndInitializeSid.ADVAPI32(00F9091C,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F432A9
AllocateAndInitializeSid.ADVAPI32(00F9091C,00000002,00000020,00000221,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F432C9
SetEntriesInAclW.ADVAPI32(00000002,?,00000000,?), ref: 00F43372
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00F433A9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Initialize$Allocate$DescriptorEntriesH_prolog3_Security
String ID:
API String ID: 3621466317-0
Opcode ID: 56302306175896d893dbcf7476c0b288e4d29a42b9768545a0defb3a176b0093
Instruction ID: a18f6c2e1b5c87578a915abfaea8e485b8cba3e3ed58c868e43fa5f5f97e7c66
Opcode Fuzzy Hash: 56302306175896d893dbcf7476c0b288e4d29a42b9768545a0defb3a176b0093
Instruction Fuzzy Hash: 729151B1D4025CAADB24DF55CC85BEEBBB8BF04304F4040D9E509B6292EBB45B84EF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEB40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,0000001C,33A37B94,00000000,?,?), ref: 00EEEB93

Part of subcall function 00EEEAE0: CompareStringA.KERNELBASE(00000400,00000001,000000F8,00000008,.debug,000000FF,00000000,00000000,00000000,.debug,?,00EEEBB0), ref: 00EEEB0D

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00F70328,000000FF), ref: 00EEEC4F
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,?,?), ref: 00EEEC72

Strings

.debug, xrefs: 00EEEB9F
.rdata, xrefs: 00EEEBD1
.text, xrefs: 00EEEBE3

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CompareFileInfoQueryStringSystemViewVirtual
String ID: .debug$.rdata$.text
API String ID: 2597005349-733372908
Opcode ID: 0dd89dcc1f140fdce9840cc6fbbb6162148e101f298cff318f35a3a375b0be64
Instruction ID: e9e8e3dbd339cf5b4f2cc0f17c866143e129a96a5120643a681f1befd706c361
Opcode Fuzzy Hash: 0dd89dcc1f140fdce9840cc6fbbb6162148e101f298cff318f35a3a375b0be64
Instruction Fuzzy Hash: 5F516071B006599FDB18CF6AC984AAEF7F6BF88714F248129E819E7344D730E9018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F49DF3 Relevance: 19.6, APIs: 13, Instructions: 140
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00F49E17
OpenThreadToken.ADVAPI32(00000000,?,?,?,00F49DF0,00000001), ref: 00F49E1E
GetLastError.KERNEL32(?,?,?,00F49DF0,00000001), ref: 00F49E2E
GetCurrentProcess.KERNEL32(00000008,00F49DF0,?,?,?,00F49DF0,00000001), ref: 00F49E3D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00F49DF0,00000001), ref: 00F49E44
GetLastError.KERNEL32(?,?,?,00F49DF0,00000001), ref: 00F49E4A
GetTokenInformation.KERNELBASE(00F49DF0,00000002,00000000,00000000,?,?,?,?,?,00F49DF0,00000001), ref: 00F49E7B
GetLastError.KERNEL32(?,?,?,00F49DF0,00000001), ref: 00F49E8F
new.LIBCMT ref: 00F49E99
GetTokenInformation.KERNELBASE(00F49DF0,00000002,00000000,?,?,?,?,?,00F49DF0,00000001), ref: 00F49EAE
AllocateAndInitializeSid.ADVAPI32(00000001,00000002,00000020,00000223,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F49DF0,00000001), ref: 00F49ED8
EqualSid.ADVAPI32(00000004,?,?,?,?,00F49DF0,00000001), ref: 00F49EF3
FreeSid.ADVAPI32(?,?,?,?,00F49DF0,00000001), ref: 00F49F1F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Token$ErrorLast$CurrentInformationOpenProcessThread$AllocateEqualFreeInitialize
String ID:
API String ID: 884311744-0
Opcode ID: ecc71640cd51682f6018fe53dde0ece2de460f5c5c3346eebd177e209bc9328a
Instruction ID: 103a0c5525af90a42b52d4537533d450af31bdfdffb7f7245caa5754daac4752
Opcode Fuzzy Hash: ecc71640cd51682f6018fe53dde0ece2de460f5c5c3346eebd177e209bc9328a
Instruction Fuzzy Hash: 6C414F71E0820DAEEF119BA4DC89FBFBFACEF04364F104419E901E6191D6B59D48AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EEED70 Relevance: 16.7, APIs: 11, Instructions: 180
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,33A37B94,?,00000000,00000001), ref: 00EEEDC6
CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2), ref: 00EEEDE9
GetSystemInfo.KERNELBASE(?,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94,?), ref: 00EEEE03
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,?,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000), ref: 00EEEE17
IsBadReadPtr.KERNEL32(?,000000F8,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94), ref: 00EEEE4B
UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94,?), ref: 00EEEE6C
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,33A37B94,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000), ref: 00EEEE7C
IsBadReadPtr.KERNEL32(00000101,000000F8,00000000,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?), ref: 00EEEEAF
GetLastError.KERNEL32(?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94,?), ref: 00EEEF0F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94,?), ref: 00EEEF46
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94,?), ref: 00EEEF5F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$View$CloseCreateHandleRead$ErrorInfoLastMappingSystemUnmap
String ID:
API String ID: 1718622468-0
Opcode ID: e8a6a545628cd37ca11947606090bcd08cbe1f3428b8dc199d3982974f32a74c
Instruction ID: 53dfc05277786edd9d5bb1ab19cd82736c5cf78dd847711c37532a282a643d1c
Opcode Fuzzy Hash: e8a6a545628cd37ca11947606090bcd08cbe1f3428b8dc199d3982974f32a74c
Instruction Fuzzy Hash: 56614B71A0135D9BDB20CFAACC48BAEBBB8BF04B14F145529E515FB391D7B49900CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00F43A91 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00F43A9B
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000044,00FD689C,?,00000000,00F44B64,?,00000000), ref: 00F43BAC
GetLastError.KERNEL32 ref: 00F43BC7
ShellExecuteExW.SHELL32(0000003C), ref: 00F43CF9
WaitForInputIdle.USER32(?,000003E8), ref: 00F43D74
GetExitCodeProcess.KERNEL32(?,00FD6898), ref: 00F43D98
GetLastError.KERNEL32 ref: 00F43DA2

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Part of subcall function 00EBC740: GetLastError.KERNEL32(000000FF,000000FD,?,00000000,33A37B94,?), ref: 00EBC7D9
Part of subcall function 00EBC740: SetLastError.KERNEL32(00F908E8,00000000,00000000,000000FF), ref: 00EBC83B

Strings

D, xrefs: 00F43B4E
<, xrefs: 00F43C3B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeProcessString$CodeCreateExecuteExitH_prolog3_IdleInputShellWait
String ID: <$D
API String ID: 1884863512-1382654409
Opcode ID: 0618589015d2b67ce9b832cbbc6714716a887487c9ebbf6378e5d00dd4c13546
Instruction ID: 797814acb2cec5e12b4685967f2b76751a88cbbcededefff66e9b5a6523247a8
Opcode Fuzzy Hash: 0618589015d2b67ce9b832cbbc6714716a887487c9ebbf6378e5d00dd4c13546
Instruction Fuzzy Hash: 56A15C75900248EFDF20EFA4D885BDE7BB8AF45300F14415AF905A7292EB74AA44EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F415C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00F415CF
GetModuleHandleW.KERNEL32(kernel32.dll,CreateDirectoryW,00000000,00F41EB9), ref: 00F415EC
GetProcAddress.KERNEL32(00000000), ref: 00F415EF
CreateDirectoryW.KERNELBASE(00000000,?), ref: 00F41606
GetModuleHandleW.KERNEL32(kernel32.dll,CreateDirectoryA), ref: 00F41614
GetProcAddress.KERNEL32(00000000), ref: 00F41617

Strings

kernel32.dll, xrefs: 00F415E4, 00F4160F
CreateDirectoryA, xrefs: 00F4160A
CreateDirectoryW, xrefs: 00F415DF

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc$CreateDirectoryH_prolog3
String ID: CreateDirectoryA$CreateDirectoryW$kernel32.dll
API String ID: 662308948-2917578371
Opcode ID: f1143938c65a66e8cf7f11b16f742f36541f1f22d2d796bf3e1dcc2fe963e573
Instruction ID: 82b3352e0fd1a17db43ea87035497a425811524c83ec729fc4c0b8d050655c84
Opcode Fuzzy Hash: f1143938c65a66e8cf7f11b16f742f36541f1f22d2d796bf3e1dcc2fe963e573
Instruction Fuzzy Hash: B7F0C230600708ABCF00BFB4CC99AEE3AA8FF48B51B454114B905E7182CB38DA41EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F42749 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 37
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00F42750
GetModuleHandleW.KERNEL32(kernel32.dll,GetFileAttributesW,00000000,00F41859,?,?,?,?,?,?,?,?,?,?,?,00EB85CE), ref: 00F4276A
GetProcAddress.KERNEL32(00000000), ref: 00F4276D
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00EB85CE), ref: 00F42783
GetModuleHandleW.KERNEL32(kernel32.dll,GetFileAttributesA,?,?,?,?,?,?,?,?,?,?,?,00EB85CE), ref: 00F42791
GetProcAddress.KERNEL32(00000000), ref: 00F42794

Strings

GetFileAttributesW, xrefs: 00F4275D
GetFileAttributesA, xrefs: 00F42787
kernel32.dll, xrefs: 00F42762, 00F4278C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc$AttributesFileH_prolog3
String ID: GetFileAttributesA$GetFileAttributesW$kernel32.dll
API String ID: 3512441749-1399581607
Opcode ID: 8f538a0bc99c96e64981eae795a437ec03ba9aa1f7e1fcea7164d210e5b50aa6
Instruction ID: c75637087d85d13efc176f8f51aa49757b7d1733c143a64cae78a5fbb1ef6ab4
Opcode Fuzzy Hash: 8f538a0bc99c96e64981eae795a437ec03ba9aa1f7e1fcea7164d210e5b50aa6
Instruction Fuzzy Hash: 39F0F030600708ABCF50BF74CC1AEDE3AA4AF80B10B914524F801E7182CF35CA01EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE7780 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 280
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(0000000D,?,00000001), ref: 00EE797E
GetLastError.KERNEL32 ref: 00EE7988

Part of subcall function 00F43200: __EH_prolog3_GS.LIBCMT ref: 00F4320A
Part of subcall function 00F43200: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0000014C,00ED15F0,?,?,00000000), ref: 00F4326C

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F43A91: __EH_prolog3_GS.LIBCMT ref: 00F43A9B
Part of subcall function 00F43A91: CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000044,00FD689C,?,00000000,00F44B64,?,00000000), ref: 00F43BAC
Part of subcall function 00F43A91: GetLastError.KERNEL32 ref: 00F43BC7

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

CloseHandle.KERNEL32 ref: 00EE7B09
CloseHandle.KERNEL32 ref: 00EE7B11
DeleteFileW.KERNEL32(?,?), ref: 00EE7B3D
RemoveDirectoryW.KERNEL32(?), ref: 00EE7B4F

Strings

exe, xrefs: 00EE7933
open, xrefs: 00EE7A06

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$CloseFileFreeH_prolog3_HandleString$AllocateCopyCreateDeleteDirectoryInitializeProcessRemove
String ID: exe$open
API String ID: 3427983850-3420628079
Opcode ID: cf09f7c04c8812eff45e5588b9a3fbdb9f3db90caca7345bfba7ba09b694972b
Instruction ID: 84131dac13fef5f71ebf1c60d0bb5004c4948a6cf315b0f5fa728b18b19da960
Opcode Fuzzy Hash: cf09f7c04c8812eff45e5588b9a3fbdb9f3db90caca7345bfba7ba09b694972b
Instruction Fuzzy Hash: 26C1A1B0A0425CEEEF14DF64DC46BDDBBB8EF14304F244199E458A7282DBB45B84DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EEFF50 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(00EEFD27,?,00000138,00000000,00000000,00000000), ref: 00EEFFC5
GetLastError.KERNEL32 ref: 00EEFFCF
ReadFile.KERNEL32(00EEFD27,?,00000018,00000000,00000000,33A37B94,00000000,00000000,?), ref: 00EF00BA
ReadFile.KERNEL32(00EEFD27,00000000,?,00000018,00000000), ref: 00EF013E
GetLastError.KERNEL32 ref: 00EF0148

Strings

0, xrefs: 00EF0227

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: FileRead$ErrorLast
String ID: 0
API String ID: 1577890643-4108050209
Opcode ID: 611323b466aa80449986dd070b5ed07486e4e8369214388ee7d82955125593e2
Instruction ID: 9c39419e24a7a98169cba1c227f253e42df8944f52df531cf3184fc426e236b2
Opcode Fuzzy Hash: 611323b466aa80449986dd070b5ed07486e4e8369214388ee7d82955125593e2
Instruction Fuzzy Hash: 76C10875A013289FDB60DF64CC81BEAB7F8BF09700F40559AE949E7281E774AA80DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F41641 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 51
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileW,00000003,?,?,00EBF6E7,?,?,?,?,?,?,?), ref: 00F41657
GetProcAddress.KERNEL32(00000000), ref: 00F4165A
CreateFileW.KERNELBASE(?,?,?,?,?,?,00EBF6E7,?,00EBF6E7,?,?,?,?,?,?,?), ref: 00F41685
GetModuleHandleW.KERNEL32(kernel32.dll,CreateFileA,?,00EBF6E7,?,?,?,?,?,?,?), ref: 00F4168F
GetProcAddress.KERNEL32(00000000), ref: 00F41692

Strings

kernel32.dll, xrefs: 00F4164C, 00F41656, 00F4168E
CreateFileW, xrefs: 00F41651
CreateFileA, xrefs: 00F41689

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc$CreateFile
String ID: CreateFileA$CreateFileW$kernel32.dll
API String ID: 2362759813-3217398002
Opcode ID: 31820cf11da06c90864f003af11cfa2527fd72864cd44e0940773263f8af7710
Instruction ID: b3e99f9412636c4183cdc9e562a27a319a3992157c39b0ae696b3eb7d86b0038
Opcode Fuzzy Hash: 31820cf11da06c90864f003af11cfa2527fd72864cd44e0940773263f8af7710
Instruction Fuzzy Hash: 00015A32500219BBCF025FA4DC08DEE3F2AFF087A5B194519FE15A6161CB36D860FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F43651 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNELBASE(?,_is,00000000,00000000,?,00000104,?,00000000), ref: 00F437B6
GetTempPathW.KERNEL32(00000104,00000000,?,00000104,0000010C,00ECBBC5,?,00000000,00F8B388,00000000,00000000), ref: 00F4369E

Part of subcall function 00EB9D60: GetLastError.KERNEL32(33A37B94,74DEDFA0,74DEE010), ref: 00EB9D8D
Part of subcall function 00EB9D60: SetLastError.KERNEL32(00000000), ref: 00EB9E1E

__EH_prolog3_GS.LIBCMT ref: 00F4365B

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

DeleteFileW.KERNELBASE(?), ref: 00F437DB

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F43E17: __EH_prolog3.LIBCMT ref: 00F43E1E

Strings

.tmp, xrefs: 00F4380D
_is, xrefs: 00F437B0

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FileStringTemp$AllocDeleteH_prolog3H_prolog3_NamePath
String ID: .tmp$_is
API String ID: 1410897340-3921807090
Opcode ID: 80092638975ebe2a1b0e76d848bafde1cc4b934ed6aa9a047ad351573540231c
Instruction ID: 6d261945270f0be2917ad0bcb34b81dafe2f5dca78e175911019f267fe71f44b
Opcode Fuzzy Hash: 80092638975ebe2a1b0e76d848bafde1cc4b934ed6aa9a047ad351573540231c
Instruction Fuzzy Hash: 219192B1A0025CDEDF15EBA0DC96BDEBBB8AF14300F100099E54573293DB75AB48DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F39E70 Relevance: 10.7, APIs: 7, Instructions: 159
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000004,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00F39F0E
WriteFile.KERNELBASE(?,?,00004000,?,00000000), ref: 00F39FE6
FlushFileBuffers.KERNEL32(?), ref: 00F3A020
SetFileTime.KERNELBASE(?,?,00000008,?), ref: 00F3A03E
FindCloseChangeNotification.KERNELBASE(?), ref: 00F3A0AE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$BuffersChangeCloseCreateFindFlushNotificationTimeWrite
String ID:
API String ID: 906025698-0
Opcode ID: 1a2a70d1f9dbc9c54733165c46fbaa27cd51c622bac5d54cb1d72d8e12bf9675
Instruction ID: 78eeea94bd0fabbbb3f77971559b5888dcb017673f85b3beeda48b7b8e69b3fc
Opcode Fuzzy Hash: 1a2a70d1f9dbc9c54733165c46fbaa27cd51c622bac5d54cb1d72d8e12bf9675
Instruction Fuzzy Hash: 445193B19006188BCB74DF25CC84BDEB7B8BB44330F1086A9D599E61D0DB749A8DEF51

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF760 Relevance: 10.6, APIs: 7, Instructions: 149
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,33A37B94,00F9091C,?,?), ref: 00EEF7C7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,00F70530,000000FF,?,00EEF74D,00F9091C,00000000,00F9091C), ref: 00EEF7D7
SetFilePointer.KERNELBASE(00000000,00F9091C,?,00000000), ref: 00EEF815
GetLastError.KERNEL32 ref: 00EEF81E
CloseHandle.KERNEL32(?,?,00000000,00000000,?), ref: 00EEF889
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?), ref: 00EEF8DB
CloseHandle.KERNEL32(00000000), ref: 00EEF8F2

Part of subcall function 00EEF910: CreateFileW.KERNEL32(-00000004,40000000,00000000,00000000,00000002,00000080,00000000,33A37B94,00000000,?,00000000), ref: 00EEF992
Part of subcall function 00EEF910: GetLastError.KERNEL32 ref: 00EEF9A0

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$CreateErrorLast$CloseHandle$Pointer
String ID:
API String ID: 115946061-0
Opcode ID: 9a0061c7c1c5d3ea29267e2ee0d0a665d899d54757c22eb34fa01b586a3fcbc3
Instruction ID: 5268e205004623ea203b94334e2e9e54d39915f535849f7dfc4d60f59701664c
Opcode Fuzzy Hash: 9a0061c7c1c5d3ea29267e2ee0d0a665d899d54757c22eb34fa01b586a3fcbc3
Instruction Fuzzy Hash: ED51AD30A0024CABDB24CFA5DC59BAEB7B5EF44714F10522AE812BB2D1DB70AD01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00EBF630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EBF940: FindCloseChangeNotification.KERNELBASE(?,33A37B94,74DEE010), ref: 00EBF9A0
Part of subcall function 00EBF940: __CxxThrowException@8.LIBVCRUNTIME ref: 00EBF9E9

new.LIBCMT ref: 00EBF65E
new.LIBCMT ref: 00EBF714

Part of subcall function 00EC1300: new.LIBCMT ref: 00EC1383
Part of subcall function 00EC1300: new.LIBCMT ref: 00EC13A3

GetLastError.KERNEL32(00000003,00000000,80400100,toys::file,00007530,00000000,00000000,00000000,00000000), ref: 00EBF76E

Strings

http://, xrefs: 00EBF69D
https://, xrefs: 00EBF6BD
toys::file, xrefs: 00EBF735

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ChangeCloseErrorException@8FindLastNotificationThrow
String ID: http://$https://$toys::file
API String ID: 2864113975-144175362
Opcode ID: 5503f108685365910003f1d95320e3c505a28eef2cd239440df55e8e911a6999
Instruction ID: 1dfe9994d67744d38ea36ef6986b39e49cde1c0ce7981f063e48c0e9275ec7d5
Opcode Fuzzy Hash: 5503f108685365910003f1d95320e3c505a28eef2cd239440df55e8e911a6999
Instruction Fuzzy Hash: 9D41F372A00704ABDB209F64DD42F9ABBA4FB04710F10463EFD15A72D1DB75E814DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F45667 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,GetNativeSystemInfo,?,00F43A82,?,?,?,?,?,?,?,?,?,00EC2E11,33A37B94), ref: 00F45674
GetProcAddress.KERNEL32(00000000), ref: 00F4567B
GetSystemInfo.KERNEL32(00F43A82,?,00F43A82,?,?,?,?,?,?,?,?,?,00EC2E11,33A37B94), ref: 00F45688
GetNativeSystemInfo.KERNELBASE(00F43A82,?,00F43A82,?,?,?,?,?,?,?,?,?,00EC2E11,33A37B94), ref: 00F45690

Strings

GetNativeSystemInfo, xrefs: 00F4566A
kernel32, xrefs: 00F4566F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32
API String ID: 3433367815-3846845290
Opcode ID: b38be78bd84a5f404a813435e0de2ede55ac359df0a05d02ba85e20732024347
Instruction ID: c1733254d03b6cccd2deefd4732068e82e43a46628cbac39ebef7f1570e23671
Opcode Fuzzy Hash: b38be78bd84a5f404a813435e0de2ede55ac359df0a05d02ba85e20732024347
Instruction Fuzzy Hash: 8CD0C93164060DBF9F003BE1BC0D9F93B2CAB44F667400041F90DC4092DA72D0547B56

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF070 Relevance: 9.2, APIs: 6, Instructions: 239fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,00000000,?), ref: 00EEF0C0
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00F70427), ref: 00EEF0FF

Part of subcall function 00EDF680: new.LIBCMT ref: 00EDF6AD

CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00F8B388,00F8B386), ref: 00EEF1E1
SetFilePointer.KERNELBASE(00000000,00F9091C,?,00000000), ref: 00EEF22C
ReadFile.KERNELBASE(00000000,?,0000002E,?,00000000), ref: 00EEF269
ReadFile.KERNEL32(00000000,?,0000002E,?,00000000,00000000,00F9091C,00000000,00000000,?), ref: 00EEF2D9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$ErrorLastRead$CreatePointer
String ID:
API String ID: 3079590808-0
Opcode ID: 20a1feed0d7561f9d033b8d8fb615d2f8144b88de299c963349b10f111b24fbb
Instruction ID: 0069529b09dafe96144fe16a9f3df48bfd2af378540f2550d07dbc424961c280
Opcode Fuzzy Hash: 20a1feed0d7561f9d033b8d8fb615d2f8144b88de299c963349b10f111b24fbb
Instruction Fuzzy Hash: 30A1BEB0A0078AEFDB20DF66C94879ABBF4FF44708F105529E506ABA81D775F915CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F417CE Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F417D8
GetLastError.KERNEL32 ref: 00F41879
GetLastError.KERNEL32 ref: 00F4193E
__CxxThrowException@8.LIBVCRUNTIME ref: 00F419AE

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F419C3: __EH_prolog3_catch_GS.LIBCMT ref: 00F419CD
Part of subcall function 00F419C3: __CxxThrowException@8.LIBVCRUNTIME ref: 00F41A8C

Strings

, xrefs: 00F41967

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Exception@8Throw$H_prolog3_H_prolog3_catch_
String ID:
API String ID: 3130792420-3916222277
Opcode ID: e0f6771bcbb6a36822ed050279f30f87c5cf6a1e0282430495063cf19714ccd3
Instruction ID: 19c6f4e9a3363a49e90cfa6df1b2ebd9b45ec61234af717814cd4acce5fe8943
Opcode Fuzzy Hash: e0f6771bcbb6a36822ed050279f30f87c5cf6a1e0282430495063cf19714ccd3
Instruction Fuzzy Hash: 7351BE7080025C9EEF25EB64CD95BED7FA4BF01354F481199EC4923293DB349AC9EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBF790 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00EBF820

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

SetFilePointer.KERNELBASE(?,00000003,33A37B94,?,33A37B94,?,?,?), ref: 00EBF82C
__CxxThrowException@8.LIBVCRUNTIME ref: 00EBF880
GetLastError.KERNEL32(00000001,00FCE19C,00F9091C,00000001,?,33A37B94), ref: 00EBF885
__CxxThrowException@8.LIBVCRUNTIME ref: 00EBF8D2

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EBF330: GetLastError.KERNEL32(33A37B94,00000000), ref: 00EBF393
Part of subcall function 00EBF330: new.LIBCMT ref: 00EBF3A9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Exception@8Throw$ExceptionFilePointerRaise
String ID:
API String ID: 699254983-0
Opcode ID: 59d985d57378b83942ff7c574a639034662b9816b90ef3affdd72c79f050db27
Instruction ID: b397ba86dd9176be746dde1828ddbbce5a0fe32659d0907dfbf52d7e828f3cb3
Opcode Fuzzy Hash: 59d985d57378b83942ff7c574a639034662b9816b90ef3affdd72c79f050db27
Instruction Fuzzy Hash: AD416D71A00208EFDB14EFA4DD85FEFB7B8EB04314F104129F916A3292DB74AA09DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EEFCA0 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EEFCE2

Part of subcall function 00EEFE70: GetLastError.KERNEL32(33A37B94,?,00000000,00EEFD01,00000004,74DF34C0), ref: 00EEFEAC
Part of subcall function 00EEFE70: SetLastError.KERNEL32(?), ref: 00EEFEEB

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001,00000004,74DF34C0), ref: 00EEFD16

Part of subcall function 00EEFF50: ReadFile.KERNEL32(00EEFD27,?,00000138,00000000,00000000,00000000), ref: 00EEFFC5
Part of subcall function 00EEFF50: GetLastError.KERNEL32 ref: 00EEFFCF

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

SetFilePointer.KERNELBASE(00000000,?,00000000,00000001,?,?,-00000010,00000000,00F9091C,00000000,00000000,?,00000000,00000000), ref: 00EEFDC9
GetLastError.KERNEL32(?,-00000010,00000000,00F9091C,00000000,00000000,?,00000000,00000000), ref: 00EEFDD1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$File$FreePointerString$Read
String ID:
API String ID: 3966585283-0
Opcode ID: ff5ab28f6dd9f69386e98f80dff4096200339245862ab12b6853fc6edb64c7e7
Instruction ID: ed1fd6facdd7fe84133adf66b181e256de3cfa61a65510507854cc2459dbebce
Opcode Fuzzy Hash: ff5ab28f6dd9f69386e98f80dff4096200339245862ab12b6853fc6edb64c7e7
Instruction Fuzzy Hash: F141EF71A00248EFDF10DFA5CD55BEEBBF8EB04314F204269E915E7292DB74AA04DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5900 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00EE594B
GetLastError.KERNEL32 ref: 00EE597C
new.LIBCMT ref: 00EE599B
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE59BF

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: DirectoryErrorExceptionException@8LastRaiseThrowWindows
String ID:
API String ID: 1415589362-0
Opcode ID: 152182543ebbb813cbd0cc0cc2727c790d4e335d9656b126e9e1b7fe232556cf
Instruction ID: 0be3551147f2625ae415e0d51d7d8f76610b8dd15a8559e241ac3b939e5f86ed
Opcode Fuzzy Hash: 152182543ebbb813cbd0cc0cc2727c790d4e335d9656b126e9e1b7fe232556cf
Instruction Fuzzy Hash: 87314DB1901258EEDB60EF94DC49BDDBBF8EB18704F0001D9E409A7292DBB45B84DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F39F74 Relevance: 6.1, APIs: 4, Instructions: 76filetimeCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00004000,?,00000000), ref: 00F39FE6
FlushFileBuffers.KERNEL32(?), ref: 00F3A020
SetFileTime.KERNELBASE(?,?,00000008,?), ref: 00F3A03E
GetLastError.KERNEL32(?,00004000,?,0000000C), ref: 00F3A090
FindCloseChangeNotification.KERNELBASE(?), ref: 00F3A0AE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$BuffersChangeCloseErrorFindFlushLastNotificationTimeWrite
String ID:
API String ID: 3065014259-0
Opcode ID: 00dccfc36386cccbae4548bdc7f5e81fa8a540a454da0bc0ab6ae1a02f053aa1
Instruction ID: 12414579c3f93e7512f4bfdbc38a79c2390ed6ad37eb66b00e00047c6c9a903b
Opcode Fuzzy Hash: 00dccfc36386cccbae4548bdc7f5e81fa8a540a454da0bc0ab6ae1a02f053aa1
Instruction Fuzzy Hash: F8217FB1A005188BCF74DB28CC847EDB379BB44330F1086AAD5A9961D0DB759E89EF52

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4610 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,00000000,?,00000000,00F60BC9,000000FF,?,string too long,invalid string position,invalid string position,?,00000000,?,?,00EB4050), ref: 00EB4652
SetLastError.KERNEL32(?,?,00000000,000000FF,?,00000000,00F60BC9,000000FF,?,string too long,invalid string position,invalid string position,?,00000000,?), ref: 00EB46B4

Strings

invalid string position, xrefs: 00EB45EC, 00EB45F6
string too long, xrefs: 00EB4600

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: invalid string position$string too long
API String ID: 1452528299-4289949731
Opcode ID: 2b04ffc72bb57691fa5a822b7e83134d6ceeaef23bd4150fcab6d63fc434001a
Instruction ID: 69101a13a43dfae8b2747bcc989131936675096b70769c1963d5e78ca1d5174d
Opcode Fuzzy Hash: 2b04ffc72bb57691fa5a822b7e83134d6ceeaef23bd4150fcab6d63fc434001a
Instruction Fuzzy Hash: 81219DB1604649EFD700CF18C948BAABBF4FF49728F208359E4149B792D7B5E904DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F41D94 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F41D9E

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Part of subcall function 00EB4A50: GetLastError.KERNEL32(33A37B94,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4A92
Part of subcall function 00EB4A50: SetLastError.KERNEL32(?,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4AD1

GetLastError.KERNEL32 ref: 00F41EC0

Strings

\, xrefs: 00F41E0B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3_
String ID: \
API String ID: 2549205776-2967466578
Opcode ID: fd4baea4c9b77536176bd9d1495ec979b6dcb0e819da254dee5844b9d466870f
Instruction ID: 178b3d062fa437898991dc082e9ef248eabc8e8c3a15a9c179225742a9ac930c
Opcode Fuzzy Hash: fd4baea4c9b77536176bd9d1495ec979b6dcb0e819da254dee5844b9d466870f
Instruction Fuzzy Hash: 8241B3B591021CDEDF14EF64DC85BEE7BB8BF15310F101159E849A3283EB70AA89EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EC0AF0 Relevance: 4.6, APIs: 3, Instructions: 85fileCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00EC0B96

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

ReadFile.KERNELBASE(?,00000000,000000FF,33A37B94,00000000), ref: 00EC0BA3
__CxxThrowException@8.LIBVCRUNTIME ref: 00EC0BEC

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EBF330: GetLastError.KERNEL32(33A37B94,00000000), ref: 00EBF393
Part of subcall function 00EBF330: new.LIBCMT ref: 00EBF3A9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Exception@8Throw$ExceptionFileRaiseRead
String ID:
API String ID: 686783228-0
Opcode ID: 9d44139f922fff56a2209d5b0428fc9b9fe0bb182d670a15443ca6961d39ae86
Instruction ID: b9407262d8bb905e9b789f48688294b4d1cb192663011267dc008dd042e4f15a
Opcode Fuzzy Hash: 9d44139f922fff56a2209d5b0428fc9b9fe0bb182d670a15443ca6961d39ae86
Instruction Fuzzy Hash: 6B31FE75900218EFDB20DF54CD45FEFB7B8EB44714F00855AE819A3282DB75AA499B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F43034 Relevance: 4.6, APIs: 3, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4303B

Part of subcall function 00EB4A50: GetLastError.KERNEL32(33A37B94,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4A92
Part of subcall function 00EB4A50: SetLastError.KERNEL32(?,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4AD1

UuidToStringW.RPCRT4(?,?), ref: 00F4307B

Part of subcall function 00F4540D: __EH_prolog3.LIBCMT ref: 00F45414
Part of subcall function 00F4540D: CharUpperW.USER32(00000000,?,?,0000000C,00F430A6,00F8B388), ref: 00F45436

RpcStringFreeW.RPCRT4(00000000), ref: 00F430AA

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$String$Free$CharH_prolog3H_prolog3_UpperUuid
String ID:
API String ID: 3172286170-0
Opcode ID: 13b31750d9e6da1a02d03a2a32f49b9d79b4064f5ca4e167ad57a6f3005331d2
Instruction ID: 5fbd7ff28a69a9860db704ad0ff3c1609efa411acbcde8d5f427a2e18a649bc1
Opcode Fuzzy Hash: 13b31750d9e6da1a02d03a2a32f49b9d79b4064f5ca4e167ad57a6f3005331d2
Instruction Fuzzy Hash: BD111C71E00618DBDB01EFD0DC95BEEB7B9BF44701F400029E505EB296DB749A49DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F48D2B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F48D35

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F4889E: __EH_prolog3_GS.LIBCMT ref: 00F488A5

Part of subcall function 00EB4A50: GetLastError.KERNEL32(33A37B94,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4A92
Part of subcall function 00EB4A50: SetLastError.KERNEL32(?,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4AD1

Strings

], xrefs: 00F48E67

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3_
String ID: ]
API String ID: 3339191932-3352871620
Opcode ID: 7b6480c8fe3233e6b369a99756edf8f3f83e90ab0e0074391d9e4ae0a20d40fd
Instruction ID: d44d66110c2476278e354056b6c3dab570be715c7f01f747b6e012b75247dd46
Opcode Fuzzy Hash: 7b6480c8fe3233e6b369a99756edf8f3f83e90ab0e0074391d9e4ae0a20d40fd
Instruction Fuzzy Hash: 11A13E71900218DECB25EB64CC91BDEBBB8AF14300F504599E509B3292EF34AB89DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4000 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

string too long, xrefs: 00EB40EE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: string too long
API String ID: 0-2556327735
Opcode ID: 3755226ef6d9bae18869818bf64500124130ae172b2bbecb2213ebf4854ff218
Instruction ID: f519cb2101ec53667e649fb68ad7de41a031b8a522f03198a15e42d2181e1538
Opcode Fuzzy Hash: 3755226ef6d9bae18869818bf64500124130ae172b2bbecb2213ebf4854ff218
Instruction Fuzzy Hash: 9941E5B23142149B8624BE5CF8808EBF3FAEF94725310552FE646D7682D732EC5487A6

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEAE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000400,00000001,000000F8,00000008,.debug,000000FF,00000000,00000000,00000000,.debug,?,00EEEBB0), ref: 00EEEB0D

Strings

.debug, xrefs: 00EEEAE3, 00EEEB02

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CompareString
String ID: .debug
API String ID: 1825529933-652440927
Opcode ID: cad27cc1b09230d260ec6fe4b7dff25a6c8efa90d6e261735dffa688f525c768
Instruction ID: 722907cb600555141c6fad8ae4490bb6e5f55f82fe5c18cf3430d61cf6f190ea
Opcode Fuzzy Hash: cad27cc1b09230d260ec6fe4b7dff25a6c8efa90d6e261735dffa688f525c768
Instruction Fuzzy Hash: 30F02B3270001866CB208A4FAC86ABAF399EB84331F554266FD0ED7284D4619C4082A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEFB90 Relevance: 3.1, APIs: 2, Instructions: 104fileCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057), ref: 00EEFB9E
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00EEFBCF

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 6c768556e97cfa5664f5f59ea95770c8321636baf0b28f018665905b7f09d12d
Instruction ID: d4c8e0d15ff62a660ce3b782bf271ffdba364f6613b84f95b71977ff28e9d7fe
Opcode Fuzzy Hash: 6c768556e97cfa5664f5f59ea95770c8321636baf0b28f018665905b7f09d12d
Instruction Fuzzy Hash: 5531D031A0074D9FCB20CE29C880AABB7A6FF88310F218569EC56A7341D730ED10CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4370 Relevance: 3.1, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00EB43E8
SysFreeString.OLEAUT32(00000000), ref: 00EB4460

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: aff37bd0ecc918af2a8f4aff628e1f7e13b19102f9cee1a94a4b929a84dab0dc
Instruction ID: a9a32cc18030fd886d995fa05851d44f122172415888c8ac779c3a138c9bc1db
Opcode Fuzzy Hash: aff37bd0ecc918af2a8f4aff628e1f7e13b19102f9cee1a94a4b929a84dab0dc
Instruction Fuzzy Hash: 82317CB1A04704DBCB24CF68D9847ABB7F9FB44714F20062EE466E7791DB70A9148BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEF80 Relevance: 3.1, APIs: 2, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00EEED70: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,33A37B94,?,00000000,00000001), ref: 00EEEDC6
Part of subcall function 00EEED70: CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2), ref: 00EEEDE9
Part of subcall function 00EEED70: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94,?), ref: 00EEEE03
Part of subcall function 00EEED70: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,?,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000), ref: 00EEEE17
Part of subcall function 00EEED70: IsBadReadPtr.KERNEL32(?,000000F8,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94), ref: 00EEEE4B
Part of subcall function 00EEED70: UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000,00000000,?,33A37B94,?), ref: 00EEEE6C
Part of subcall function 00EEED70: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,33A37B94,?,?,?,?,?,00000000,00F70368,000000FF,?,00EEEFE2,00000000), ref: 00EEEE7C

FindCloseChangeNotification.KERNELBASE(00000000,?,?,?), ref: 00EEF036
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00EEF04F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$View$CloseCreate$ChangeFindHandleInfoMappingNotificationReadSystemUnmap
String ID:
API String ID: 2649132672-0
Opcode ID: 430c9388a1dc7fe22e8f7c77955ef69ce092fdee83a309ac16df5e8bb1780266
Instruction ID: a53378ce475e67d46b096d296b0b76ddd4033ccae301e7e82b3bf955213912fa
Opcode Fuzzy Hash: 430c9388a1dc7fe22e8f7c77955ef69ce092fdee83a309ac16df5e8bb1780266
Instruction Fuzzy Hash: 9B21BF71E0169DABDB11CF99C944BAFBBF8EB44708F144229D810B7382D7B59E0487E1

Uniqueness

Uniqueness Score: -1.00%

Function 00EBF940 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,33A37B94,74DEE010), ref: 00EBF9A0
__CxxThrowException@8.LIBVCRUNTIME ref: 00EBF9E9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ChangeCloseException@8FindNotificationThrow
String ID:
API String ID: 232429529-0
Opcode ID: 479ac40ebe5506fb6490b1a86985049ac49f9f69231a221cd62b318e8e68be81
Instruction ID: 9a81ba71c7931a4d71e5fe5df008c47539c3557fc5a4ff374111248228938768
Opcode Fuzzy Hash: 479ac40ebe5506fb6490b1a86985049ac49f9f69231a221cd62b318e8e68be81
Instruction Fuzzy Hash: A0218370600608EFCB24EFA4DD55BABB7B8FF04724F00462DE426A3AD1DB74A904CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4150 Relevance: 2.6, APIs: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 634070dcf000ab72c96320c31261fe811bcb02eebd44ca728f6c509b82f40322
Instruction ID: 55969db3dc5db2a0c2ef295f27f1f02f8001d046eb02a48053d39297ad811f1d
Opcode Fuzzy Hash: 634070dcf000ab72c96320c31261fe811bcb02eebd44ca728f6c509b82f40322
Instruction Fuzzy Hash: F721ACB160064AEFD700DF18C948B9AFBF4FB08314F148269E805D7B91D7B1EA50CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EB6F90 Relevance: 2.6, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7c29ea45b31cb719a97eb91f9444a95046cc8bfe4dfa5fb1e3b87384d2525b31
Instruction ID: 13d8adfda5f4b6a614ae28320366e813681dfced22ebe088b0e1eff5933c1252
Opcode Fuzzy Hash: 7c29ea45b31cb719a97eb91f9444a95046cc8bfe4dfa5fb1e3b87384d2525b31
Instruction Fuzzy Hash: F5219DB1604649EFD710CF18C948BAABBF4FF48728F208359E4249B791D7B5E904DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EBFDF0 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00EC1460: GetLastError.KERNEL32(33A37B94,74DEDFA0,?,?,?,00F645F9,000000FF,?,00EBF578,?,00000000), ref: 00EC1497
Part of subcall function 00EC1460: SetLastError.KERNEL32(?), ref: 00EC14D6

new.LIBCMT ref: 00EBFE5A

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EBF630: new.LIBCMT ref: 00EBF65E

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID:
API String ID: 2425351278-0
Opcode ID: f314ab820f90b0b37665b7814af8672bac7684bee2d6cb514719d20f176e789f
Instruction ID: 14da673ef68657708a28b05ff0bfb47aeb5e46ed0f0a7056929902cca7a4290b
Opcode Fuzzy Hash: f314ab820f90b0b37665b7814af8672bac7684bee2d6cb514719d20f176e789f
Instruction Fuzzy Hash: B1418070901289DEEF21DFA8CC55BEEBBF0EB01314F104169E955BB2C1EB749A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4889E Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F488A5

Part of subcall function 00EB4A50: GetLastError.KERNEL32(33A37B94,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4A92
Part of subcall function 00EB4A50: SetLastError.KERNEL32(?,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4AD1

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EBFDF0: new.LIBCMT ref: 00EBFE5A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3_
String ID:
API String ID: 3339191932-0
Opcode ID: ed40bf7dcb1bf603ef9cba05400853d7c265d2a76c4538339a2838efcdee165e
Instruction ID: 58a63d422b0b41bf76c13b5d1d4eaffa9c0704ee559056223fc49f463c3a0b6e
Opcode Fuzzy Hash: ed40bf7dcb1bf603ef9cba05400853d7c265d2a76c4538339a2838efcdee165e
Instruction Fuzzy Hash: 1F317E75904218ABDF10EBA4CC85AEFBBB8AF55754F100058F91577283EB70AE06DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE2B70 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EE2B9F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c557db2288c89b9a1636e5f49f13dfaf7869b0b5c5b3268040336644c3bb21
Instruction ID: d13a8bdb201d23093750d31aa59b3e5a9a670b89e61f40f4ea0e1fde6c19e1a5
Opcode Fuzzy Hash: a0c557db2288c89b9a1636e5f49f13dfaf7869b0b5c5b3268040336644c3bb21
Instruction Fuzzy Hash: CF0180B1A012499FD724CF5DC941B96F7F8FB48724F14466EE915D7380E731A900CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F56BB6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F573BB,00000001,00000364,?,00F4DFF8,?,?,?,?,?,00F3FACB,00F3FBA7), ref: 00F56BF7

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d1238cbc7e7b3b3439d4b217b810e4509272d301560960fe082491582d8a51d0
Instruction ID: 323ec723297d8c9c99fb7b4987a319e5077d2086de3f1823f131f9ad379359d0
Opcode Fuzzy Hash: d1238cbc7e7b3b3439d4b217b810e4509272d301560960fe082491582d8a51d0
Instruction Fuzzy Hash: CAF0B432A08A25B69B219A269C05B9A3B58DF81773B544111BE68DB180DB34DC0DB2E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F430D2 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00F430F0

Part of subcall function 00F43034: __EH_prolog3_GS.LIBCMT ref: 00F4303B
Part of subcall function 00F43034: UuidToStringW.RPCRT4(?,?), ref: 00F4307B
Part of subcall function 00F43034: RpcStringFreeW.RPCRT4(00000000), ref: 00F430AA

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: StringUuid$CreateFreeH_prolog3_
String ID:
API String ID: 3372217299-0
Opcode ID: f0d9451ff7f1e652dda2ed39ff772eba6aa927dfe95e004d70138898d4e4edba
Instruction ID: 6f24367568de30b9219f116b9031c81022f92c05a764cda8cd9dd0cc406a86f7
Opcode Fuzzy Hash: f0d9451ff7f1e652dda2ed39ff772eba6aa927dfe95e004d70138898d4e4edba
Instruction Fuzzy Hash: A8F08232A01108A7CB00EFEDDD869AFFBB9EB45211F904169E905AB201DA765A0487E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F56B68 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00F3FBA7,?,?,00F4DFF8,?,?,?,?,?,00F3FACB,00F3FBA7,?,?,?,?), ref: 00F56B9A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 368ad13a963fc2ce223c70b829a40c2ff98afdc2fae8c1b78ca944098f61787d
Instruction ID: 3206221ebf11a6bd168c87eb81ecb618ebd2971efa39c004843f8f8f41ef8bf5
Opcode Fuzzy Hash: 368ad13a963fc2ce223c70b829a40c2ff98afdc2fae8c1b78ca944098f61787d
Instruction Fuzzy Hash: 8DE0E5329046247BDA312B259D01F5A3B5C9B827F3F850210AE64E7091EE24DC4872E4

Uniqueness

Uniqueness Score: -1.00%

Function 00F43E17 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F43E1E

Part of subcall function 00F41D94: __EH_prolog3_GS.LIBCMT ref: 00F41D9E
Part of subcall function 00F41D94: GetLastError.KERNEL32 ref: 00F41EC0

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString$H_prolog3H_prolog3_
String ID:
API String ID: 2488494826-0
Opcode ID: a1c89428b3b549700c509d4259926585cd29d67d2661104a91d9cd9d2a9b27f1
Instruction ID: a8bee6be6312b0ab1df5ecb76819c28cafda084a4d483953583bcdf56efe1689
Opcode Fuzzy Hash: a1c89428b3b549700c509d4259926585cd29d67d2661104a91d9cd9d2a9b27f1
Instruction Fuzzy Hash: 17D0C2E89610006AEF48BB24CC135EE3B54EB10300F005829BE1547383FA38AA08D1E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F49F51 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00F49DF0,?,00F49E8A,00F49DF0,00000000,?,?,?,00F49DF0,00000001), ref: 00F49F57

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e4a03b4a5323bc801596cb850bda8bfaceb5d5a9871090bc76ae848519ff7426
Instruction ID: aa67594c90a8508476019ea71abe04ae8b6912cbc12889c3e094f7e9dbac32df
Opcode Fuzzy Hash: e4a03b4a5323bc801596cb850bda8bfaceb5d5a9871090bc76ae848519ff7426
Instruction Fuzzy Hash: E0B0123800414CBBCF011F51EC084E87F6CDB05560B008050FC5C45323DB329511AB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ECB630 Relevance: 157.6, APIs: 17, Strings: 71, Instructions: 3644windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

GetLastError.KERNEL32 ref: 00ECBC90
SetLastError.KERNEL32(00F908E8), ref: 00ECBCF7
MessageBoxW.USER32(00000000,?,?,00000010), ref: 00ECBF27

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F417CE: __EH_prolog3_GS.LIBCMT ref: 00F417D8

MoveFileExW.KERNEL32(?,00000004,00000001,?,00F9091C,setup.xml,00000000,00000000,00000000,?,00000001,00000000,00F9091C), ref: 00ECC2FE
GetLastError.KERNEL32 ref: 00ECC33C

Part of subcall function 00F39100: GetDateFormatW.KERNEL32(00000800,00000000,00000000,M-d-yyyy,00000000,00000080,00000001,00000080,00000001,?), ref: 00F3917C
Part of subcall function 00F39100: GetTimeFormatW.KERNEL32(00000800,00000000,00000000,hh':'mm':'ss tt,00000000,00000080,?,00000080), ref: 00F391D8

Part of subcall function 00EB4810: GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
Part of subcall function 00EB4810: SetLastError.KERNEL32(?), ref: 00EB48AA

Strings

EvalMarker.dat, xrefs: 00ECE1D9
Engine: reloading engine state info for resume/reboot, xrefs: 00ECC49A
Engine: we're not running after reboot, xrefs: 00ECCB70
Engine: setup will run silent, xrefs: 00ECB71C
Engine: attempt to launch with updated suite install failed with status 0x%08x, continuing normal setup, xrefs: 00ECEBB4
ISPassiveInstall, xrefs: 00ECB944
Engine: ***warning: this suite appears to be running without elevated privileges, the InstallScript debugger requires admin privil, xrefs: 00ECBAE5
Engine: no command line mode specified, evaluating setup.xml install mode block for mode, xrefs: 00ECD0E4
Failed to evaluate abort condition (text '%s'), result: %x, xrefs: 00ECF00B
Engine: initializing resources, xrefs: 00ECC6CF
yes, xrefs: 00ECD393, 00ECD3A2
InstallMode, xrefs: 00ECCDE7
Engine: final mode we're running in: %d, xrefs: 00ECCDBC
., xrefs: 00ECF271
repair, xrefs: 00ECCE5E
passive, xrefs: 00ECB86F
silent, xrefs: 00ECB6BB
ISPassword, xrefs: 00ECD7AC
ProductVersion, xrefs: 00ECC5E9, 00ECC650
stage_only, xrefs: 00ECCCBC
Password, xrefs: 00ECE145
The resource %s failed to initialize, status %x, xrefs: 00ECC931
BetaMarker.dat, xrefs: 00ECE28A
ISInstallMode, xrefs: 00ECD3CE
ISLogDir, xrefs: 00ECDEFF, 00ECE03F
Engine: setup will run with minimal UI, xrefs: 00ECB8CC
No setup.xml was present in the setup stream, xrefs: 00ECBE79
Engine: sending initialize event to UI, xrefs: 00ECE363
ISEnablePerParcelLogging, xrefs: 00ECDB24
SetupEngine.cpp, xrefs: 00ECB6FA, 00ECB8AA, 00ECBA6A, 00ECBA8A, 00ECBAC3, 00ECBE57, 00ECC0C0, 00ECC0DF, 00ECC13E, 00ECC328, 00ECC34A, 00ECC3AD, 00ECC478, 00ECC58D, 00ECC5AD, 00ECC6AD, 00ECC916, 00ECC93C, 00ECCA3A, 00ECCA5A, 00ECCB4E, 00ECCC19, 00ECCCFB, 00ECCDA2, 00ECCDC7, 00ECCE9D, 00ECCF8A, 00ECD035, 00ECD0C2, 00ECD18F, 00ECD1B2, 00ECD254, 00ECD37F, 00ECD3AE, 00ECD46A, 00ECE33E, 00ECE7D0, 00ECE7F1, 00ECE99C, 00ECE9BC, 00ECEB9E, 00ECEBBF, 00ECEBEE, 00ECEC89, 00ECEE70, 00ECEF07, 00ECEFF5, 00ECF016
Error extracting setup.xml., xrefs: 00ECBEC9
Engine: mode is maintenance: %s, xrefs: 00ECD3A3
f3:, xrefs: 00ECBD0E, 00ECBFC9
Engine: not rebooted or maintenance, checking for suite update (update: '%s', updated from: '%s'), xrefs: 00ECE7E6
ISOnRebooted, xrefs: 00ECC1D8
Engine: running after reboot, xrefs: 00ECC160
password:, xrefs: 00ECD6EF, 00ECD72A
No UI DLL was initialized. This is likely due to a missing UIResource in setup.xml, xrefs: 00ECD48F
Engine: script debug option specified, will enable script debugging; symbol path: '%s', xrefs: 00ECBA7F
Evaluating abort conditions, xrefs: 00ECEF1E
modify, xrefs: 00ECCFFA
Engine: command line specified remove mode, xrefs: 00ECCFAC
updated_from:, xrefs: 00ECE6DD
Engine: initialization complete, xrefs: 00ECEE95
Engine: command line specified maintenance/modify mode, xrefs: 00ECD057
true, xrefs: 00ECB7AE, 00ECB91C, 00ECC1B0
Engine: update not found, xrefs: 00ECEC05
ISSelectedLanguage, xrefs: 00ECDA3F, 00ECDA90
TempFolder, xrefs: 00ECDFA6
InstallShield, xrefs: 00ECE977
ISSilentInstall, xrefs: 00ECB7D6
ShowLanguageSelection, xrefs: 00ECD9BF
Engine: update URL is '%s', xrefs: 00ECE9B1
Could not move setup.xml to new stage path, error %d, file will not be cleaned up, xrefs: 00ECC33F
No UI DLL was initialized. This is likely due to a missing UIResource in setup.xml., xrefs: 00ECD524
InstallShield Wizard, xrefs: 00ECBEF1, 00ECD2B9, 00ECD54F
Engine: failed to initialize resources, error %x, xrefs: 00ECCA4F
Engine: failed to evaluate install mode %d condition, error %x, xrefs: 00ECD1A7
language:, xrefs: 00ECD7E0, 00ECD875
Engine: sending rebooted event to UI, xrefs: 00ECECAE
Engine: command line specified stage only mode, xrefs: 00ECCD1D
Engine: parsing setup.xml, xrefs: 00ECC0D4
An invalid condition was encountered:Error: 0x%08xThe setup will now abort., xrefs: 00ECD220
Determining setup mode..., xrefs: 00ECCC3B
log, xrefs: 00ECDAF6
Engine: command line specified repair mode, xrefs: 00ECCEBF
setup.xml, xrefs: 00ECBD3D, 00ECC2B0
remove, xrefs: 00ECCF4F
Engine: initializing predefined path properties, xrefs: 00ECC3CF
Command Line: %s, xrefs: 00ECC5A2
setup.xml, xrefs: 00ECBDB1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$String$Free$Format$AllocDateFileH_prolog3_MessageMoveTime
String ID: .$An invalid condition was encountered:Error: 0x%08xThe setup will now abort.$BetaMarker.dat$Command Line: %s$Could not move setup.xml to new stage path, error %d, file will not be cleaned up$Determining setup mode...$Engine: ***warning: this suite appears to be running without elevated privileges, the InstallScript debugger requires admin privil$Engine: attempt to launch with updated suite install failed with status 0x%08x, continuing normal setup$Engine: command line specified maintenance/modify mode$Engine: command line specified remove mode$Engine: command line specified repair mode$Engine: command line specified stage only mode$Engine: failed to evaluate install mode %d condition, error %x$Engine: failed to initialize resources, error %x$Engine: final mode we're running in: %d$Engine: initialization complete$Engine: initializing predefined path properties$Engine: initializing resources$Engine: mode is maintenance: %s$Engine: no command line mode specified, evaluating setup.xml install mode block for mode$Engine: not rebooted or maintenance, checking for suite update (update: '%s', updated from: '%s')$Engine: parsing setup.xml$Engine: reloading engine state info for resume/reboot$Engine: running after reboot$Engine: script debug option specified, will enable script debugging; symbol path: '%s'$Engine: sending initialize event to UI$Engine: sending rebooted event to UI$Engine: setup will run silent$Engine: setup will run with minimal UI$Engine: update URL is '%s'$Engine: update not found$Engine: we're not running after reboot$Error extracting setup.xml.$EvalMarker.dat$Evaluating abort conditions$Failed to evaluate abort condition (text '%s'), result: %x$ISEnablePerParcelLogging$ISInstallMode$ISLogDir$ISOnRebooted$ISPassiveInstall$ISPassword$ISSelectedLanguage$ISSilentInstall$InstallMode$InstallShield$InstallShield Wizard$No UI DLL was initialized. This is likely due to a missing UIResource in setup.xml$No UI DLL was initialized. This is likely due to a missing UIResource in setup.xml.$No setup.xml was present in the setup stream$Password$ProductVersion$SetupEngine.cpp$ShowLanguageSelection$TempFolder$The resource %s failed to initialize, status %x$f3:$language:$log$modify$passive$password:$remove$repair$setup.xml$setup.xml$silent$stage_only$true$updated_from:$yes
API String ID: 4022214443-2701837669
Opcode ID: 083ecb1e06a4b1e37313618002ec416b3153ff8e34a7bb314b8358ec909ed5ea
Instruction ID: e78da4cfab0b3ffd23ea7e57c360b7446f03a2aa26179763f5db91f64c14d286
Opcode Fuzzy Hash: 083ecb1e06a4b1e37313618002ec416b3153ff8e34a7bb314b8358ec909ed5ea
Instruction Fuzzy Hash: 3483A9B09012889EDF25DB64CE85BDEBBB4AF10304F1401ADE5497B292DBB06F4ADF51

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2D20 Relevance: 40.6, APIs: 9, Strings: 14, Instructions: 316pipeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F430D2: UuidCreate.RPCRT4(?), ref: 00F430F0

CreateNamedPipeW.KERNEL32(?,00000003,00000000,00000001,00001000,00001000,00000000,00000000,?,?,?,?), ref: 00ED2DC4
GetLastError.KERNEL32(?,?,?,?), ref: 00ED2DFB
CreateEventW.KERNEL32(00000000,00000001,00000000,?,?,?,?,?,?,?,?), ref: 00ED2E57
CloseHandle.KERNEL32(00000000,?), ref: 00ED31DA

Strings

Failed to allocate proxy handler, xrefs: 00ED30ED
Timed out waiting for proxy to respond, xrefs: 00ED3035
Failed to create pipe server for elevated proxy, error %x, xrefs: 00ED2E08
runas, xrefs: 00ED2EC2, 00ED2ED7
\\.\pipe\ISEngine_, xrefs: 00ED2D89
Failed to connect/verify proxy, error %x, xrefs: 00ED3143
Failed to launch proxy process '%s', error %x, xrefs: 00ED2FCC
open, xrefs: 00ED2EB3
SetupEngine.cpp, xrefs: 00ED2DE7, 00ED2E0D, 00ED2FB1, 00ED2FD1, 00ED3013, 00ED30D9, 00ED316B
!, xrefs: 00ED310B
Failed to initialize proxy communication, error %x, xrefs: 00ED3160
-IS_temp, xrefs: 00ED2E93
-embedded:, xrefs: 00ED2E76
IS_ProxyWaiter_, xrefs: 00ED2E2A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Create$CloseErrorEventHandleLastNamedPipeUuid
String ID: -IS_temp$!$-embedded:$Failed to allocate proxy handler$Failed to connect/verify proxy, error %x$Failed to create pipe server for elevated proxy, error %x$Failed to initialize proxy communication, error %x$Failed to launch proxy process '%s', error %x$IS_ProxyWaiter_$SetupEngine.cpp$Timed out waiting for proxy to respond$\\.\pipe\ISEngine_$open$runas
API String ID: 2889566602-412059878
Opcode ID: c0cb7602a0666c50477547398c06e131c4994db53339920f34f7197b790d7279
Instruction ID: b5a58f6c43a3ba6513b74a299b14ea16bc023963aa29697cb56189cf9eef42c6
Opcode Fuzzy Hash: c0cb7602a0666c50477547398c06e131c4994db53339920f34f7197b790d7279
Instruction Fuzzy Hash: E6D1AF70905258EEEF21DBA4DC45BEEBBB4AB15304F1401D9E408B72C2DBB45B49EF52

Uniqueness

Uniqueness Score: -1.00%

Function 00EFCA90 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EFCADF
new.LIBCMT ref: 00EFCB21
new.LIBCMT ref: 00EFCB60
new.LIBCMT ref: 00EFCBA2
new.LIBCMT ref: 00EFCBE1
new.LIBCMT ref: 00EFCC20
new.LIBCMT ref: 00EFCC62
new.LIBCMT ref: 00EFCCA1
new.LIBCMT ref: 00EFCCE3
new.LIBCMT ref: 00EFCD25
new.LIBCMT ref: 00EFCD67
new.LIBCMT ref: 00EFCDA9
new.LIBCMT ref: 00EFCDEB
new.LIBCMT ref: 00EFCE2A
new.LIBCMT ref: 00EFCE65
new.LIBCMT ref: 00EFCE9D

Strings

, xrefs: 00EFCEC6

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4732b13c94193840cb6c78f6a3d6c1cfe985c88080b5e76e17e01bd5e91669fa
Instruction ID: 02f9a7d5835bee156e14353f0c53826ef8d17d869300991e52181797924041d0
Opcode Fuzzy Hash: 4732b13c94193840cb6c78f6a3d6c1cfe985c88080b5e76e17e01bd5e91669fa
Instruction Fuzzy Hash: 00D19262D0B29DDBDB11C7B896063FEBEA00F21704F299499D945BB381D6744F04ABE2

Uniqueness

Uniqueness Score: -1.00%

Function 00EB5840 Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 494COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,00000001,?,?), ref: 00EB589E
SetLastError.KERNEL32(00F908E8,?,?), ref: 00EB58EB
GetLastError.KERNEL32(?,?,?), ref: 00EB5965
SetLastError.KERNEL32(00F908E8,?,?), ref: 00EB59AF
new.LIBCMT ref: 00EB5B12
new.LIBCMT ref: 00EB5B81
new.LIBCMT ref: 00EB5CDE
new.LIBCMT ref: 00EB5E6F
new.LIBCMT ref: 00EB5F02
new.LIBCMT ref: 00EB5F76

Strings

1, xrefs: 00EB5F84

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: 1
API String ID: 1452528299-2212294583
Opcode ID: 2fb996e2c5bed15a4d6407cb8a0e5d7ca8d0817115b804f47fe0e81b6bab69ce
Instruction ID: 2e0eb9345be067a300f5de3b9fe3d8f0e02edae90537c9b47b8ef41be2a83751
Opcode Fuzzy Hash: 2fb996e2c5bed15a4d6407cb8a0e5d7ca8d0817115b804f47fe0e81b6bab69ce
Instruction Fuzzy Hash: 7B220E71D00658DEDB24DB68C8857EEBBF0AF15318F1452A9D069B72C2DBB44E84DF81

Uniqueness

Uniqueness Score: -1.00%

Function 00F00DF0 Relevance: 17.7, Strings: 14, Instructions: 155COMMON

Download Yara Rule

Strings

AnyStartsWith, xrefs: 00F00F78
NotEqual, xrefs: 00F00FCC
EndsWith, xrefs: 00F00F94
Compare, xrefs: 00F00E28
LessThan, xrefs: 00F00E68
Contains, xrefs: 00F00F1E
AnyEndsWith, xrefs: 00F00FB0
GreaterEqual, xrefs: 00F00EC1
LessEqual, xrefs: 00F00E83
AnyContains, xrefs: 00F00F3D
HasFlags, xrefs: 00F00EFF
Equal, xrefs: 00F00EE0
StartsWith, xrefs: 00F00F5C
GreaterThan, xrefs: 00F00EA2

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: AnyContains$AnyEndsWith$AnyStartsWith$Compare$Contains$EndsWith$Equal$GreaterEqual$GreaterThan$HasFlags$LessEqual$LessThan$NotEqual$StartsWith
API String ID: 2425351278-1967529450
Opcode ID: 7ac743579c5514814b545a36d23516ab4fd82ffb784fc80a051ee3ea50630705
Instruction ID: 702f145483c4385c610a08d89e7deab2e38591505e020acd04e7076920823ea0
Opcode Fuzzy Hash: 7ac743579c5514814b545a36d23516ab4fd82ffb784fc80a051ee3ea50630705
Instruction Fuzzy Hash: EB519E319482169BEF24DBA0ED45FAEB6E4EF10744F208628E816735D1FFB09904FB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F44741 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,SetupEngine.cpp,?,00000000,33A37B94), ref: 00F4475A
OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,33A37B94), ref: 00F44767
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00F4477E
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000), ref: 00F447A9
ExitWindowsEx.USER32(00000002,0000FFFF), ref: 00F447B7

Strings

SeShutdownPrivilege, xrefs: 00F44778

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 1314775590-3733053543
Opcode ID: 969d457eac1e0c035c00c8067f4a025fd023eb94568b5e14e899667f47305217
Instruction ID: a637abf21fe7461b04f46dfb0d86d279509a737ff053c9dd13e6659ae0bc7ba7
Opcode Fuzzy Hash: 969d457eac1e0c035c00c8067f4a025fd023eb94568b5e14e899667f47305217
Instruction Fuzzy Hash: F1013970A01229ABCF10DFE4DD4DAFEBFB8EF09700F000119E905E6281DB749A05ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F00520 Relevance: 7.8, APIs: 5, Instructions: 267timeCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(000000FF), ref: 00F00637
VariantChangeTypeEx.OLEAUT32(?,00000000,0000007F,00000000,00000007), ref: 00F00828
VariantTimeToSystemTime.OLEAUT32 ref: 00F00841
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,00EC499E,00F9091C), ref: 00F0084F
VariantClear.OLEAUT32(?), ref: 00F00874

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Time$Variant$System$ChangeClearFileFreeStringType
String ID:
API String ID: 829595763-0
Opcode ID: 44ba2e5a20b757ed8049800882d11b33df711128dbffe5151e68357a6af8713c
Instruction ID: 0e364a3e4b00fba4fed54b1b8cf4443e02bc5c32cdc24f1bb2436c6129746930
Opcode Fuzzy Hash: 44ba2e5a20b757ed8049800882d11b33df711128dbffe5151e68357a6af8713c
Instruction Fuzzy Hash: 45A17D71E00218DBDF15DFA8D894BEEBBF5BF08710F148159E405AB2C1DB789A04EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F09450 Relevance: 6.5, Strings: 5, Instructions: 295COMMON

Download Yara Rule

Strings

PackagePath, xrefs: 00F09766
Parcel: disabling remove of parcel '%s' due to share count of %d, xrefs: 00F09832
Parcel: disabling repair of parcel '%s' as this suite is not a client, xrefs: 00F096E0
Final action state for parcel %s: %d, xrefs: 00F0972B
Parcel.cpp, xrefs: 00F096D2, 00F096E8, 00F09719, 00F09730, 00F09824

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: Final action state for parcel %s: %d$PackagePath$Parcel.cpp$Parcel: disabling remove of parcel '%s' due to share count of %d$Parcel: disabling repair of parcel '%s' as this suite is not a client
API String ID: 0-2668638366
Opcode ID: 7bc886860227501c52bcf9ea206d7ffba0a401ddc73ae665dc5827c7238cd6b6
Instruction ID: c0fd076a2a72716217474c08407288553f98d64f14fb185397b6980f76f7f667
Opcode Fuzzy Hash: 7bc886860227501c52bcf9ea206d7ffba0a401ddc73ae665dc5827c7238cd6b6
Instruction Fuzzy Hash: E6B1B071A04206DFDF18DF64CCE0BADB7F5FB44304F548229D41A97292E7B0A855EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F5551A Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00F55543
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 00F5555B
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00F555B1
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00F555C6

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 0e461382f40a48932b853366499bc9ceacb2a6af6852b84798aa7aba05cd5a9f
Instruction ID: 2976be7878ed70596584cbc6f15fd8da9448188596930b980f9b2f7a3b588a63
Opcode Fuzzy Hash: 0e461382f40a48932b853366499bc9ceacb2a6af6852b84798aa7aba05cd5a9f
Instruction Fuzzy Hash: 04218672E0011CABCF20DFA4CC85AEEB7B9EB44765F150065EE05EB140EA349A08DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F20CE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,33A37B94,00000000,?), ref: 00F20D2C
GetProcAddress.KERNEL32(00000000,SuiteStartupInstall), ref: 00F20D4F

Strings

SuiteStartupInstall, xrefs: 00F20D49

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SuiteStartupInstall
API String ID: 2574300362-3262701596
Opcode ID: 4ca54a0268ae1818dad81d8d00d8292626b42a5032affe406297dbcf2f3fc7c1
Instruction ID: 2b8f9cba5f0db8a8715fa91cc7f8ff063753f7792bd165d1f4bb9747c74da5e2
Opcode Fuzzy Hash: 4ca54a0268ae1818dad81d8d00d8292626b42a5032affe406297dbcf2f3fc7c1
Instruction Fuzzy Hash: 04318172D01218EFDB14CF98D844BAEBBB5FB45714F10012DE811AB382CB74AD01DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F5222D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00F3FBA7), ref: 00F52325
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00F3FBA7), ref: 00F5232F
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00F3FBA7), ref: 00F5233C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f5a75cc7dfe6c817c6dd46f6d546a731ce275cfc0da69b1df965a6a5530dddb4
Instruction ID: 23775d98556991946dd93f0167a9c61060b2316b843d7f608b8758f897482d4b
Opcode Fuzzy Hash: f5a75cc7dfe6c817c6dd46f6d546a731ce275cfc0da69b1df965a6a5530dddb4
Instruction Fuzzy Hash: 0131C47490122C9BCB61DF64DC887D8BBB8BF08310F5046EAE91CA6250EB749B859F44

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D3C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F4D3E1

Strings

, xrefs: 00F4D53E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 670621d596e24d96a294da79d62500df5edd09299187bc1712e204691317bfae
Instruction ID: d4a797d1760515f43e42ae3eabf7dcd3945042f4d3bb8871d4eeae2492de7279
Opcode Fuzzy Hash: 670621d596e24d96a294da79d62500df5edd09299187bc1712e204691317bfae
Instruction Fuzzy Hash: 71418E71E0120D9BEB14CFA9E8997AEBFF5FB48324F14816BD809E7254D374A840DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F5B2D0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf88605dbd0322d2ecb5532771ae3339d28b7093155358778e131ecff2853dfc
Instruction ID: 449ce3e79de58896481e329bff6f2f2f4af3316a34d3309d42491a5ad233562f
Opcode Fuzzy Hash: bf88605dbd0322d2ecb5532771ae3339d28b7093155358778e131ecff2853dfc
Instruction Fuzzy Hash: 71023C71E002199FDF14CFA9C8806AEBBF1EF88325F258269D919E7385D731A945DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F3CFF0 Relevance: 1.6, Strings: 1, Instructions: 377COMMON

Download Yara Rule

Strings

@, xrefs: 00F3D40A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 90c4dae4d91584c98b6940756602bc2427e1352042e00b236df98bba3062f34c
Instruction ID: 2e2d3cc44e671aa3e38f386a5dfac044e5325eca15b12571b178e4197f044b7e
Opcode Fuzzy Hash: 90c4dae4d91584c98b6940756602bc2427e1352042e00b236df98bba3062f34c
Instruction Fuzzy Hash: 15E16C71E00218CFCB28CFA8D4906ADBBB2FF49720F24416ED81AAB355D7759D86DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2400 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(00000294), ref: 00EC244E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: f0d002ef0add50ff6779066248c27a66ff337428d33f3b765368abb6cde07ce5
Instruction ID: da3d0c1238efeb6197017ce48ebed67eb404ad2aeeb706ad5252903e198ef8af
Opcode Fuzzy Hash: f0d002ef0add50ff6779066248c27a66ff337428d33f3b765368abb6cde07ce5
Instruction Fuzzy Hash: BD11AD70A14208DBDB10EF98E949B9ABBF8FB09714F00026EE409EB381DBB55900CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EEC2B0 Relevance: 1.5, APIs: 1, Instructions: 37comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00F865B8,00000000,00000001,00F974EC,?), ref: 00EEC2DE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 63985c77fb8dfeb5302312f5597fb05cdb499d42dbba0ed87a3522ad0b6ded9d
Instruction ID: e5a7eae2bdd1e62ef23c5faa1d519d8d3ad822f4b94ab92221cc4313212f58f6
Opcode Fuzzy Hash: 63985c77fb8dfeb5302312f5597fb05cdb499d42dbba0ed87a3522ad0b6ded9d
Instruction Fuzzy Hash: CFF0B4B22402259B83219A8AE880D47FB6CFF99B643104125FA08AB211C7719811C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D2A4 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0009D2B0,00F4CA77), ref: 00F4D2A9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7c02758c23fa807ee68323e737c60a0f3f49794242fe4bfe28ad9f3914ac5947
Instruction ID: 808fe87c57b3895adb7af2e4d3c0852dd0c86db408e3193ec69713a5f95919e8
Opcode Fuzzy Hash: 7c02758c23fa807ee68323e737c60a0f3f49794242fe4bfe28ad9f3914ac5947
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00F5A39A Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F5A39A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0e0159e40e231ca2c27069ba57755e4477c5f6fb62235696654136ed84ccb28e
Instruction ID: d8615022e966f7fe1a13908c6e6a8e5fd904f07e8d0a645804bca8309b8616ad
Opcode Fuzzy Hash: 0e0159e40e231ca2c27069ba57755e4477c5f6fb62235696654136ed84ccb28e
Instruction Fuzzy Hash: 46A0223020B308CF8300CF3AAF0830C3FEEBA022C0300C2AAA800CA230FB308000BB02

Uniqueness

Uniqueness Score: -1.00%

Function 00F3AE43 Relevance: .9, Instructions: 878COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07a09fc92beab59e46cdb05ae819f1a825e381e3bba5651ece469f2a0880131
Instruction ID: a713cd46b3478a0d98c3287f7616f2c4c6ba1a6ff047452a9bb59c74b8f23975
Opcode Fuzzy Hash: f07a09fc92beab59e46cdb05ae819f1a825e381e3bba5651ece469f2a0880131
Instruction Fuzzy Hash: 33724AB1E002199FCB08CF99C5906ADBBF1FF88324F2481AED955AB341D7359A46DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F3A410 Relevance: .8, Instructions: 750COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe5e1268f86b081c4aff82ea24175312e04f909044c70c72bd5282261cb1a10
Instruction ID: 80c5759ed92eac1ba0ebdbf378a2b3ba0f9f97814a2fbd1dea1c3cfb69947954
Opcode Fuzzy Hash: afe5e1268f86b081c4aff82ea24175312e04f909044c70c72bd5282261cb1a10
Instruction Fuzzy Hash: 65629EB1E00205DBDF14CF5AC5846ADBBB1BF88324F2881ADD854AB342D779DA42DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4A226 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fa3e7fe490313148d01498914685c832a4181b756cac296912fffe9db10e61
Instruction ID: 4259e80643933e57e606bde7a3602ff3de36fc4ceddd184646fc0e0d12a5a8f7
Opcode Fuzzy Hash: 04fa3e7fe490313148d01498914685c832a4181b756cac296912fffe9db10e61
Instruction Fuzzy Hash: 6F2273B7F515144BDB0CCA5DCCA23EDB2E3AFD4218B0E813DA80AE3745EA7DD9158684

Uniqueness

Uniqueness Score: -1.00%

Function 00F3C830 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3d521a1bc445728d7ee59e52ec3459f6e041d1d6134f72bd092515bffe1742
Instruction ID: 7ed04e582ee56a5358516a9475643838b12b90b9eddece807c4e7d292208101a
Opcode Fuzzy Hash: ec3d521a1bc445728d7ee59e52ec3459f6e041d1d6134f72bd092515bffe1742
Instruction Fuzzy Hash: 06024535A00B008FD724CF29C480AA6B7F1FF48364F54496EE99A8BB51D735F991DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D460 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be10e1f0ffe327da101943046d924daf0a3c3fad0713b8dd69ece6b88f49366
Instruction ID: e16782455ce33cfa630e194ebd609e2bb79b23aab6cab6979859076a9fa21450
Opcode Fuzzy Hash: 7be10e1f0ffe327da101943046d924daf0a3c3fad0713b8dd69ece6b88f49366
Instruction Fuzzy Hash: BFE1B371E042559FCB04CF6CD5806ACFBF2EF99320F2881A9D495EB342D735AA06DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F508B3 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: af44d608c50c1347139bcad71af8f3e291182f3fc7b5cd895dee9a3d6e22ed3f
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 8CC1D1726051934ADF2D8639C53403FBAA15A927B331A476DDEF3CB1D5FE20C928E620

Uniqueness

Uniqueness Score: -1.00%

Function 00F50CE8 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 4ea2c41689944740c2e92bcd16e3dd910665e24f492c3b530430840fc968434d
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 58C1C6726050934ADF2D8639C53413FBAA15A927B331A476DDEF2CB4D4FE20D92DE620

Uniqueness

Uniqueness Score: -1.00%

Function 00F3E270 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d04ea213e215d651511e788a7b3a724a841cd610a3980e295b98df4ec515e7
Instruction ID: c8523491ffbc26438e3b5ee0d20f2c58bb226323dd78daa79dee86d8b5a8113f
Opcode Fuzzy Hash: 39d04ea213e215d651511e788a7b3a724a841cd610a3980e295b98df4ec515e7
Instruction Fuzzy Hash: BFE1AC759092518FC70ACF18C4988F67BF5AF65720F1E82F9C8899B767C3329980DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F5047E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 5dbd11031f1c56b41708ae8ab759f15dc8f45c59a60b9489622e3c2cf316a1ed
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 80C1B4726050934ADF2D8639853453FBAA15AA27B331A476DDEF2CB4D0FE10C92DEA10

Uniqueness

Uniqueness Score: -1.00%

Function 00F50066 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 545f0a3a625b7a4d45e55b543b2886d658880607a919a0272ffde86446d5c32e
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 78C1B4726051934ADF2D8639853413FBAA15AA27B331A476DDEF3CB4D4FE20C92DE610

Uniqueness

Uniqueness Score: -1.00%

Function 00F54576 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c15a6b2021b0395fccfac5a3033646063728dc7ea4377ff03b32ea4555246c
Instruction ID: 00f551265e1182481aa784f141631c7a589a7e8fc20f660a698234cb1a2a4627
Opcode Fuzzy Hash: c4c15a6b2021b0395fccfac5a3033646063728dc7ea4377ff03b32ea4555246c
Instruction Fuzzy Hash: E9619A72A0070867DA348A2858957BEB394AF1772FF140519EF42CB281E645FECDB745

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D890 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca912fbd74cdeef2b55000208cc960772fb1ca2d7e5a73aa174721ea2c6e582
Instruction ID: 6b0dde143c6968447cf0d50d021e7edec448daa7622075a303aac2c698d51ab5
Opcode Fuzzy Hash: 7ca912fbd74cdeef2b55000208cc960772fb1ca2d7e5a73aa174721ea2c6e582
Instruction Fuzzy Hash: 0F6132357102696FEB18CF1EECC08B67755E78A3113864229EA81CB3D5C635E927E7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3ABED Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca407813887ac5ed2db7c8b1aa6ea359c85eee18d49da2cb8eca8892239c895b
Instruction ID: 3b75134a1f3407cbe4eb48aefb9935b75501a1ca13697484a05979d0a39369a3
Opcode Fuzzy Hash: ca407813887ac5ed2db7c8b1aa6ea359c85eee18d49da2cb8eca8892239c895b
Instruction Fuzzy Hash: 44616DB2E006158BCB08CF5AC5442ADFBB1FF88324F14C1AED818AB745D7759A42DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00F51298 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c03aa0fa737a59770e6fc423e78525cd04325b6560e8fa474c5e57c54527a7d
Instruction ID: 7119f11e04778a1e62b4d05cc3ebc77795ea3f709b94fe52a2baaa32b4b006b4
Opcode Fuzzy Hash: 9c03aa0fa737a59770e6fc423e78525cd04325b6560e8fa474c5e57c54527a7d
Instruction Fuzzy Hash: 97315C6790D1C147C701877D88B97E6BBA5BF9333271D82AACAC147E49E152A41EF701

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2870 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78678eb6c7b84fdfed71e0602582bba54129a6d7ac7f101c99b218783b5ec921
Instruction ID: 0577562a370e200e2d68a1fb4cd8471de26525ee4586f1047202a3fce2dad86f
Opcode Fuzzy Hash: 78678eb6c7b84fdfed71e0602582bba54129a6d7ac7f101c99b218783b5ec921
Instruction Fuzzy Hash: 6B11573B074E0E82C62C841C5620FE922416B11719B94262DE7C6F93C1EFA7D857D187

Uniqueness

Uniqueness Score: -1.00%

Function 00EB10E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0f6efffb58c0845356d4de3b3b36cab0548beaf1ff68fc44e796011b855008
Instruction ID: 6c56038d272a5f121f6faf56d14b15d8a6c8e09b8ec48c953d38a60f6634c39d
Opcode Fuzzy Hash: 3f0f6efffb58c0845356d4de3b3b36cab0548beaf1ff68fc44e796011b855008
Instruction Fuzzy Hash: 8601A2B190A788DFC711EF68ED05B55B7A6F306734F1443AAE9259B3E0E735A400BB42

Uniqueness

Uniqueness Score: -1.00%

Function 00EB1040 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811bfd1cc25eeffef5514aed35109ec3bfc79133d3bd06e781100ddb0d2b1255
Instruction ID: 7b03cdf8aaa7d50d13d1ae7f51a4c9745d49f0116ef4ebeefe809783a45a77cd
Opcode Fuzzy Hash: 811bfd1cc25eeffef5514aed35109ec3bfc79133d3bd06e781100ddb0d2b1255
Instruction Fuzzy Hash: BB01DFB2909788DBC710EF68ED05B4577A1F304720F544B6AE8259B3D0F735A900AF42

Uniqueness

Uniqueness Score: -1.00%

Function 00EB84A0 Relevance: 52.9, APIs: 27, Strings: 3, Instructions: 381COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,33A37B94,?,?,?,?,00F61E9C,000000FF), ref: 00EB84E6
SetLastError.KERNEL32(00F908E8,?,?,?,?,?,?,?,?,?,33A37B94,?,?,?,?,00F61E9C), ref: 00EB8535

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104,?,?,?,?,?,?,?,?,?,33A37B94), ref: 00EB856A

Part of subcall function 00EB9D60: GetLastError.KERNEL32(33A37B94,74DEDFA0,74DEE010), ref: 00EB9D8D
Part of subcall function 00EB9D60: SetLastError.KERNEL32(00000000), ref: 00EB9E1E

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F417CE: __EH_prolog3_GS.LIBCMT ref: 00F417D8

GetLastError.KERNEL32 ref: 00EB85ED
SetLastError.KERNEL32(00F908E8), ref: 00EB8645
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00EB8678
SetCurrentDirectoryW.KERNEL32(?), ref: 00EB86AB
PathFileExistsW.SHLWAPI(?), ref: 00EB872D
GetLastError.KERNEL32 ref: 00EB8749
SetLastError.KERNEL32(00F908E8), ref: 00EB878F

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Strings

D, xrefs: 00EB86B9
", xrefs: 00EB8844
explorer.exe, xrefs: 00EB86E8, 00EB87E7

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$String$DirectoryFileFree$AllocCurrentExistsH_prolog3_ModuleNamePathSystem
String ID: "$D$explorer.exe
API String ID: 3750105342-2425987333
Opcode ID: 3a5349d0becf8342a31c22663035bfd137a2774bfc6795e5785ff7d7631694b8
Instruction ID: 8fc5ba36aa46a5e924d0c7e13466961603295eb9567e4b625339023a8e6602ad
Opcode Fuzzy Hash: 3a5349d0becf8342a31c22663035bfd137a2774bfc6795e5785ff7d7631694b8
Instruction Fuzzy Hash: 04025A70D0425CEEEB21DFA4DD49BDEBBB8AF04704F104099E148B7292DBB46A88DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F13770 Relevance: 49.9, APIs: 32, Strings: 1, Instructions: 399COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32(33A37B94,00000020,?,?,00F15374), ref: 00F137E8
SetLastError.KERNEL32(?), ref: 00F1382A
GetLastError.KERNEL32 ref: 00F13846
SetLastError.KERNEL32(?), ref: 00F13882
GetLastError.KERNEL32 ref: 00F1389E
SetLastError.KERNEL32(?), ref: 00F138DA
GetLastError.KERNEL32 ref: 00F138F9
SetLastError.KERNEL32(?), ref: 00F13935
GetLastError.KERNEL32 ref: 00F13954
SetLastError.KERNEL32(?), ref: 00F13990
GetLastError.KERNEL32 ref: 00F139AF
SetLastError.KERNEL32(?), ref: 00F139EB
GetLastError.KERNEL32 ref: 00F13A0A
SetLastError.KERNEL32(?), ref: 00F13A46
GetLastError.KERNEL32 ref: 00F13A65
SetLastError.KERNEL32(?), ref: 00F13AA1
GetLastError.KERNEL32 ref: 00F13AC0
SetLastError.KERNEL32(?), ref: 00F13AFC
GetLastError.KERNEL32 ref: 00F13B1B
SetLastError.KERNEL32(?), ref: 00F13B57
GetLastError.KERNEL32 ref: 00F13B76
SetLastError.KERNEL32(?), ref: 00F13BB2
GetLastError.KERNEL32 ref: 00F13BD1
SetLastError.KERNEL32(?), ref: 00F13C0D
GetLastError.KERNEL32 ref: 00F13C2C
SetLastError.KERNEL32(?), ref: 00F13C68
GetLastError.KERNEL32 ref: 00F13C87
SetLastError.KERNEL32(?), ref: 00F13CC3
GetLastError.KERNEL32 ref: 00F13CE2
SetLastError.KERNEL32(?), ref: 00F13D1E
GetLastError.KERNEL32 ref: 00F13D3D
SetLastError.KERNEL32(?), ref: 00F13D79

Strings

c, xrefs: 00F13D7B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: c
API String ID: 1452528299-112844655
Opcode ID: 0e984010e65fcf0cfd3e0acf46785ffe4b9690d4db1ac9276e7e9203999f4279
Instruction ID: 33dcc2041cdf97117e62ee694f1c53ab3a4a60cc0707fd87ef31415b3cbd35c3
Opcode Fuzzy Hash: 0e984010e65fcf0cfd3e0acf46785ffe4b9690d4db1ac9276e7e9203999f4279
Instruction Fuzzy Hash: 4F22E5B0805B84CFDB61CFA9C54874ABFF0AF18308F14899DC48A97B52D7B5AA04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00EC9500 Relevance: 40.7, APIs: 3, Strings: 20, Instructions: 495synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

CreateMutexW.KERNEL32(00000000,00000001,-00000004,33A37B94,00000000), ref: 00EC9A15
GetLastError.KERNEL32 ref: 00EC9A29
__CxxThrowException@8.LIBVCRUNTIME ref: 00EC9A56

Strings

ORIGINALSETUPEXEDIR, xrefs: 00EC9910
ORIGINALSETUPEXENAME, xrefs: 00EC998A, 00EC99AE
ISPassword, xrefs: 00EC9573
UpdateUrl, xrefs: 00EC9A5B
ReverseOfPackageOrder, xrefs: 00EC9B50
Password, xrefs: 00EC9597
Password set with no password in setup.xml, xrefs: 00EC9619
true, xrefs: 00EC9670, 00EC9799
Engine: property '%s' value now '%s', xrefs: 00EC9C22
ISSelectedLanguage, xrefs: 00EC98CE
UninstallOrder, xrefs: 00EC9B37
ISPasswordValid, xrefs: 00EC9691, 00EC97BA, 00EC98B5
SuiteId, xrefs: 00EC99E3
., xrefs: 00EC9BCC
Engine: running from temp, original setup: %s, xrefs: 00EC9940
SetupEngine.cpp, xrefs: 00EC95F7, 00EC9720, 00EC981C, 00EC9936, 00EC9C18
Invalid password supplied, xrefs: 00EC983E
********, xrefs: 00EC9BE2
Valid password supplied, xrefs: 00EC9742
ISHiddenProperties, xrefs: 00EC9AA1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString$CreateException@8MutexThrow
String ID: ********$.$Engine: property '%s' value now '%s'$Engine: running from temp, original setup: %s$ISHiddenProperties$ISPassword$ISPasswordValid$ISSelectedLanguage$Invalid password supplied$ORIGINALSETUPEXEDIR$ORIGINALSETUPEXENAME$Password$Password set with no password in setup.xml$ReverseOfPackageOrder$SetupEngine.cpp$SuiteId$UninstallOrder$UpdateUrl$Valid password supplied$true
API String ID: 3035193437-1046570353
Opcode ID: b8a936fc034e424bb045db89ba14e28dd38b5aef4ad4fa7307c7e2b381955207
Instruction ID: 4cfdf83664c4214324d7526b74284c911cc4622c12926be53a0aafb9c3e76679
Opcode Fuzzy Hash: b8a936fc034e424bb045db89ba14e28dd38b5aef4ad4fa7307c7e2b381955207
Instruction Fuzzy Hash: 28225F70901248EEEF14EBA4CD89FEEBBB4AB11304F145199A40577283DB746F09DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00ED7430 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 213libraryloaderCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,33A37B94), ref: 00ED7465
CoGetInterfaceAndReleaseStream.OLE32(?,00F9F884,00000000), ref: 00ED74B3
SetEvent.KERNEL32(?), ref: 00ED74C5
GetLastError.KERNEL32 ref: 00ED74DE
SetLastError.KERNEL32(00F908E8), ref: 00ED7528
GetProcAddress.KERNEL32(?,InitializeSuiteUI), ref: 00ED7540
GetLastError.KERNEL32 ref: 00ED754D
GetProcAddress.KERNEL32(?,ShutdownSuiteUI), ref: 00ED7598
GetLastError.KERNEL32 ref: 00ED75A5
SetEvent.KERNEL32(?), ref: 00ED761B
CoUninitialize.OLE32 ref: 00ED76BF

Strings

Failed to obtain UI resource uninit entry point, error 0x%08x, xrefs: 00ED75B1
Failure during UI resource initializer call, xrefs: 00ED75F2
Failed to obtain UI resource entry point, error %x, xrefs: 00ED7559
ShutdownSuiteUI, xrefs: 00ED758D
InitializeSuiteUI, xrefs: 00ED7535

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$AddressEventProc$InitializeInterfaceReleaseStreamUninitialize
String ID: Failed to obtain UI resource entry point, error %x$Failed to obtain UI resource uninit entry point, error 0x%08x$Failure during UI resource initializer call$InitializeSuiteUI$ShutdownSuiteUI
API String ID: 2855471474-2626213526
Opcode ID: f48018c9d43b542c2400fb6b9721f6ea600217567df8f27117311f62070b6ba0
Instruction ID: 2e464e85e76ed203a093b9686c879eb447b44ba0eee8e46616763b78d52f9436
Opcode Fuzzy Hash: f48018c9d43b542c2400fb6b9721f6ea600217567df8f27117311f62070b6ba0
Instruction Fuzzy Hash: 80913A70A04249DFDB01DFE4C889BAEBBB4FF08704F244069E551FB291EB75A906DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ED37F0 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 298COMMON

Download Yara Rule

Strings

Failed to allocate proxy handler, xrefs: 00ED3B2B
Failed to launch 64-bit proxy handler '%s' through elevated embed, error %x, xrefs: 00ED3A0D
SetupEngine.cpp, xrefs: 00ED3916, 00ED393C, 00ED3A13, 00ED3A71, 00ED3B14, 00ED3BB1
setup64.exe, xrefs: 00ED384A
Failed to create pipe server for elevated 64-bit proxy, error %x, xrefs: 00ED3937
\\.\pipe\ISEngine_, xrefs: 00ED38B8
-embedded:, xrefs: 00ED39A3
IS_ProxyWaiter_, xrefs: 00ED3959
Failed to connect/verify 64-bit elevated proxy, error %x, xrefs: 00ED3B89
Timed out waiting for 64-bit elevated proxy to respond, xrefs: 00ED3A85
Failed to initialize 64-bit elevated proxy communication, error %x, xrefs: 00ED3BA6

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: -embedded:$Failed to allocate proxy handler$Failed to connect/verify 64-bit elevated proxy, error %x$Failed to create pipe server for elevated 64-bit proxy, error %x$Failed to initialize 64-bit elevated proxy communication, error %x$Failed to launch 64-bit proxy handler '%s' through elevated embed, error %x$IS_ProxyWaiter_$SetupEngine.cpp$Timed out waiting for 64-bit elevated proxy to respond$\\.\pipe\ISEngine_$setup64.exe
API String ID: 0-4276722301
Opcode ID: fb57751cb6afbc64779208cd38c3571c66828fb2dd588ffe3761174f3611dbf9
Instruction ID: 2952c812af1e094e9d60f22f7fb15ab7b82be04bc2466660e65f92d3f20099ed
Opcode Fuzzy Hash: fb57751cb6afbc64779208cd38c3571c66828fb2dd588ffe3761174f3611dbf9
Instruction Fuzzy Hash: EFC18170D0425CEAEF21DBA4DC45BEEB7B4AB04304F5401EAE509B7282DBB49B49DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EBA580 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 276COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(?,00EBA378), ref: 00EBA60B
VariantCopy.OLEAUT32(?,00F9091C), ref: 00EBA62B
VariantCopy.OLEAUT32(?,?), ref: 00EBA64B
VariantCopy.OLEAUT32(?,?), ref: 00EBA66B
VariantCopy.OLEAUT32(00F9091C,?), ref: 00EBA68B
VariantCopy.OLEAUT32(?,?), ref: 00EBA701
VariantCopy.OLEAUT32(?,?), ref: 00EBA719
VariantCopy.OLEAUT32(?,?), ref: 00EBA733
VariantClear.OLEAUT32(?), ref: 00EBA74C

Part of subcall function 00EBAF20: __CxxThrowException@8.LIBVCRUNTIME ref: 00EBAF32

Strings

ScriptInvoke: failed to get id for function '%s', error 0x%08x, xrefs: 00EBA7CD
i, xrefs: 00EBA7D3
p=<u, xrefs: 00EBA828, 00EBA82E
Common\IScriptExtension.cpp, xrefs: 00EBA7C6

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Copy$ClearException@8Throw
String ID: Common\IScriptExtension.cpp$ScriptInvoke: failed to get id for function '%s', error 0x%08x$i$p=<u
API String ID: 1212477081-4073536936
Opcode ID: 807b6c7b53994189e4e816c4680d08a76d1edbc43e659581aa257601698c4892
Instruction ID: 592e36a0720cb1357aad4ab7cbd78147e1c5d55ca0e0e0f78321b70dbefb8859
Opcode Fuzzy Hash: 807b6c7b53994189e4e816c4680d08a76d1edbc43e659581aa257601698c4892
Instruction Fuzzy Hash: 34A1F8B1A00359AFDF10DFA4CC84BEEBBB9FF48304F185569E509E7241E7759A048B62

Uniqueness

Uniqueness Score: -1.00%

Function 00EBB3C0 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 314COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,33A37B94), ref: 00EBB4E4
SetLastError.KERNEL32(00F908E8), ref: 00EBB53C
GetLastError.KERNEL32(?,33A37B94), ref: 00EBB595
SetLastError.KERNEL32(00F908E8), ref: 00EBB5DB
VariantInit.OLEAUT32(?), ref: 00EBB627
VariantClear.OLEAUT32(?), ref: 00EBB6DB
VariantClear.OLEAUT32(?), ref: 00EBB70C

Part of subcall function 00EB4810: GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
Part of subcall function 00EB4810: SetLastError.KERNEL32(?), ref: 00EB48AA

GetLastError.KERNEL32(?,33A37B94), ref: 00EBB741
SetLastError.KERNEL32(00F908E8), ref: 00EBB787
GetLastError.KERNEL32 ref: 00EBB7B1
SetLastError.KERNEL32(00F908E8), ref: 00EBB818

Part of subcall function 00EBB990: GetLastError.KERNEL32(33A37B94), ref: 00EBBA1E
Part of subcall function 00EBB990: SetLastError.KERNEL32(00F908E8), ref: 00EBBA68
Part of subcall function 00EBB990: VariantInit.OLEAUT32(?), ref: 00EBBAC0
Part of subcall function 00EBB990: VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 00EBBB33

Strings

Value, xrefs: 00EBB5FC
;, xrefs: 00EBB6BE
#, xrefs: 00EBB89A
Ctor, xrefs: 00EBB5F3
SuiteObject call ('%s') failed with error %08x, xrefs: 00EBB6B8
SuiteObject: initialize object for '%s' failed with error %08x, xrefs: 00EBB462

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Variant$ClearFreeInitString$ChangeType
String ID: #$;$Ctor$SuiteObject call ('%s') failed with error %08x$SuiteObject: initialize object for '%s' failed with error %08x$Value
API String ID: 3163211979-2604594377
Opcode ID: 6d7ba6b528adbca73702ecb0078f84a71f4701895bfda42645da357a5e761abb
Instruction ID: 7483cd05fe22fba25b69f67a78097c80d8a61f34b1d94be0b1e473ad2091cb1e
Opcode Fuzzy Hash: 6d7ba6b528adbca73702ecb0078f84a71f4701895bfda42645da357a5e761abb
Instruction Fuzzy Hash: B0F10670D00259DEEB60DFA8C948BDEBBF4BF08304F148199D558B7291DBB45A88DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ED6D60 Relevance: 28.4, APIs: 7, Strings: 9, Instructions: 394COMMON

Download Yara Rule

APIs

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

GetLastError.KERNEL32(00000000,00000000,33A37B94,00000000,?), ref: 00ED6ED9
SetLastError.KERNEL32(00F908E8), ref: 00ED6F25
GetLastError.KERNEL32 ref: 00ED6F3F
SetLastError.KERNEL32(00F908E8), ref: 00ED6FA6
new.LIBCMT ref: 00ED7092
GetLastError.KERNEL32(00F9091C,/isupdate.xml,0000000D), ref: 00ED7108
SetLastError.KERNEL32(00F908E8), ref: 00ED716F

Strings

ISUpdateVersion, xrefs: 00ED7346
Engine: no update XML URL specified, xrefs: 00ED6E23
Engine: failed to download update XML file '%s', error 0x%08x, xrefs: 00ED71B8
SetupEngine.cpp, xrefs: 00ED6E01, 00ED6FE3, 00ED71AE
Engine: update URL does not provide a path for isupdate.xml, xrefs: 00ED700B
Url, xrefs: 00ED70C1
/isupdate.xml, xrefs: 00ED7061
', xrefs: 00ED73C5
ISUpdateAvailable, xrefs: 00ED727B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: '$/isupdate.xml$Engine: failed to download update XML file '%s', error 0x%08x$Engine: no update XML URL specified$Engine: update URL does not provide a path for isupdate.xml$ISUpdateAvailable$ISUpdateVersion$SetupEngine.cpp$Url
API String ID: 1452528299-591482025
Opcode ID: 29cc9756b8319fafaf85503c65faacdb106bfb443c4cdcaa0b8dd27f4c7bb462
Instruction ID: 5e0bcdb54aa790c47588d70cc69b346c87e58c2848461e6f7b15e231a014a9b4
Opcode Fuzzy Hash: 29cc9756b8319fafaf85503c65faacdb106bfb443c4cdcaa0b8dd27f4c7bb462
Instruction Fuzzy Hash: 531269B090429CDEEF21DBA4CC48BDEBBB4AF15308F144099D448B7282DBB41B89DF52

Uniqueness

Uniqueness Score: -1.00%

Function 00EF8330 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 388COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,?,?), ref: 00EF83A3
SetLastError.KERNEL32(00F908E8,?,?,?), ref: 00EF83F0

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

GetLastError.KERNEL32(?,00000104,?,00000104,?,?,?), ref: 00EF84FF
SetLastError.KERNEL32(00F908E8,?,00000104,?,00000104,?,?,?), ref: 00EF8549

Part of subcall function 00EB9D60: GetLastError.KERNEL32(33A37B94,74DEDFA0,74DEE010), ref: 00EB9D8D
Part of subcall function 00EB9D60: SetLastError.KERNEL32(00000000), ref: 00EB9E1E

GetLastError.KERNEL32(?,00000104,?,00000104,?,?,?), ref: 00EF8648
SetLastError.KERNEL32(00F908E8,?,00000104,?,00000104,?,?,?), ref: 00EF8692
VariantInit.OLEAUT32(?), ref: 00EF8770
VariantClear.OLEAUT32(?), ref: 00EF8824
VariantClear.OLEAUT32(?), ref: 00EF8843

Strings

MsiInstalled condition: failed to convert registered version value (%s), error %x, xrefs: 00EF87B6
VersionString, xrefs: 00EF86D9, 00EF872E
Condition.cpp, xrefs: 00EF87AC, 00EF87F7
MsiInstalled condition: failed to evaluate comparison, error %x, xrefs: 00EF8801
PackageCode, xrefs: 00EF8443, 00EF849D
LocalPackage, xrefs: 00EF8593, 00EF85EC

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Variant$ClearString$AllocInit
String ID: Condition.cpp$LocalPackage$MsiInstalled condition: failed to convert registered version value (%s), error %x$MsiInstalled condition: failed to evaluate comparison, error %x$PackageCode$VersionString
API String ID: 2423531521-4192797876
Opcode ID: f17dcd2852eb28b2cb9c2aa11ed366be550d5b1abf420a66fe2f904afda0cbf2
Instruction ID: d4a1844f3487e559b6a01fd07304cb7254b36354ea7362b5af51793800c51b21
Opcode Fuzzy Hash: f17dcd2852eb28b2cb9c2aa11ed366be550d5b1abf420a66fe2f904afda0cbf2
Instruction Fuzzy Hash: C3024A7190428CDFEB11DFA8C948BEEBBF4AF19304F148099D149B7292DB749A48DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F1D270 Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 470libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB6EC0: GetLastError.KERNEL32(33A37B94,?,00EB5D01,00EB5D01,00F90920,00F60FF9,000000FF,?,00EB6814,00F8B388,00000000,?,00000000), ref: 00EB6F02
Part of subcall function 00EB6EC0: SetLastError.KERNEL32(00F908E8,00F8B388,00000000,?,00EB5D01,00EB5D01,00F90920,00F60FF9,000000FF,?,00EB6814,00F8B388,00000000,?,00000000), ref: 00EB6F65

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

LoadLibraryW.KERNEL32(?,?,00F9091C,setup.inx,?,00000000,?,00F9091C,ISSetup.dll,?,00000000,00F8B388,?,?,00000000,00F8B388), ref: 00F1D3E3
GetLastError.KERNEL32 ref: 00F1D3FF

Strings

!, xrefs: 00F1DAB9
setup.inx, xrefs: 00F1D39B
ISSetup.dll, xrefs: 00F1D351

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString$LibraryLoad
String ID: !$ISSetup.dll$setup.inx
API String ID: 132963947-4047876747
Opcode ID: 77cbf4b83207a129a4cc8a563d883350986a55914c6050d728f8910e4a711b4d
Instruction ID: 87b4dd9a06b1bd5fc5762ce54f3abc6cae02e30cde8f23a2d9e5d000af66c33d
Opcode Fuzzy Hash: 77cbf4b83207a129a4cc8a563d883350986a55914c6050d728f8910e4a711b4d
Instruction Fuzzy Hash: 7C228A70905258DFDB11EBA8DD99BDEBBB4AF14304F1440D9E008A7292DBB45F88DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA1C0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 204libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetUserDefaultLCID.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F73079,000000FF), ref: 00EFA28E
GetSystemDefaultLCID.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F73079,000000FF), ref: 00EFA297
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F73079,000000FF), ref: 00EFA2A0
GetACP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F73079,000000FF), ref: 00EFA2AA
GetLastError.KERNEL32 ref: 00EFA2CC
SetLastError.KERNEL32(?), ref: 00EFA30A
GetLastError.KERNEL32 ref: 00EFA328
SetLastError.KERNEL32(?), ref: 00EFA361
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00EFA375
GetProcAddress.KERNEL32(00000000,GetUserDefaultLocaleName), ref: 00EFA38D
GetProcAddress.KERNEL32(00000000,GetSystemDefaultLocaleName), ref: 00EFA39A

Strings

GetUserDefaultLocaleName, xrefs: 00EFA387
kernel32.dll, xrefs: 00EFA370
GetSystemDefaultLocaleName, xrefs: 00EFA38F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Default$AddressProcSystem$HandleLanguageModuleUser
String ID: GetSystemDefaultLocaleName$GetUserDefaultLocaleName$kernel32.dll
API String ID: 1013420760-1337869891
Opcode ID: 3171d949fe49551960fe5c29ff26ffed427e223ece368dbc6103e78cc77df5c5
Instruction ID: b5f02804dfe5918922d626a37026cdaff7c504c324a500f9ea6cebadd595f6b2
Opcode Fuzzy Hash: 3171d949fe49551960fe5c29ff26ffed427e223ece368dbc6103e78cc77df5c5
Instruction Fuzzy Hash: 44A16DB0805748DFDB11DFA8D988799BFF0BF09308F14819AD508AB392D7B59A44DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00F10BC0 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 394COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F10CD3

Strings

End transaction result: %x, xrefs: 00F11055, 00F11086
Transaction.cpp, xrefs: 00F10C79, 00F10D4C, 00F10E74, 00F10F42, 00F10FC3, 00F10FDA, 00F10FE8, 00F1100E, 00F11139, 00F1113A
Running transaction parcels, xrefs: 00F10E96
Running with current process transaction, starting transaction (if supported), xrefs: 00F10C9B
End proxy transaction result: %x, xrefs: 00F11131
}, xrefs: 00F10FEF
Transaction: finished running parcels, will %s transaction, xrefs: 00F11006
Skipping parcel with no action, xrefs: 00F10F56
Running with out-proc transaction, starting transaction (if supported), xrefs: 00F10D6E
Transaction: parcel returned error status %x, xrefs: 00F10FD2
commit, xrefs: 00F10FFB
roll back, xrefs: 00F10FF6, 00F11005

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: End proxy transaction result: %x$End transaction result: %x$Running transaction parcels$Running with current process transaction, starting transaction (if supported)$Running with out-proc transaction, starting transaction (if supported)$Skipping parcel with no action$Transaction.cpp$Transaction: finished running parcels, will %s transaction$Transaction: parcel returned error status %x$commit$roll back$}
API String ID: 0-457923003
Opcode ID: 1629d8cc2f50b46f04a9d95ba7113c5e81ee86ca901597e511451696a542d2f4
Instruction ID: b0b161936e9a50c0001b1a7df2c125f47bfdbce5859a04a60419214c463c63fd
Opcode Fuzzy Hash: 1629d8cc2f50b46f04a9d95ba7113c5e81ee86ca901597e511451696a542d2f4
Instruction Fuzzy Hash: 62F1C3B0D00298DFEF21DB64D8427EEBBB0AF04314F14816DE5446B292DBB46E84EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F298A0 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 365COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F29B02

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Strings

Publisher, xrefs: 00F29A29, 00F29C23
Appx parcel detect: condition is overridden by setup.xml detect, xrefs: 00F29921
AppxParcelHandler.cpp, xrefs: 00F298F6, 00F29B46, 00F29D9F, 00F29DE5
Compare, xrefs: 00F29D3D
Equal, xrefs: 00F29D16
Name, xrefs: 00F299D6, 00F29BD8
Appx detect condition: failed to validate condition, status 0x%08x, xrefs: 00F29DA9
Version, xrefs: 00F29AC6, 00F29CCB
3, xrefs: 00F29D70
ProcessorArchitecture, xrefs: 00F29A73, 00F29C7A
Appx detect condition: failed to evaluate condition, status 0x%08x, xrefs: 00F29DEF
Appx parcel detect: failed to create new installed condition, xrefs: 00F29B71

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: 3$Appx detect condition: failed to evaluate condition, status 0x%08x$Appx detect condition: failed to validate condition, status 0x%08x$Appx parcel detect: condition is overridden by setup.xml detect$Appx parcel detect: failed to create new installed condition$AppxParcelHandler.cpp$Compare$Equal$Name$ProcessorArchitecture$Publisher$Version
API String ID: 2425351278-3743069896
Opcode ID: 89c5a43569b5ea7a29b5727ad96deca546edacd2889d12d5747b82c920752f3a
Instruction ID: acd9d79b0fc381a8311617af207e130c6f7f8375b45ffa08afb31046338ca86e
Opcode Fuzzy Hash: 89c5a43569b5ea7a29b5727ad96deca546edacd2889d12d5747b82c920752f3a
Instruction Fuzzy Hash: 5B029FB0905258DEEB25DBA4DC95BDEBBB4BF15304F0441C9E40977282DBB05B48EF92

Uniqueness

Uniqueness Score: -1.00%

Function 00ED56C0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 277windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,00000001), ref: 00ED5704
SetLastError.KERNEL32(00F908E8), ref: 00ED5753
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00ED576D
SetLastError.KERNEL32(00F908E8), ref: 00ED57C5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00ED57D9
SetLastError.KERNEL32(00F908E8), ref: 00ED581F

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

MessageBoxW.USER32(00000000,00000000,00F9091C,00000030), ref: 00ED5AB3

Strings

IDS_SUITE_BETA, xrefs: 00ED59CE
This setup was created with an EVALUATION VERSION of %s, xrefs: 00ED59B1
IDS_SUITE_EVAL, xrefs: 00ED5917
IDS_PRODUCTNAME_INSTALLSHIELD, xrefs: 00ED5846
InstallShield, xrefs: 00ED5A78
This setup was created with a BETA VERSION of %s, xrefs: 00ED5A64

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$String$Free$AllocMessage
String ID: IDS_PRODUCTNAME_INSTALLSHIELD$IDS_SUITE_BETA$IDS_SUITE_EVAL$InstallShield$This setup was created with a BETA VERSION of %s$This setup was created with an EVALUATION VERSION of %s
API String ID: 4144628438-1802893656
Opcode ID: 81ac1afe155d165bc5043520b4196d60feb3ed61d0090edac300409095445154
Instruction ID: 369a70e875c4c7c5a0c1fd3b9729ba42847a969e0a3a1ffb46b3562082ff5412
Opcode Fuzzy Hash: 81ac1afe155d165bc5043520b4196d60feb3ed61d0090edac300409095445154
Instruction Fuzzy Hash: 4FC16871D0425CDEEF10DBA8C895BDEBBF4AF14304F14819AE019B7292DBB45A88DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F0EAD0 Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 257libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB4810: GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
Part of subcall function 00EB4810: SetLastError.KERNEL32(?), ref: 00EB48AA

LoadLibraryW.KERNEL32(?), ref: 00F0EC50
GetLastError.KERNEL32 ref: 00F0EC7D
GetProcAddress.KERNEL32(00000000,GetSuiteObject), ref: 00F0ECD2
GetLastError.KERNEL32 ref: 00F0ECDE

Strings

SuiteObject: failed to create suite extension, status 0x%08x, xrefs: 00F0ED59
Failed to load resource DLL in SON extension object (%s), error: %08x, xrefs: 00F0ECAF
Resource DLL GetSuiteObject (obj '%s') returned error %08x, xrefs: 00F0EDC8
8, xrefs: 00F0EE1E
.dll, xrefs: 00F0EB59
GetSuiteObject, xrefs: 00F0ECCC
Unknown resource DLL in SON extension object reference: %s, xrefs: 00F0EC34
Invalid resource name or object name in SON extension object reference: Dll '%s', Object '%s', xrefs: 00F0EE28
Resource DLL '%s' does not provide a suite object factor, error %08x, xrefs: 00F0ED10

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString$AddressLibraryLoadProc
String ID: .dll$8$Failed to load resource DLL in SON extension object (%s), error: %08x$GetSuiteObject$Invalid resource name or object name in SON extension object reference: Dll '%s', Object '%s'$Resource DLL '%s' does not provide a suite object factor, error %08x$Resource DLL GetSuiteObject (obj '%s') returned error %08x$SuiteObject: failed to create suite extension, status 0x%08x$Unknown resource DLL in SON extension object reference: %s
API String ID: 3058898142-2981135431
Opcode ID: 9480cfbc59fe5a8a0505d09df9fa76e7f4747ec2848fff33204888c476d1086a
Instruction ID: 2a27f0d891bdfc48b4e36982a4754b7b3bd0ee67840cd07176619004028335d7
Opcode Fuzzy Hash: 9480cfbc59fe5a8a0505d09df9fa76e7f4747ec2848fff33204888c476d1086a
Instruction Fuzzy Hash: DCA181B1D00258DFDF24EFA4CC45BDEB7B8AF14314F148499E419B7281EB749A48EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1500 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 211COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EF155A
new.LIBCMT ref: 00EF15A7

Part of subcall function 00EF0E50: GetLastError.KERNEL32 ref: 00EF0ED7
Part of subcall function 00EF0E50: SetLastError.KERNEL32(?), ref: 00EF0F19
Part of subcall function 00EF0E50: GetLastError.KERNEL32 ref: 00EF0F35
Part of subcall function 00EF0E50: SetLastError.KERNEL32(?), ref: 00EF0F71
Part of subcall function 00EF0E50: GetLastError.KERNEL32 ref: 00EF0F90
Part of subcall function 00EF0E50: SetLastError.KERNEL32(?), ref: 00EF0FCC

new.LIBCMT ref: 00EF160F

Strings

SetProperty, xrefs: 00EF16C9
CallDll, xrefs: 00EF1591
CallInstallScript, xrefs: 00EF1661
CallPowerShell, xrefs: 00EF15F9
CallExe, xrefs: 00EF1544
CallClr, xrefs: 00EF1721

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: CallClr$CallDll$CallExe$CallInstallScript$CallPowerShell$SetProperty
API String ID: 1452528299-737400278
Opcode ID: e14eeff9fedf5f6e049ba92128f8c5ebd4a30f74104b80e20d5ad6efc522b4db
Instruction ID: 40ee43f31364348d1eca64a61545034cde39bfa699e7f0210b9620efb17816c3
Opcode Fuzzy Hash: e14eeff9fedf5f6e049ba92128f8c5ebd4a30f74104b80e20d5ad6efc522b4db
Instruction Fuzzy Hash: A6610771F043189BDF24EF689C027ADB7E5EB80720F1046AEE919A73C1EBB55A0197C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F141B0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 201COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F14206
new.LIBCMT ref: 00F14245

Strings

Msp, xrefs: 00F142AC
WebDeploy, xrefs: 00F14340
Msi, xrefs: 00F141EE
Isp, xrefs: 00F14232
Appx, xrefs: 00F142EB
Exe, xrefs: 00F1426F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: Appx$Exe$Isp$Msi$Msp$WebDeploy
API String ID: 0-1138894300
Opcode ID: 2021dbc0d8686fd3b7eb92dc958602360359b8207e1f56458241c7fb1a9693c4
Instruction ID: 2a62ba07adaeafcd2ad15a9eb62c97703d752ac0b4a52ed0b9df78b2a450634b
Opcode Fuzzy Hash: 2021dbc0d8686fd3b7eb92dc958602360359b8207e1f56458241c7fb1a9693c4
Instruction Fuzzy Hash: 2671B2B1A00345ABDF14DF64C805BAEBBE4BF84350F10852DE819DB381EBB5E940EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBCF40 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 189COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(80004005,33A37B94), ref: 00EBCF93

Part of subcall function 00EB48D0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60F81,000000FF,?,00EB2726), ref: 00EB4907
Part of subcall function 00EB48D0: SetLastError.KERNEL32(?,?,?,?,?,00F60F81,000000FF), ref: 00EB4946

SetLastError.KERNEL32(8007007E), ref: 00EBCFFE
SetLastError.KERNEL32(80004005,33A37B94), ref: 00EBD107

Strings

Extension: couldn't find entry point '%s' in script, error 0x%08x, xrefs: 00EBD1B6
_Validate, xrefs: 00EBD02F, 00EBD138
e, xrefs: 00EBD1BC
Extension resource for entry point '%s' failed to load or is not a DLL (validate), xrefs: 00EBCFE4
Validation function entry point '%s' not found for extension condition in DLL '%s', xrefs: 00EBD091
ExtensionDelegate.cpp, xrefs: 00EBCFDD, 00EBD08A, 00EBD1AF

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: Extension resource for entry point '%s' failed to load or is not a DLL (validate)$Extension: couldn't find entry point '%s' in script, error 0x%08x$ExtensionDelegate.cpp$Validation function entry point '%s' not found for extension condition in DLL '%s'$_Validate$e
API String ID: 1452528299-3069477522
Opcode ID: a8eb58259102bddd7e0e4fb808402f33be442831fc5776f3da80873186f87104
Instruction ID: 2e0f2464b51150187c0ef2734015957ca78df43ff023de800836740d2f3fb182
Opcode Fuzzy Hash: a8eb58259102bddd7e0e4fb808402f33be442831fc5776f3da80873186f87104
Instruction Fuzzy Hash: 62815EB1905209EFEB10EFA4D945BDEBBF4FB14709F20501DD445B7282EBB4A648CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD270 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 188COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(80004005,33A37B94), ref: 00EBD2C3

Part of subcall function 00EB48D0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60F81,000000FF,?,00EB2726), ref: 00EB4907
Part of subcall function 00EB48D0: SetLastError.KERNEL32(?,?,?,?,?,00F60F81,000000FF), ref: 00EB4946

SetLastError.KERNEL32(8007007E), ref: 00EBD32E
SetLastError.KERNEL32(80004005,33A37B94), ref: 00EBD437

Strings

Extension: couldn't find entry point '%s' in script, error 0x%08x, xrefs: 00EBD4E0
x, xrefs: 00EBD31A
ExtensionDelegate.cpp, xrefs: 00EBD30D, 00EBD3BA, 00EBD4D9
Extension resource for entry point '%s' failed to load or is not a DLL (evaluate), xrefs: 00EBD314
_Evaluate, xrefs: 00EBD35F, 00EBD468
Evaluation function entry point '%s' not for extension condition in DLL '%s', xrefs: 00EBD3C1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: Evaluation function entry point '%s' not for extension condition in DLL '%s'$Extension resource for entry point '%s' failed to load or is not a DLL (evaluate)$Extension: couldn't find entry point '%s' in script, error 0x%08x$ExtensionDelegate.cpp$_Evaluate$x
API String ID: 1452528299-1918396859
Opcode ID: bb6dc5b74097b152c00e49f8ea23fb7ca88828e4ab2bcffbacf68dd7b34e32f0
Instruction ID: b225744e7085b7405ed9d8d9d64898bf06f33f1b2353d87eb831819939316299
Opcode Fuzzy Hash: bb6dc5b74097b152c00e49f8ea23fb7ca88828e4ab2bcffbacf68dd7b34e32f0
Instruction Fuzzy Hash: 11815EB1904209DFDB10DFA4C949BDEBBF4FB14308F20502DD455B7282EBB4A648CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F442FD Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 97libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F44307
GetModuleHandleW.KERNEL32(kernel32.dll,CreateToolhelp32Snapshot,000002A8,00F42EDD,00F43D8D,?,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F4431F
GetProcAddress.KERNEL32(00000000), ref: 00F44322
GetModuleHandleW.KERNEL32(Kernel32.dll,Process32First,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F4435D
GetProcAddress.KERNEL32(00000000), ref: 00F44360
GetModuleHandleW.KERNEL32(Kernel32.dll,Process32Next,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F44376
GetProcAddress.KERNEL32(00000000), ref: 00F44379

Part of subcall function 00F44466: __EH_prolog3_GS.LIBCMT ref: 00F44470
Part of subcall function 00F44466: GetModuleHandleW.KERNEL32(Ntdll.dll,NtQueryInformationProcess,?,00000400,?,000004A0,00F44454,00000000,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F444A0
Part of subcall function 00F44466: GetProcAddress.KERNEL32(00000000), ref: 00F444A7
Part of subcall function 00F44466: OpenProcess.KERNEL32(00000400,00000000,?,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F444D3

Strings

CreateToolhelp32Snapshot, xrefs: 00F44315
kernel32.dll, xrefs: 00F4431A
Kernel32.dll, xrefs: 00F44358, 00F4436B
Process32Next, xrefs: 00F44366
Process32First, xrefs: 00F44353

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc$H_prolog3_$OpenProcess
String ID: CreateToolhelp32Snapshot$Kernel32.dll$Process32First$Process32Next$kernel32.dll
API String ID: 175859365-1872946363
Opcode ID: 7dabd24be8fd08690a43e044517b5be0a6d4a20bff630042521559791886bc55
Instruction ID: 369dd3a4169b73c7f022ee5b7201dd6aca0aac69979eef3e8c0002ed270c86ea
Opcode Fuzzy Hash: 7dabd24be8fd08690a43e044517b5be0a6d4a20bff630042521559791886bc55
Instruction Fuzzy Hash: 59316F71A00218ABDF24EBA0CC89BED7B78AF05700F204095E905B7192DF74AE44AF12

Uniqueness

Uniqueness Score: -1.00%

Function 00EF4A00 Relevance: 19.8, APIs: 6, Strings: 7, Instructions: 283COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EF4A44
SetLastError.KERNEL32(00F908E8), ref: 00EF4A93
GetLastError.KERNEL32 ref: 00EF4AAA
SetLastError.KERNEL32(00F908E8), ref: 00EF4AF0
GetLastError.KERNEL32 ref: 00EF4B07
SetLastError.KERNEL32(00F908E8), ref: 00EF4B5F

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Strings

true, xrefs: 00EF4E07
Key, xrefs: 00EF4B6E
", xrefs: 00EF4DE2
Check64Bit, xrefs: 00EF4C91
ValueName, xrefs: 00EF4C0A
Condition.cpp, xrefs: 00EF4D2E
Invalid registry exists condition: no key specified, xrefs: 00EF4D59

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: "$Check64Bit$Condition.cpp$Invalid registry exists condition: no key specified$Key$ValueName$true
API String ID: 1452528299-3014655832
Opcode ID: c8248a7a888e0c731a89a578eea69158bfd8056cf9052fdcddf080820296f796
Instruction ID: 86c960f7ff8a47789340b58946ce070c71973f6be828892f911642dda12e7551
Opcode Fuzzy Hash: c8248a7a888e0c731a89a578eea69158bfd8056cf9052fdcddf080820296f796
Instruction Fuzzy Hash: 5BD158B0D0529CDEEF21DBA4DC54BEEBBB4AB14308F148199D048B72D2DBB45A48DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00ED5100 Relevance: 19.6, APIs: 3, Strings: 8, Instructions: 379COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(-00000004,00F9091C,00000000,?,00000000,Engine: registering/unregistering ARP entry, will use maintenance mode detection from setup.xml,?,00000000,SetupEngine.cpp,?,00000000,33A37B94,?,00000000), ref: 00ED5443
GetLastError.KERNEL32(?,00000000,SetupEngine.cpp,?,00000000,33A37B94,?,00000000), ref: 00ED547B
SetLastError.KERNEL32(00F908E8,?,00000000,SetupEngine.cpp,?,00000000,33A37B94,?,00000000), ref: 00ED54C5

Part of subcall function 00EB4810: GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
Part of subcall function 00EB4810: SetLastError.KERNEL32(?), ref: 00EB48AA

Strings

unregistering, xrefs: 00ED5658
registering, xrefs: 00ED565D, 00ED5679
No ARP information provided in setup.xml, skipping register/unregister ARP info, xrefs: 00ED517B
Engine: %s ARP entry, xrefs: 00ED5680
SetupEngine.cpp, xrefs: 00ED5156, 00ED5222, 00ED5313, 00ED5662, 00ED5685
Engine: registering/unregistering ARP entry, will use maintenance mode detection from setup.xml, xrefs: 00ED5247
No maintenance mode detection condition in setup.xml, skipping register/unregister ARP info, xrefs: 00ED5338
=, xrefs: 00ED566F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString$DriveType
String ID: =$Engine: %s ARP entry$Engine: registering/unregistering ARP entry, will use maintenance mode detection from setup.xml$No ARP information provided in setup.xml, skipping register/unregister ARP info$No maintenance mode detection condition in setup.xml, skipping register/unregister ARP info$SetupEngine.cpp$registering$unregistering
API String ID: 568823952-2460947592
Opcode ID: 427071bb8a9cb61df4f76a9e749d6a61379c3dc49879bd3adde01127b9d2eebe
Instruction ID: e417a231a09814e9aa944d3be5c6e7670ee666b25ade45195359171fd68978c4
Opcode Fuzzy Hash: 427071bb8a9cb61df4f76a9e749d6a61379c3dc49879bd3adde01127b9d2eebe
Instruction Fuzzy Hash: C7F1C170A05388EEEF24DF64DC48BEEBBB1EF01308F185159E4057B292DBB45A49DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EBCA50 Relevance: 19.6, APIs: 3, Strings: 8, Instructions: 337COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EBCABE
SetLastError.KERNEL32(?), ref: 00EBCAFD

Part of subcall function 00EB48D0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60F81,000000FF,?,00EB2726), ref: 00EB4907
Part of subcall function 00EB48D0: SetLastError.KERNEL32(?,?,?,?,?,00F60F81,000000FF), ref: 00EB4946

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

new.LIBCMT ref: 00EBCE8E

Strings

IScript:, xrefs: 00EBCBA2
!, xrefs: 00EBCD1C
Extension: failed to get ISRT.dll resource, error 0x%08x, xrefs: 00EBCC94
ExtensionDelegate.cpp, xrefs: 00EBCC8A, 00EBCD0C
Extension: failed to get setup.inx resource, error 0x%08x, xrefs: 00EBCD16
setup.inx, xrefs: 00EBCCC4
ISSetup.dll, xrefs: 00EBCBE6
ISRT.dll, xrefs: 00EBCC47

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: !$Extension: failed to get ISRT.dll resource, error 0x%08x$Extension: failed to get setup.inx resource, error 0x%08x$ExtensionDelegate.cpp$ISRT.dll$ISSetup.dll$IScript:$setup.inx
API String ID: 2425351278-1511573062
Opcode ID: 337ca88aeeacdc326598aa822c79bab680c302228a6fad9a1f175d32524701d3
Instruction ID: af21599004a413ac8836b0e0ba2210e28707bcfe6c211cb9e1701978aa9bcfc4
Opcode Fuzzy Hash: 337ca88aeeacdc326598aa822c79bab680c302228a6fad9a1f175d32524701d3
Instruction Fuzzy Hash: 3CE1BD70A09258DEEF24DF64CC95BEEBBF4AF15304F1441E8E449B7282DB709A48DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2CF80 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 283COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F2D127

Strings

IspParcelHandler.cpp, xrefs: 00F2CFD6, 00F2D16B, 00F2D307, 00F2D34D
ProductVersion, xrefs: 00F2D0EB, 00F2D236
!, xrefs: 00F2D2D8
Compare, xrefs: 00F2D2A5
Equal, xrefs: 00F2D281
Isp parcel detection: failed to validate installed condition, error %x, xrefs: 00F2D311
ISP parcel detect: condition is overridden by setup.xml detect, xrefs: 00F2CFFB
ProductCode, xrefs: 00F2D0A1, 00F2D1EE
Isp parcel detection: failed to create new installed condition, xrefs: 00F2D18D
Isp parcel detection: failed to evaluate installed condition, error %x, xrefs: 00F2D357

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: !$Compare$Equal$ISP parcel detect: condition is overridden by setup.xml detect$Isp parcel detection: failed to create new installed condition$Isp parcel detection: failed to evaluate installed condition, error %x$Isp parcel detection: failed to validate installed condition, error %x$IspParcelHandler.cpp$ProductCode$ProductVersion
API String ID: 0-4212178543
Opcode ID: 6cf02b042597e31a45a1f665bde9ed32ef9b70647154bc3b5e371f3da47ec394
Instruction ID: b664e6dd47150e306820dbce91baaab18427a55e065c29e73510a24c7b9bb868
Opcode Fuzzy Hash: 6cf02b042597e31a45a1f665bde9ed32ef9b70647154bc3b5e371f3da47ec394
Instruction Fuzzy Hash: 31C1D0B0900258EFEF24DBA4DC85BDEBBB0FF15304F144189E44577282DBB45A89EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00ED1AA8 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 229COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00F9091C,80000000,00000003,00000080,00000003,00000000,00000000,00F9091C,00000000), ref: 00ED1AD5
SetLastError.KERNEL32(00F908E8), ref: 00ED1B3C
new.LIBCMT ref: 00ED1C2A

Strings

?, xrefs: 00ED1E51
Size, xrefs: 00ED1CD4
, xrefs: 00ED1AA8
%I64d, xrefs: 00ED1B4D
Engine: failed to download suite update, error 0x%08x, xrefs: 00ED1DC9
Name, xrefs: 00ED1C83
SetupEngine.cpp, xrefs: 00ED1B88, 00ED1DB4, 00ED1DD4
Engine: attempting to download updated suite, xrefs: 00ED1BAA

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: $%I64d$?$Engine: attempting to download updated suite$Engine: failed to download suite update, error 0x%08x$Name$SetupEngine.cpp$Size
API String ID: 1452528299-4000506540
Opcode ID: 24a312862a2b05d9a09d211d3d31da17513d9c1efe3be50ba7f3d1407943f4a2
Instruction ID: 055a538b5b6d56e412781c8c20d03b761db7bcdc5eafbec593005a381b856380
Opcode Fuzzy Hash: 24a312862a2b05d9a09d211d3d31da17513d9c1efe3be50ba7f3d1407943f4a2
Instruction Fuzzy Hash: 08B18AB0905298DEEF11DBA4D949BDEBBB0AB10304F1440EAE44877292DBB41F49DF52

Uniqueness

Uniqueness Score: -1.00%

Function 00EBA8D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EBA91B

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Part of subcall function 00EBAE70: VariantClear.OLEAUT32(?), ref: 00EBAE86
Part of subcall function 00EBAE70: SysAllocString.OLEAUT32(?), ref: 00EBAE99

Part of subcall function 00EB6CA0: GetLastError.KERNEL32(33A37B94,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94,?,00F7979A), ref: 00EB6CE3
Part of subcall function 00EB6CA0: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94), ref: 00EB6D60

VariantInit.OLEAUT32 ref: 00EBA97F
VariantInit.OLEAUT32 ref: 00EBA99B
VariantInit.OLEAUT32 ref: 00EBA9B7
VariantCopy.OLEAUT32(?,?), ref: 00EBA9D2
VariantClear.OLEAUT32(?), ref: 00EBAA76
VariantClear.OLEAUT32(?), ref: 00EBAA83

Part of subcall function 00EBAF20: __CxxThrowException@8.LIBVCRUNTIME ref: 00EBAF32

Part of subcall function 00EBAAB0: VariantInit.OLEAUT32(?), ref: 00EBAB14
Part of subcall function 00EBAAB0: VariantInit.OLEAUT32 ref: 00EBAB52
Part of subcall function 00EBAAB0: VariantInit.OLEAUT32 ref: 00EBAB6E
Part of subcall function 00EBAAB0: VariantInit.OLEAUT32 ref: 00EBAB8A
Part of subcall function 00EBAAB0: VariantInit.OLEAUT32 ref: 00EBABA6
Part of subcall function 00EBAAB0: VariantCopy.OLEAUT32(?,?), ref: 00EBABBE

Strings

ScriptExtension: failed to init script, error 0x%08x, xrefs: 00EBAA3A
|, xrefs: 00EBAA40
Common\IScriptExtension.cpp, xrefs: 00EBAA33
__ISRTSuiteExtInit, xrefs: 00EBA94A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Init$ClearString$AllocCopyErrorLast$Exception@8Throw
String ID: Common\IScriptExtension.cpp$ScriptExtension: failed to init script, error 0x%08x$__ISRTSuiteExtInit$|
API String ID: 2418387389-689324398
Opcode ID: 3ae7175a5a9d52a3ade225eed12d64846a461557570a1249913ba113a9ab9326
Instruction ID: fa5422c5d150864f9703720585d40df8ac035ff5412dd4d76cdd2c132e6141e8
Opcode Fuzzy Hash: 3ae7175a5a9d52a3ade225eed12d64846a461557570a1249913ba113a9ab9326
Instruction Fuzzy Hash: 4F512CB1D043489EDB05DFA8D945B9EBBF8EF08310F1481AEE409E7352DB749A04DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F43558 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 88registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,?,?,?,?,?,?,?,?,00F06BB9,33A37B94,?,00000000,00000000,00F9091C), ref: 00F4356D
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00F4357D
RegOpenKeyExW.ADVAPI32(80000003,.Default\Control Panel\desktop\ResourceLocale,00000000,000F003F,?,33A37B94), ref: 00F435B6
RegQueryValueExW.ADVAPI32(?,00F8B388,00000000,00000000,?,0000000A), ref: 00F435CE
RegOpenKeyExW.ADVAPI32(80000003,.DEFAULT\Control Panel\International,00000000,000F003F,?), ref: 00F435EF
RegQueryValueExW.ADVAPI32(?,Locale,00000000,00000000,?,0000000A), ref: 00F43609

Strings

.Default\Control Panel\desktop\ResourceLocale, xrefs: 00F435A9
.DEFAULT\Control Panel\International, xrefs: 00F435E5
Locale, xrefs: 00F43601
Kernel32.dll, xrefs: 00F43568
GetSystemDefaultUILanguage, xrefs: 00F43577

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: OpenQueryValue$AddressHandleModuleProc
String ID: .DEFAULT\Control Panel\International$.Default\Control Panel\desktop\ResourceLocale$GetSystemDefaultUILanguage$Kernel32.dll$Locale
API String ID: 1454740049-3798069133
Opcode ID: 1b8d80f68c15c3c1e7d11551aad2f6edc4c3f5a032755644fbf215fbab3a4112
Instruction ID: f318dc39f567f799f6681a35673aae0fbff777672410b5860ad00e82bcaa3cba
Opcode Fuzzy Hash: 1b8d80f68c15c3c1e7d11551aad2f6edc4c3f5a032755644fbf215fbab3a4112
Instruction Fuzzy Hash: 61213271E0021EBEEB11ABA18C45EFF77ACEB14745F150129BD01F2141DA749E05A7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00ED87F0 Relevance: 18.5, APIs: 10, Strings: 2, Instructions: 454COMMON

Download Yara Rule

APIs

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

GetLastError.KERNEL32 ref: 00ED8936
SetLastError.KERNEL32(00F908E8), ref: 00ED8994
GetLastError.KERNEL32 ref: 00ED89A8
SetLastError.KERNEL32(00F908E8), ref: 00ED89EE
GetLastError.KERNEL32 ref: 00ED8A02
SetLastError.KERNEL32(00F908E8), ref: 00ED8A48
GetLastError.KERNEL32 ref: 00ED8A62
SetLastError.KERNEL32(00F908E8), ref: 00ED8AC9
GetLastError.KERNEL32 ref: 00ED8AE3
SetLastError.KERNEL32(00F908E8), ref: 00ED8B4A

Strings

**********, xrefs: 00ED8DF2
$, xrefs: 00ED8E36

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: $$**********
API String ID: 1452528299-2042610098
Opcode ID: eaa4482908121a5fe8a2d0233dad064a6bbf91d7face882074a575f828e7f59e
Instruction ID: 43457fd44b9430a7d39c455864182a1952afbb203a1ad571815883ca1bdb0635
Opcode Fuzzy Hash: eaa4482908121a5fe8a2d0233dad064a6bbf91d7face882074a575f828e7f59e
Instruction Fuzzy Hash: 18225870904298DEEF25DB68CD94BDEBBB4AF15304F1480DAD049B7282DBB05B89DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EF8CE0 Relevance: 18.3, APIs: 2, Strings: 10, Instructions: 332COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EF8D52
SetLastError.KERNEL32(00F908E8), ref: 00EF8D9C

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Part of subcall function 00EF9290: VariantInit.OLEAUT32(00000007), ref: 00EF9330
Part of subcall function 00EF9290: VariantInit.OLEAUT32(?), ref: 00EF9347
Part of subcall function 00EF9290: GetLastError.KERNEL32 ref: 00EF9381
Part of subcall function 00EF9290: SetLastError.KERNEL32(?), ref: 00EF93C3
Part of subcall function 00EF9290: GetLastError.KERNEL32 ref: 00EF93E2

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Strings

ProductVersion, xrefs: 00EF8EDF, 00EF902C
Compare, xrefs: 00EF8F68, 00EF90BD
LessThan, xrefs: 00EF9083
ProductCode, xrefs: 00EF8E83
Condition.cpp, xrefs: 00EF91DB, 00EF9242
GreaterEqual, xrefs: 00EF8F33, 00EF8F4F
LessEqual, xrefs: 00EF9092, 00EF90AA
MsiRelated evaluation: failed to build MsiInstalled condition, error %x, xrefs: 00EF9237
MsiRelated evaluation: failed to evaluate MsiInstalled condition, error %x, xrefs: 00EF91E5, 00EF9225
GreaterThan, xrefs: 00EF8E65

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$String$FreeInitVariant$Alloc
String ID: Compare$Condition.cpp$GreaterEqual$GreaterThan$LessEqual$LessThan$MsiRelated evaluation: failed to build MsiInstalled condition, error %x$MsiRelated evaluation: failed to evaluate MsiInstalled condition, error %x$ProductCode$ProductVersion
API String ID: 1079116179-3350049033
Opcode ID: e3da44d9e7835da5d26bd074c08f9fcecfff87adf3c7213b4e35b51a77f38a22
Instruction ID: 0d0b90fb135d422222de5a47721ae53129b0e6b980f03fbb88707cbc0a60e324
Opcode Fuzzy Hash: e3da44d9e7835da5d26bd074c08f9fcecfff87adf3c7213b4e35b51a77f38a22
Instruction Fuzzy Hash: A3F1477190525CDEEF21DB64CC88BEEBBB8AF15304F1440D9D149B7292DBB05A88DF62

Uniqueness

Uniqueness Score: -1.00%

Function 00F30AA0 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

new.LIBCMT ref: 00F30BB8

Part of subcall function 00EF9290: VariantInit.OLEAUT32(00000007), ref: 00EF9330
Part of subcall function 00EF9290: VariantInit.OLEAUT32(?), ref: 00EF9347
Part of subcall function 00EF9290: GetLastError.KERNEL32 ref: 00EF9381
Part of subcall function 00EF9290: SetLastError.KERNEL32(?), ref: 00EF93C3
Part of subcall function 00EF9290: GetLastError.KERNEL32 ref: 00EF93E2

Strings

true, xrefs: 00F30DB9, 00F30DD1
Failed to allocate msi installed condition, xrefs: 00F30C31
MSI patch detect: product code: '%s', patch code: '%s', xrefs: 00F30BA8
MsiParcelHandler.cpp, xrefs: 00F30B77, 00F30BAD, 00F30C0F, 00F30D68, 00F30D77, 00F30DAF, 00F30DD8
PatchCode, xrefs: 00F30ADC, 00F30D1C
MSI patch detect: evaluate status: %x, is installed: %s, xrefs: 00F30DD3
ProductCode, xrefs: 00F30B2D, 00F30CD4
MSI patch detect: failed to validate condition, error: %x, xrefs: 00F30D72
false, xrefs: 00F30DAA

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeInitStringVariant
String ID: Failed to allocate msi installed condition$MSI patch detect: evaluate status: %x, is installed: %s$MSI patch detect: failed to validate condition, error: %x$MSI patch detect: product code: '%s', patch code: '%s'$MsiParcelHandler.cpp$PatchCode$ProductCode$false$true
API String ID: 4090687836-2311497672
Opcode ID: 93ddb4dd53c2725495acb6d50140cda52ee52029ab44b996e7b484ee1d157246
Instruction ID: b7a048251911f219a238faace4f5473da169fad95a34258985d0e5fa9636d765
Opcode Fuzzy Hash: 93ddb4dd53c2725495acb6d50140cda52ee52029ab44b996e7b484ee1d157246
Instruction Fuzzy Hash: 0DB1ADB0904258EFEF21DBA4DC99BDEBBB4BF15304F14418AE40577292DBB05A48DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F457C2 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 161stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F457C9
SetLastError.KERNEL32(00002EE6), ref: 00F45835
lstrcmpiW.KERNEL32(?,?), ref: 00F458A5
lstrlenW.KERNEL32(?), ref: 00F458DE
lstrcpyW.KERNEL32(00000000,?), ref: 00F45904
lstrlenW.KERNEL32(?), ref: 00F4590D
lstrcpyW.KERNEL32(00000000,?), ref: 00F45935
lstrcatW.KERNEL32(?,?), ref: 00F45946

Strings

<, xrefs: 00F457D2
GET, xrefs: 00F4595D

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: lstrcpylstrlen$ErrorH_prolog3Lastlstrcatlstrcmpi
String ID: <$GET
API String ID: 152113618-427699995
Opcode ID: ddd3397338d6db3e400ea7c0a6741a70e7dc0d25b9bc0383298be589e77b1462
Instruction ID: 39e60b26bee2b8ebddb5f93b22aacc14bad542f5c0766370afff0a4260fa16df
Opcode Fuzzy Hash: ddd3397338d6db3e400ea7c0a6741a70e7dc0d25b9bc0383298be589e77b1462
Instruction Fuzzy Hash: A4515872901119EFDF15AFA1DD09AAE7F76FF08760F044029FE05AA262DB358911EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9290 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

VariantInit.OLEAUT32(00000007), ref: 00EF9330
VariantInit.OLEAUT32(?), ref: 00EF9347
GetLastError.KERNEL32 ref: 00EF9381
SetLastError.KERNEL32(?), ref: 00EF93C3
GetLastError.KERNEL32 ref: 00EF93E2
SetLastError.KERNEL32(?), ref: 00EF941E
GetLastError.KERNEL32 ref: 00EF943D
SetLastError.KERNEL32(?), ref: 00EF9479
VariantInit.OLEAUT32(?), ref: 00EF9496

Strings

GreaterThan, xrefs: 00EF92A4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$InitVariant
String ID: GreaterThan
API String ID: 201494241-2075541825
Opcode ID: d0c827f654b0ee78c55cb7097ec1631a6ef3dd65c33606b1717134a6c5107e98
Instruction ID: 81be693b02789bb8282970f11f243015829a633379e8c17c21fe402a6c2f4525
Opcode Fuzzy Hash: d0c827f654b0ee78c55cb7097ec1631a6ef3dd65c33606b1717134a6c5107e98
Instruction Fuzzy Hash: B87102B0805788CFDB60CF69C54878ABFF0BF09314F10899DD4899B762D775AA08DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F06A80 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 138COMMON

Download Yara Rule

Strings

Using installed language %d, xrefs: 00F06AED
Using command line language %d, xrefs: 00F06AA8
Using system default UI language %d, xrefs: 00F06BE0
Using default language %d, xrefs: 00F06C08
Using user default language %d, xrefs: 00F06B45
a, xrefs: 00F06C00
T, xrefs: 00F06B95
Using system default language %d, xrefs: 00F06B8F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: T$Using command line language %d$Using default language %d$Using installed language %d$Using system default UI language %d$Using system default language %d$Using user default language %d$a
API String ID: 0-2116512202
Opcode ID: eb289110a5ba41a6d3c5887a6f9d71562f11279c2e9190093d57f001c87335c3
Instruction ID: a0dc6deeefc2b8675f253236e3b2cf29017bfe610b4e8fcf772ca97844d1406b
Opcode Fuzzy Hash: eb289110a5ba41a6d3c5887a6f9d71562f11279c2e9190093d57f001c87335c3
Instruction Fuzzy Hash: 7941DB72604309ABCB10FF14D8059ABBBD9EFD4314F00446EF984D7291D7B99528BBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00F4559A Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F45694: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456A7
Part of subcall function 00F45694: GetProcAddress.KERNEL32(00000000), ref: 00F456AE
Part of subcall function 00F45694: GetCurrentProcess.KERNEL32(00000000,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456BE

GetModuleHandleW.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,?,?,?,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F455BF
GetProcAddress.KERNEL32(00000000), ref: 00F455C8
GetModuleHandleW.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F455D3
GetProcAddress.KERNEL32(00000000), ref: 00F455D6
GetModuleHandleW.KERNEL32(kernel32,Wow64EnableWow64FsRedirection,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F45649
GetProcAddress.KERNEL32(00000000), ref: 00F4564C

Strings

Wow64EnableWow64FsRedirection, xrefs: 00F4563F
Wow64RevertWow64FsRedirection, xrefs: 00F455CA
Wow64DisableWow64FsRedirection, xrefs: 00F455B9
kernel32, xrefs: 00F455B3, 00F455BE, 00F455CF, 00F45644

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentProcess
String ID: Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32
API String ID: 565683799-3439747844
Opcode ID: ec35febbcbfefce1f2da385b8b3c09f8328468f68dae31c30036623d11710915
Instruction ID: b19537f35cb9e5b742233982f9b97634cb6db49b2564d6fdb46f0089c2e48c4c
Opcode Fuzzy Hash: ec35febbcbfefce1f2da385b8b3c09f8328468f68dae31c30036623d11710915
Instruction Fuzzy Hash: B4110331B0170CABDB10BBB59C85BAE7F9D9F84B20F85002AEC04D3292DA79DD04BB11

Uniqueness

Uniqueness Score: -1.00%

Function 00F08330 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 403COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00F925F8,?,?,?), ref: 00F08485
SetLastError.KERNEL32(00F908E8,?,?,?), ref: 00F084E4

Strings

GetPathOnly, xrefs: 00F08380
RootPath, xrefs: 00F088D5
:, xrefs: 00F08908
ParcelId, xrefs: 00F08627
Name, xrefs: 00F08522, 00F087D5
Package path not found while trying to stage package. Containing parcel has no ID, xrefs: 00F08692
ForceStageSourceType, xrefs: 00F083F9
Package.cpp, xrefs: 00F085D0, 00F0867E
Source path not found attempting to stage parcel, xrefs: 00F085E4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: :$ForceStageSourceType$GetPathOnly$Name$Package path not found while trying to stage package. Containing parcel has no ID$Package.cpp$ParcelId$RootPath$Source path not found attempting to stage parcel
API String ID: 1452528299-4144558148
Opcode ID: 856730a7935b793a57107b637b8b9252cc6ff79f0b12754a377bdc06097af837
Instruction ID: 8a5af7902ec4e015114f215ecf036dd6e20a6d26d12daa471dd9279dcaa3746c
Opcode Fuzzy Hash: 856730a7935b793a57107b637b8b9252cc6ff79f0b12754a377bdc06097af837
Instruction Fuzzy Hash: 3402AB70904258EEEF25EBA4DC95BEEBBB4BF14300F54419DE045632C2DBB05B49EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F32390 Relevance: 16.7, APIs: 10, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

Part of subcall function 00EEA8B0: new.LIBCMT ref: 00EEA8DD

GetLastError.KERNEL32(33A37B94,?,?,00F32966,00000010), ref: 00F32444
SetLastError.KERNEL32(?), ref: 00F32486
GetLastError.KERNEL32 ref: 00F324A2
SetLastError.KERNEL32(?), ref: 00F324DE
GetLastError.KERNEL32 ref: 00F324FA
SetLastError.KERNEL32(?), ref: 00F32536
GetLastError.KERNEL32 ref: 00F32555
SetLastError.KERNEL32(?), ref: 00F32591
GetLastError.KERNEL32 ref: 00F325B0
SetLastError.KERNEL32(?), ref: 00F325EC

Strings

$, xrefs: 00F325DE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: $
API String ID: 1452528299-3993045852
Opcode ID: 17512f93112a44ae0c39e4f4fb5b34a1124e8bd2c36bf5c74b346321cdcf359b
Instruction ID: fbdb20ddb4d468fce1f0668ecf38e6a7168adf3155dbd9c5a9d89524c0b708d0
Opcode Fuzzy Hash: 17512f93112a44ae0c39e4f4fb5b34a1124e8bd2c36bf5c74b346321cdcf359b
Instruction Fuzzy Hash: A18117B0801788CFDB60CFA9C54874ABFF0BF08314F148A9DD489A7752D7B5AA04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F1CE40 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 291libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB6EC0: GetLastError.KERNEL32(33A37B94,?,00EB5D01,00EB5D01,00F90920,00F60FF9,000000FF,?,00EB6814,00F8B388,00000000,?,00000000), ref: 00EB6F02
Part of subcall function 00EB6EC0: SetLastError.KERNEL32(00F908E8,00F8B388,00000000,?,00EB5D01,00EB5D01,00F90920,00F60FF9,000000FF,?,00EB6814,00F8B388,00000000,?,00000000), ref: 00EB6F65

LoadLibraryW.KERNEL32(?,00F8B388,?,?,00000000,33A37B94), ref: 00F1CED1
GetLastError.KERNEL32 ref: 00F1CEE7
GetProcAddress.KERNEL32(00000000,00000000), ref: 00F1CF67
GetLastError.KERNEL32 ref: 00F1CF77

Strings

_SuiteClrActionEntry@16, xrefs: 00F1D04E
_SuitePSHostEntry@8, xrefs: 00F1D032

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: _SuiteClrActionEntry@16$_SuitePSHostEntry@8
API String ID: 1866314245-1896176088
Opcode ID: 067619bece29970aa3ff6159c0c4f113718f1c372112198258f980bb91615fec
Instruction ID: e46adfb8369a507d0b6f97a08a0a316ab3a109a4abb8986c7a1e68d533cf6726
Opcode Fuzzy Hash: 067619bece29970aa3ff6159c0c4f113718f1c372112198258f980bb91615fec
Instruction Fuzzy Hash: 8EC17070A00259DFDB24DF98CC94BEEB7B4AF54304F148199E409B7242DB70AE89EF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4510 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 188registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,?,?,?,00020019,33A37B94), ref: 00EC45BF
RegCloseKey.ADVAPI32(00000000), ref: 00EC4607

Part of subcall function 00F45694: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456A7
Part of subcall function 00F45694: GetProcAddress.KERNEL32(00000000), ref: 00F456AE
Part of subcall function 00F45694: GetCurrentProcess.KERNEL32(00000000,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456BE

RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,?,?), ref: 00EC475C

Strings

Evaluate registry condition: error %x querying reg value, xrefs: 00EC4782
Z, xrefs: 00EC4788
RegistryProvider.cpp, xrefs: 00EC45DD, 00EC4688, 00EC477B
q=, xrefs: 00EC4702, 00EC470F
Evaluate registry value condition: unable to allocate memory for reg value, xrefs: 00EC46AA
Evaluate registry value condition: unexpected error 0x%08x querying registry value '%s', xrefs: 00EC45E4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: QueryValue$AddressCloseCurrentHandleModuleProcProcess
String ID: Evaluate registry condition: error %x querying reg value$Evaluate registry value condition: unable to allocate memory for reg value$Evaluate registry value condition: unexpected error 0x%08x querying registry value '%s'$RegistryProvider.cpp$Z$q=
API String ID: 3054686338-3571612815
Opcode ID: 9f397c9825a498d6ccce53cd92db8b6c38dfef5e8fc452b2910f4d5d893215e6
Instruction ID: 9d9ebe06de1b9896f6c9bd758fdd0e2500f431224f37570630c61e7122663139
Opcode Fuzzy Hash: 9f397c9825a498d6ccce53cd92db8b6c38dfef5e8fc452b2910f4d5d893215e6
Instruction Fuzzy Hash: C671F1B0900248EFEF20DFA4DD55BAEBBB5EF05308F24415DE841BB292C7755909DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EBAAB0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EBAB14
VariantInit.OLEAUT32 ref: 00EBAB52
VariantInit.OLEAUT32 ref: 00EBAB6E
VariantInit.OLEAUT32 ref: 00EBAB8A
VariantInit.OLEAUT32 ref: 00EBABA6
VariantCopy.OLEAUT32(?,?), ref: 00EBABBE
VariantClear.OLEAUT32(?), ref: 00EBAC0C
VariantClear.OLEAUT32(?), ref: 00EBAC19

Strings

__SetSuiteExtension, xrefs: 00EBAB1D

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID: __SetSuiteExtension
API String ID: 3833040332-3087628983
Opcode ID: a212001148184b8949a1189bd77d536e7116aca63a71222630182ebfc8ca1efc
Instruction ID: 05a0597181d8452b5125492d04834294281d7149b5a15d76d1f517abdd54707c
Opcode Fuzzy Hash: a212001148184b8949a1189bd77d536e7116aca63a71222630182ebfc8ca1efc
Instruction Fuzzy Hash: 315107B1D052489EDB15DFA8C909B9EBFF8EF08310F1481AEE409EB351D7749A04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F460EE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 117stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00F46249,?,00000000,?,?,?,00EC0B4E,00000000,000000FF,33A37B94), ref: 00F4611E
wsprintfW.USER32 ref: 00F46152
lstrcatW.KERNEL32(?,?), ref: 00F46166
ResetEvent.KERNEL32(?,?,?,00F46249,?,00000000,?,?,?,00EC0B4E,00000000,000000FF,33A37B94), ref: 00F46175
GetLastError.KERNEL32(?,00F46249,?,00000000,?,?,?,00EC0B4E,00000000,000000FF,33A37B94), ref: 00F46181
ResetEvent.KERNEL32(?,?,?,00F46249,?,00000000,?,?,?,00EC0B4E,00000000,000000FF,33A37B94), ref: 00F461DC

Strings

A, xrefs: 00F4610A
Range: bytes=%d-, xrefs: 00F4614A
Range: bytes=%d-, xrefs: 00F46143

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorEventLastReset$lstrcatwsprintf
String ID: A$Range: bytes=%d-$Range: bytes=%d-
API String ID: 2894917480-4039695729
Opcode ID: 962876d9863ff3c71d369e2adb12db8a68d8603a1373f8f5c5915fe2a51bb324
Instruction ID: 054d9a8c88037ed3ff109162b5ddca0bd7548aac32fddcd77252dc08e45201e2
Opcode Fuzzy Hash: 962876d9863ff3c71d369e2adb12db8a68d8603a1373f8f5c5915fe2a51bb324
Instruction Fuzzy Hash: E8418F71600104EFDF158F64DC88A6A7FA9FF86710B1440A9FE05CA16ADB32DC50FB12

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD920 Relevance: 15.2, APIs: 10, Instructions: 186COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EBDA18
VariantInit.OLEAUT32 ref: 00EBDA72
VariantInit.OLEAUT32 ref: 00EBDA95
VariantInit.OLEAUT32 ref: 00EBDAB8
VariantInit.OLEAUT32 ref: 00EBDADB
VariantCopy.OLEAUT32(?,?), ref: 00EBDB00

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Init$Copy
String ID:
API String ID: 3837755448-0
Opcode ID: 8ad59700976d3c1f7389b286b97cd5b2b0b64d0c3574962710821ed08cd0a1ce
Instruction ID: 92a426bcc911d446238ff40ee750d7354843ee5902846db0b3bb919ed0f66f85
Opcode Fuzzy Hash: 8ad59700976d3c1f7389b286b97cd5b2b0b64d0c3574962710821ed08cd0a1ce
Instruction Fuzzy Hash: 4B714570909248DFDB10DF68C949BAABBF4EF09314F1581AEE449EB351EB349A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD660 Relevance: 15.2, APIs: 10, Instructions: 180COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EBD75D
VariantInit.OLEAUT32 ref: 00EBD7BC
VariantInit.OLEAUT32 ref: 00EBD7DB
VariantInit.OLEAUT32 ref: 00EBD7FA
VariantInit.OLEAUT32 ref: 00EBD819
VariantCopy.OLEAUT32(?,?), ref: 00EBD837

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Init$Copy
String ID:
API String ID: 3837755448-0
Opcode ID: 628b40a0d4796184fe422acada6a6639c224cb51ed3160514d849f9c2a852ede
Instruction ID: 73cf31f5eb80ba24177f5ad93798ac824dfda3dd60bffbcc276522c3be3f33d5
Opcode Fuzzy Hash: 628b40a0d4796184fe422acada6a6639c224cb51ed3160514d849f9c2a852ede
Instruction Fuzzy Hash: A27158B0905218DFDB14DF68C949B9ABBF8BF08300F1481AEE448E7351EB349A44DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F24B90 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 326libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000001,33A37B94,00000000,00000000,00F92610), ref: 00F24BF5
GetLastError.KERNEL32 ref: 00F24C0E

Strings

Failed to create extension handler for parcel interface on DLL call, error 0x%08x, xrefs: 00F24E97
Proxy DLL call action request failed, status 0x%08x, xrefs: 00F24F9D
Failed to create extension handler for DLL action, error %x, xrefs: 00F24D6A
Failed to obtain proxy handler for DLL call action, xrefs: 00F24CA8
ProxyApi.cpp, xrefs: 00F24C83, 00F24D70, 00F24E9C, 00F24EAF, 00F24F93
(DLL Action): , xrefs: 00F24DAC

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLastLibraryLoad
String ID: (DLL Action): $Failed to create extension handler for DLL action, error %x$Failed to create extension handler for parcel interface on DLL call, error 0x%08x$Failed to obtain proxy handler for DLL call action$Proxy DLL call action request failed, status 0x%08x$ProxyApi.cpp
API String ID: 3568775529-1975990019
Opcode ID: 1488e74cd4a6ec2e75c421504fd52e747bb561e93fd042d4dbd30dadb64d68cd
Instruction ID: 3d3f1316c3f54fcc5876ebf37c3657ce3d462192bd8dd3e8881f606ffda14149
Opcode Fuzzy Hash: 1488e74cd4a6ec2e75c421504fd52e747bb561e93fd042d4dbd30dadb64d68cd
Instruction Fuzzy Hash: 4CE19EB0A01268DFDB24DF54DC84BDEBBB5AF05310F1441D9E409A7282DB74AE48DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F23580 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EBE730: GetLastError.KERNEL32(33A37B94,?,00000000,?,?,?,00000000,00F63A01,000000FF,?,00EBE6C8,00000000,?,33A37B94), ref: 00EBE770
Part of subcall function 00EBE730: SetLastError.KERNEL32(?,?,00000000,?,?,?,00000000,00F63A01,000000FF,?,00EBE6C8,00000000,?,33A37B94), ref: 00EBE7B5
Part of subcall function 00EBE730: SetLastError.KERNEL32(?,00000000,-00000002,?,?,00000000), ref: 00EBE806

GetLastError.KERNEL32(00000000,?,-00000003,00000000,?,00000000,?,00F92584,00000001,00000001,?,00F8B388,?,00000000,33A37B94), ref: 00F2370A
SetLastError.KERNEL32(00F908E8, ,00000003,?,00F8B388,?,00000000,33A37B94), ref: 00F2376F
GetLastError.KERNEL32(00000000,00000000,?,00000000,00000000,?,000000FF,00000000,?,00F8B388,?,00000000,33A37B94), ref: 00F237EE
SysFreeString.OLEAUT32(00000000), ref: 00F2380E
SysFreeString.OLEAUT32(?), ref: 00F2381D
SetLastError.KERNEL32(00F9091C), ref: 00F23847

Strings

invalid string position, xrefs: 00F2385D
, xrefs: 00F2372C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: $invalid string position
API String ID: 2425351278-2310507360
Opcode ID: 8b51e8927e88c7060025bc29bd85e08ef40a10600c7727e82b6137cafa4b9d0c
Instruction ID: 4e498bdb31b1600356b5a0c76888bc2a015b87a015720467d4d1359d84025d61
Opcode Fuzzy Hash: 8b51e8927e88c7060025bc29bd85e08ef40a10600c7727e82b6137cafa4b9d0c
Instruction Fuzzy Hash: 87A169B1D00268DFDF10DFA8D858BDEBBB4AF04314F108599E419B7292CB749A48DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4000 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 189windowCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00EE4038
SysFreeString.OLEAUT32(?), ref: 00EE4058
GetErrorInfo.OLEAUT32(00000000,00000000,00000000,000000FF,00000000,000000FF,33A37B94,00000001,00000000,?,?,?), ref: 00EE4084
CLSIDFromProgID.OLE32(00000064,-00000020,?,?), ref: 00EE4119
FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,?), ref: 00EE4165
LocalFree.KERNEL32(?,00F8B388,?,?,?), ref: 00EE41B2
SysFreeString.OLEAUT32(?), ref: 00EE41D4

Strings

Unknown error, xrefs: 00EE41BC

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Free$String$ErrorFormatFromInfoLocalMessageProg
String ID: Unknown error
API String ID: 734698119-83687255
Opcode ID: b8cb5dc8a600922ae2f5cdbef334cf5278ee3a4b8fd433489f60a9baeb57469c
Instruction ID: ce154aaed3c1eb4bdd0a4cbc91fe72530211d6d6da96690f993272347505bfa0
Opcode Fuzzy Hash: b8cb5dc8a600922ae2f5cdbef334cf5278ee3a4b8fd433489f60a9baeb57469c
Instruction Fuzzy Hash: A07168B0A0064AAFDB14DFA9DD45BAAB7F8FF08314F104259E415EB691DB30E950CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F22F90 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 183registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

RegQueryValueExW.ADVAPI32(00000000,Language,00000000,?,00000000,74DEDFA0,80000002,-00000004,00020019,?,00000010,Software\Microsoft\Windows\CurrentVersion\Uninstall,?,00000000,33A37B94), ref: 00F23098
RegCloseKey.ADVAPI32(00000000,Maintenance: no uninstall key present,?,00000000,Common\MaintenanceRegistrar.cpp,?,00000000,80000002,-00000004,00020019,?,00000010,Software\Microsoft\Windows\CurrentVersion\Uninstall,?,00000000,33A37B94), ref: 00F23236

Strings

Common\MaintenanceRegistrar.cpp, xrefs: 00F230B4, 00F230FB, 00F2317D
Maintenance: no uninstall key present, xrefs: 00F2319F
Maintenance: uninstall key present but has no language value, xrefs: 00F2311D
Maintenance: got installed language: %d, xrefs: 00F230BE
Language, xrefs: 00F23092
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00F22FEE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$CloseQueryValue
String ID: Common\MaintenanceRegistrar.cpp$Language$Maintenance: got installed language: %d$Maintenance: no uninstall key present$Maintenance: uninstall key present but has no language value$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2032585594-644924750
Opcode ID: 05dd6c8fa871d69ec74e4c6839c61120afe5e738bee8a6c153ab7471e7524a2e
Instruction ID: d4b8c5442aef0724ed695cb978e4023c4d398f5e3ba3b0db556db2d4f9514969
Opcode Fuzzy Hash: 05dd6c8fa871d69ec74e4c6839c61120afe5e738bee8a6c153ab7471e7524a2e
Instruction Fuzzy Hash: F8819EB0D05258EEEF20DBA4EC45BDEBBB4BF11308F144159E440772C2DBB85A49EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBA250 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EBA2B1

Part of subcall function 00EB6CA0: GetLastError.KERNEL32(33A37B94,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94,?,00F7979A), ref: 00EB6CE3
Part of subcall function 00EB6CA0: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94), ref: 00EB6D60

VariantInit.OLEAUT32 ref: 00EBA2EF
VariantInit.OLEAUT32 ref: 00EBA30B
VariantInit.OLEAUT32 ref: 00EBA327
VariantInit.OLEAUT32 ref: 00EBA343
VariantInit.OLEAUT32 ref: 00EBA35F

Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,00EBA378), ref: 00EBA60B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,00F9091C), ref: 00EBA62B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,?), ref: 00EBA64B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,?), ref: 00EBA66B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(00F9091C,?), ref: 00EBA68B

Part of subcall function 00EB4810: GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
Part of subcall function 00EB4810: SetLastError.KERNEL32(?), ref: 00EB48AA

VariantClear.OLEAUT32(?), ref: 00EBA3E4

Strings

__ISRTSuiteExtUninit, xrefs: 00EBA2BA

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Init$Copy$ErrorLast$FreeString$Clear
String ID: __ISRTSuiteExtUninit
API String ID: 424148749-4113025277
Opcode ID: 972b142e302508783b209ce47d9e4814f6a1452f9582470b08e23ae6698a2de2
Instruction ID: 32e0a04d880ea4715be39bed7d4c4b78e69393d1af525c219e57bc0749e11adf
Opcode Fuzzy Hash: 972b142e302508783b209ce47d9e4814f6a1452f9582470b08e23ae6698a2de2
Instruction Fuzzy Hash: 7D7126B0905348DFDB14DFA8C549B9EBFF4AF09304F1881AEE019AB391D7749A04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8F20 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 171registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Part of subcall function 00EC3B20: GetModuleHandleW.KERNEL32(Advapi32.dll,?,00000000,?,00000000,?,00F38DE1,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,33A37B94,?), ref: 00EC3B44
Part of subcall function 00EC3B20: RegCloseKey.ADVAPI32(00000000,?,00F38DE1,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,33A37B94,?), ref: 00EC3BA7

GetLastError.KERNEL32(80000002,?,00020019,?,?,Software\InstallShield\SuiteInstallers\Parcels,?,00000000,33A37B94,?,?,00000000), ref: 00ED8FF9
SetLastError.KERNEL32(00F908E8,?,00000000), ref: 00ED9043
RegQueryValueExW.ADVAPI32(00000000,Clients,00000000,?,00000000,?,?,00000000), ref: 00ED9066
RegCloseKey.ADVAPI32(00000000,33A37B94,?,?,00000000), ref: 00ED914D

Strings

SetupEngine: parcel '%s' shared client count: %d, xrefs: 00ED912C
SetupEngine.cpp, xrefs: 00ED9122
Software\InstallShield\SuiteInstallers\Parcels, xrefs: 00ED8F5F
Clients, xrefs: 00ED9060, 00ED90B0

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$CloseFreeString$HandleModuleQueryValue
String ID: Clients$SetupEngine.cpp$SetupEngine: parcel '%s' shared client count: %d$Software\InstallShield\SuiteInstallers\Parcels
API String ID: 2931441609-3980309948
Opcode ID: bd70a1e9acc4f9781f0426fc2c70d2092168896c7111a54111cafa3818e9c698
Instruction ID: 115d122251678ca2279637ecb8e3b95d3bc88fcbb88495cb677ee206d6fa6f34
Opcode Fuzzy Hash: bd70a1e9acc4f9781f0426fc2c70d2092168896c7111a54111cafa3818e9c698
Instruction Fuzzy Hash: 82711970904258DEEB10DFA8DC99BEEBBF4FB04304F108199E115B7282DB756A49DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EED7B0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 168registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,000000CA,State manager: removing state info,?,00000000,StateManager.cpp,?,00000000,80000001,?,0002001F,33A37B94), ref: 00EED911
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,33A37B94,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,80000001,Software\InstallShield\SuiteInstallers,0002001F), ref: 00EED979

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

RegCloseKey.ADVAPI32(00000000,33A37B94), ref: 00EED9C6

Strings

SuiteInstallers, xrefs: 00EED9AA
State manager: removing state info, xrefs: 00EED8C2
Software\InstallShield, xrefs: 00EED998
StateManager.cpp, xrefs: 00EED8A0
Software\InstallShield\SuiteInstallers, xrefs: 00EED804, 00EED923

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CloseErrorLast$InfoQuery
String ID: Software\InstallShield$Software\InstallShield\SuiteInstallers$State manager: removing state info$StateManager.cpp$SuiteInstallers
API String ID: 1667384322-2728777982
Opcode ID: 3d212931835dfbce3d8df0a759cf0bd6576ecb9e7c2a9b50f05cff72f7cf4b30
Instruction ID: 00e02e879611cfeb4a29a798d2969ee12f3961361b5ceb0dac91bf077a7543ee
Opcode Fuzzy Hash: 3d212931835dfbce3d8df0a759cf0bd6576ecb9e7c2a9b50f05cff72f7cf4b30
Instruction Fuzzy Hash: 1861697090425CEAEB24EBA5DC45BEEBBB4FF04704F20511EE511B7283DBB06A09DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00EBE940 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 142COMMON

Download Yara Rule

Strings

modified, xrefs: 00EBE9BF
create, xrefs: 00EBE9E5
access, xrefs: 00EBE9CF

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: access$create$modified
API String ID: 0-2206879983
Opcode ID: 79b05202e30f6408c983016775c5ebd1cdb63dda14021bc1cee8eef6f973c903
Instruction ID: e86bb7f6f032535efa33087f94b1e096d01f6a97dfa12f7c5849f8e14384ba3a
Opcode Fuzzy Hash: 79b05202e30f6408c983016775c5ebd1cdb63dda14021bc1cee8eef6f973c903
Instruction Fuzzy Hash: 77514F75A0021D9FDF20DBA4CD45BDEBBB8EB05300F5041A9E949F3282DB74AE48DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBAC40 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EBAC84

Part of subcall function 00EB6CA0: GetLastError.KERNEL32(33A37B94,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94,?,00F7979A), ref: 00EB6CE3
Part of subcall function 00EB6CA0: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94), ref: 00EB6D60

VariantInit.OLEAUT32 ref: 00EBACC5
VariantInit.OLEAUT32 ref: 00EBACE1
VariantInit.OLEAUT32 ref: 00EBACFD
VariantInit.OLEAUT32 ref: 00EBAD19
VariantInit.OLEAUT32 ref: 00EBAD35

Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,00EBA378), ref: 00EBA60B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,00F9091C), ref: 00EBA62B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,?), ref: 00EBA64B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(?,?), ref: 00EBA66B
Part of subcall function 00EBA580: VariantCopy.OLEAUT32(00F9091C,?), ref: 00EBA68B

Part of subcall function 00EB4810: GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
Part of subcall function 00EB4810: SetLastError.KERNEL32(?), ref: 00EB48AA

VariantClear.OLEAUT32(?), ref: 00EBAD67

Strings

__RevokeSuiteExtension, xrefs: 00EBAC90

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Init$Copy$ErrorLast$FreeString$Clear
String ID: __RevokeSuiteExtension
API String ID: 424148749-93083935
Opcode ID: b2723f2012879397b1fb32acebe701237bb9f07db38de9aa432352e7b3707afd
Instruction ID: c740f641724dd8f34c2982be3d338318b98efb6e9096c89f977552e50f181cb7
Opcode Fuzzy Hash: b2723f2012879397b1fb32acebe701237bb9f07db38de9aa432352e7b3707afd
Instruction Fuzzy Hash: 554108B0D15248DEDB05DFACD90AA9EBFF8EB08310F1581AEE009EB351D7749A04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F424D4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F424DE
GetModuleHandleW.KERNEL32(kernel32.dll,FindFirstFileW,00000254,00F418E0), ref: 00F424FA
GetProcAddress.KERNEL32(00000000), ref: 00F424FD
GetModuleHandleW.KERNEL32(kernel32.dll,FindFirstFileA), ref: 00F4253D
GetProcAddress.KERNEL32(00000000), ref: 00F42540

Strings

kernel32.dll, xrefs: 00F424F5, 00F42538
FindFirstFileW, xrefs: 00F424F0
FindFirstFileA, xrefs: 00F42533

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc$H_prolog3_
String ID: FindFirstFileA$FindFirstFileW$kernel32.dll
API String ID: 762132516-163559883
Opcode ID: 165fa7644356f463c51d3bc78258f0b9926ec71ca3c654f365a84c234e70d358
Instruction ID: 6a09c9419e02fed035bda6894d0f8a4507962190d48d28fa5368f1b0b1d8865e
Opcode Fuzzy Hash: 165fa7644356f463c51d3bc78258f0b9926ec71ca3c654f365a84c234e70d358
Instruction Fuzzy Hash: 5C11C131D00628ABCF54FB64CC9DAEE3A64AB84761F940664BC15A71C1DB34DE45EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F45286 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4528D
GetModuleHandleW.KERNEL32(kernel32.dll,SetFileAttributesW,00000000,00F4179C,?,00000000), ref: 00F452A7
GetProcAddress.KERNEL32(00000000), ref: 00F452AA
GetModuleHandleW.KERNEL32(kernel32.dll,SetFileAttributesA), ref: 00F452D1
GetProcAddress.KERNEL32(00000000), ref: 00F452D4

Strings

kernel32.dll, xrefs: 00F4529F, 00F452CC
SetFileAttributesA, xrefs: 00F452C7
SetFileAttributesW, xrefs: 00F4529A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc$H_prolog3
String ID: SetFileAttributesA$SetFileAttributesW$kernel32.dll
API String ID: 1623054726-3589348009
Opcode ID: 24c826266f9e84a35f78456d71b3663439c1fea1e2779ead5f5df53134a773fd
Instruction ID: 87e26deae89f9f490f5d0e6f4189f8ff64e570cf0491dc91497535201f988e60
Opcode Fuzzy Hash: 24c826266f9e84a35f78456d71b3663439c1fea1e2779ead5f5df53134a773fd
Instruction Fuzzy Hash: 25F0AF71500A18ABCF55BF74DC199DE3AA4AF84B50B914505F901EB182DB75C601EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F28BD0 Relevance: 13.9, APIs: 2, Strings: 7, Instructions: 358COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,Running Appx parcel operation,?,00000000,AppxParcelHandler.cpp,?,00000000,33A37B94), ref: 00F28D4C
SetLastError.KERNEL32(00F908E8,?,Running Appx parcel operation,?,00000000,AppxParcelHandler.cpp,?,00000000,33A37B94), ref: 00F28D99

Strings

Appx parcel final status: 0x%08x, xrefs: 00F29051
AppxParcelHandler.cpp, xrefs: 00F28C29, 00F28F75, 00F28F99, 00F29047, 00F29056
ForceAppShutdown, xrefs: 00F28FBC
yes, xrefs: 00F28FF6
?, xrefs: 00F29057
Running Appx parcel operation, xrefs: 00F28C4E
Appx parcel target: %s, xrefs: 00F28F94

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: ?$Appx parcel final status: 0x%08x$Appx parcel target: %s$AppxParcelHandler.cpp$ForceAppShutdown$Running Appx parcel operation$yes
API String ID: 1452528299-3765110158
Opcode ID: 1650d96b6f927656fc57fc0b7f1cdee8a4866c60f4dd3acf58f0b44920a22a71
Instruction ID: 5db362fbedeb93f4eaea85c9459ce405cc031af11ce8d365f2b5c9635d919a9b
Opcode Fuzzy Hash: 1650d96b6f927656fc57fc0b7f1cdee8a4866c60f4dd3acf58f0b44920a22a71
Instruction Fuzzy Hash: 6DE1CD70D05268EEDF14DBA4EC44BEEBBB4EF00304F144199E415B72C2DB74AA49EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F012E0 Relevance: 13.8, APIs: 9, Instructions: 327COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,00000001,?), ref: 00F014DA
__CxxThrowException@8.LIBVCRUNTIME ref: 00F014F6
SafeArrayGetUBound.OLEAUT32(00000000,00000001,?), ref: 00F01529
SafeArrayGetLBound.OLEAUT32(00000000,00000001,?), ref: 00F015AC
SafeArrayGetUBound.OLEAUT32(00000000,00000001,?), ref: 00F015D3
SafeArrayDestroy.OLEAUT32(00000000), ref: 00F016BE
__CxxThrowException@8.LIBVCRUNTIME ref: 00F016D0
SafeArrayDestroy.OLEAUT32(00000000,?,00FCE384,?,?,?,33A37B94,?,00000000,?), ref: 00F016F4
__CxxThrowException@8.LIBVCRUNTIME ref: 00F01706

Part of subcall function 00EB4CA0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F610C1,000000FF), ref: 00EB4CE2
Part of subcall function 00EB4CA0: SetLastError.KERNEL32(?,?,?,?,?,00F610C1,000000FF), ref: 00EB4D21

Part of subcall function 00F01C00: SafeArrayGetLBound.OLEAUT32(00000000,00000001,00000000), ref: 00F01C17

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ArraySafe$Bound$Exception@8Throw$DestroyErrorLast
String ID:
API String ID: 3163121579-0
Opcode ID: 853f3e8341c12daa9afd08cd86e9fac14fcd177681ef8b40bb21c21ea897a3ed
Instruction ID: 75efcfc45ebabaf41a9bf7ad5c71bbc60affa6f756744a62d34051eece74b25b
Opcode Fuzzy Hash: 853f3e8341c12daa9afd08cd86e9fac14fcd177681ef8b40bb21c21ea897a3ed
Instruction Fuzzy Hash: 36D1AF71D00258DAEF25DBA4CC95BEEBBB8BF10304F144199E406A71D2EB74AE48FB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F1C570 Relevance: 13.7, APIs: 9, Instructions: 223fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB6EC0: GetLastError.KERNEL32(33A37B94,?,00EB5D01,00EB5D01,00F90920,00F60FF9,000000FF,?,00EB6814,00F8B388,00000000,?,00000000), ref: 00EB6F02
Part of subcall function 00EB6EC0: SetLastError.KERNEL32(00F908E8,00F8B388,00000000,?,00EB5D01,00EB5D01,00F90920,00F60FF9,000000FF,?,00EB6814,00F8B388,00000000,?,00000000), ref: 00EB6F65

GetFileAttributesW.KERNEL32(?,00F8B388,?,?,00000000,00F8B388,?,?,00000000,33A37B94), ref: 00F1C6A1
WriteFile.KERNEL32(00F8CBA0,?,00000010,?,00000000,00F8B388,?,?,00000000,00F8B388,?,?,00000000,33A37B94), ref: 00F1C700
GetLastError.KERNEL32 ref: 00F1C70C
WriteFile.KERNEL32(00F8CBA0,00000000,00000004,00000000,00000000), ref: 00F1C727
GetLastError.KERNEL32 ref: 00F1C72D
WriteFile.KERNEL32(?,?,00000010,00000000,00000000,00F9091C,00F9091C,74DEE010,00F8B388,?,00F9091C,74DF35B0,00F8B388,?,?,00000000), ref: 00F1C829
GetLastError.KERNEL32 ref: 00F1C835
WriteFile.KERNEL32(?,00000003,0000001C,00000000,00000000), ref: 00F1C853
GetLastError.KERNEL32 ref: 00F1C859

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$File$Write$Attributes
String ID:
API String ID: 1843076501-0
Opcode ID: f7c7865106556c352bfbea07929d5bd8c4dc5555f0ed6f87b59a88aab6aa9fe2
Instruction ID: 431d52179f68fdf06e85a85c386f70507cce1bbc543df633e97fc50466634605
Opcode Fuzzy Hash: f7c7865106556c352bfbea07929d5bd8c4dc5555f0ed6f87b59a88aab6aa9fe2
Instruction Fuzzy Hash: 02A11AB1A0025DDFEB24DF54CC94BDEBBB8EB08314F10819AE519A7281D7B05E85DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F06810 Relevance: 13.7, APIs: 2, Strings: 7, Instructions: 171COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00F0685B
SetLastError.KERNEL32(00F908E8), ref: 00F068A8

Part of subcall function 00F06DE0: SetLastError.KERNEL32(00F908E8), ref: 00F06EA4
Part of subcall function 00F06DE0: SetLastError.KERNEL32(00F908E8), ref: 00F06F40

Strings

true, xrefs: 00F06975, 00F06980
ISSelectedLanguage, xrefs: 00F0690A
ISSetupLanguages, xrefs: 00F068BC
ISShowLanguageSelection, xrefs: 00F0695A
ISDefaultLanguage, xrefs: 00F06928
ISRTLLangs, xrefs: 00F0698F
false, xrefs: 00F06970

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: ISDefaultLanguage$ISRTLLangs$ISSelectedLanguage$ISSetupLanguages$ISShowLanguageSelection$false$true
API String ID: 1452528299-3800006133
Opcode ID: a11ec899b8c379432bb5886d2541f68fddf933dac5dffd80540aaea26874f3f6
Instruction ID: f9b21fc813e4efe7fa7720063ab3e4929344bf305d11c92e66d45ead3ae1fe28
Opcode Fuzzy Hash: a11ec899b8c379432bb5886d2541f68fddf933dac5dffd80540aaea26874f3f6
Instruction Fuzzy Hash: CF516D71A04208EADF04DFA4D956BEEBBF8FF04714F10452DE406E7681EB749A18EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F13330 Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32 ref: 00F133DD
SetLastError.KERNEL32(?), ref: 00F1341F
GetLastError.KERNEL32 ref: 00F1343B
SetLastError.KERNEL32(?), ref: 00F13477
GetLastError.KERNEL32 ref: 00F13496
SetLastError.KERNEL32(?), ref: 00F134D2
GetLastError.KERNEL32 ref: 00F13556
SetLastError.KERNEL32(?), ref: 00F13592

Strings

, xrefs: 00F13594

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-3916222277
Opcode ID: c1dfe4f46c277ce38495cb61efd82786a89dffa80b555eef19da3483392e3065
Instruction ID: ad105a4ce72eccc2216ea958fa996dd36dd4a44d4876508be686c137e303bedf
Opcode Fuzzy Hash: c1dfe4f46c277ce38495cb61efd82786a89dffa80b555eef19da3483392e3065
Instruction Fuzzy Hash: 5D81F8B0805784CFEB60CF69C54878ABFF0BF08308F14869DC4899B752D7B6A609DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00ED26C0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

Part of subcall function 00EB6CA0: GetLastError.KERNEL32(33A37B94,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94,?,00F7979A), ref: 00EB6CE3
Part of subcall function 00EB6CA0: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,00FD21E8,?,00F61B59,000000FF,?,00EB1414,installshield/2019/bootstrap,?,00000000,33A37B94), ref: 00EB6D60

Part of subcall function 00F38C90: RegQueryValueExW.ADVAPI32(00000000,DoVerboseLogging,00000000,00F8B388,00000000,?,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,00000001,?), ref: 00F38CED
Part of subcall function 00F38C90: RegCloseKey.ADVAPI32(00000000,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,00000001,?), ref: 00F38D0D

VariantClear.OLEAUT32(?), ref: 00ED2B4A

Strings

NotifyUIForUpgradingParcels: failed to create parcel collection, error %x, xrefs: 00ED27F1
SetupEngine.cpp, xrefs: 00ED271C, 00ED27E7, 00ED2946, 00ED2A53
!, xrefs: 00ED2B3F
Setup was canceled during upgrade check, xrefs: 00ED2A75
Engine: notifying UI for any parcels that require upgrade confirmation, xrefs: 00ED2741
Engine: upgrade notification has no parcels installing, skipping notify, xrefs: 00ED2968

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$ClearCloseQueryValueVariant
String ID: !$Engine: notifying UI for any parcels that require upgrade confirmation$Engine: upgrade notification has no parcels installing, skipping notify$NotifyUIForUpgradingParcels: failed to create parcel collection, error %x$Setup was canceled during upgrade check$SetupEngine.cpp
API String ID: 2814348128-2178872588
Opcode ID: 7431ebeeed786bdf9041e1842d4ea84c84d28ad4509ccaa061b3b020e4fd5d37
Instruction ID: 4380f67ed1c8dfac309db64e0e070aeebe968b550af0c5105fc645ae087492bf
Opcode Fuzzy Hash: 7431ebeeed786bdf9041e1842d4ea84c84d28ad4509ccaa061b3b020e4fd5d37
Instruction Fuzzy Hash: 0DE1A070905248DFEB25DFA4C884BDDBBB0EF15308F24419EE5056B382DBB46A46DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F26F90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 306fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000010,?,00000000,Parcel extension received no data for out-proc extension request,?,00000000,ProxyApi.cpp,?,00000000,33A37B94), ref: 00F270FF
GetLastError.KERNEL32(?,00000000,ProxyApi.cpp,?,00000000,33A37B94), ref: 00F2710B
WriteFile.KERNEL32(DE55ADFF,80004005,00000004,00000000,00000000,?,00000000,ProxyApi.cpp,?,00000000,33A37B94), ref: 00F27126
GetLastError.KERNEL32(?,00000000,ProxyApi.cpp,?,00000000,33A37B94), ref: 00F2712C

Part of subcall function 00EB33E0: SysStringLen.OLEAUT32(?), ref: 00EB33EE
Part of subcall function 00EB33E0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3408

Strings

Parcel extension received unsupported request (%x) for out-proc extension, xrefs: 00F27150
Parcel extension received no data for out-proc extension request, xrefs: 00F2701F
ProxyApi.cpp, xrefs: 00F26FF1, 00F27146

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFileLastStringWrite$Alloc
String ID: Parcel extension received no data for out-proc extension request$Parcel extension received unsupported request (%x) for out-proc extension$ProxyApi.cpp
API String ID: 581789320-2742531627
Opcode ID: ec36de14edd73b2ba9df811d9e6d6e7f19e7ce47f788c6b1e1b6c4d04d47b370
Instruction ID: 0b0383092426b651b6edbaf33028f095cc97a857185e4c40f6828acea2e9d2b6
Opcode Fuzzy Hash: ec36de14edd73b2ba9df811d9e6d6e7f19e7ce47f788c6b1e1b6c4d04d47b370
Instruction Fuzzy Hash: 5ED15FB1A0425ADFDB10EFA0DC84BAEB7B9FF04304F10419AE509AB241D7749E49EF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F11AC0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00F9EE68,00000000,00000002,33A37B94), ref: 00F11BE3
SetLastError.KERNEL32(00F908E8), ref: 00F11C2D

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

VariantInit.OLEAUT32(?), ref: 00F11DCA
VariantClear.OLEAUT32(?), ref: 00F11E0B
VariantClear.OLEAUT32(?), ref: 00F11E47

Strings

%d: , xrefs: 00F11C3B
, xrefs: 00F11B64, 00F11C98

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Variant$ClearFreeString$Init
String ID: $%d:
API String ID: 2399893328-2489501889
Opcode ID: 21a352330132e155a451b89b8df13654b3a67e6e495b27c7e305f995d047101c
Instruction ID: c1b439ec4c74b2a85dd111d6c5e9f91c682e8854aa7bf89b9306d35160f772a2
Opcode Fuzzy Hash: 21a352330132e155a451b89b8df13654b3a67e6e495b27c7e305f995d047101c
Instruction Fuzzy Hash: A4B14A71D0525CDEDF20DBA8CC84BDEBBB8BB05304F14419AE509B7282DB745A84DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF97B0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 00EDF680: new.LIBCMT ref: 00EDF6AD

Part of subcall function 00F4C948: __onexit.LIBCMT ref: 00F4C94E

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Part of subcall function 00EBAE70: VariantClear.OLEAUT32(?), ref: 00EBAE86
Part of subcall function 00EBAE70: SysAllocString.OLEAUT32(?), ref: 00EBAE99

VariantClear.OLEAUT32(?), ref: 00EF993D

Strings

Parcel ref condition of parcel ID %s appears to be causing an infinite loop, xrefs: 00EF9890
Failed to evaluate eligibility condition for ParcelRef (%s), error %x, xrefs: 00EF99D7
Unknown error attempting to get parcel '%s' from collection, error %x, xrefs: 00EF996A
Condition.cpp, xrefs: 00EF9889, 00EF98CD, 00EF9963, 00EF99D0, 00EF9A12
Failed to obtain parcel collection for ParcelRef, error %x, xrefs: 00EF98D4
Invalid/unknown parcel ID specified for ParcelRef: %s, xrefs: 00EF9A19

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: String$AllocClearVariant$__onexit
String ID: Condition.cpp$Failed to evaluate eligibility condition for ParcelRef (%s), error %x$Failed to obtain parcel collection for ParcelRef, error %x$Invalid/unknown parcel ID specified for ParcelRef: %s$Parcel ref condition of parcel ID %s appears to be causing an infinite loop$Unknown error attempting to get parcel '%s' from collection, error %x
API String ID: 1494525647-1580832900
Opcode ID: 04081f9ba5dab4ff7c12abfb8af351249fcb1519799cf193838a623f5c215e34
Instruction ID: 46d38c6247cb1cd665a6b6d494b26dec957fb7a813a93223d65cfc352d7e07c6
Opcode Fuzzy Hash: 04081f9ba5dab4ff7c12abfb8af351249fcb1519799cf193838a623f5c215e34
Instruction Fuzzy Hash: B081AFB1901209DFCB10EF98C844BEEBBF9BF59314F140259E505BB382E7799944CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF5280 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

Evaluate registry value condition: failed to convert data to requested format (%x), xrefs: 00EF551E
Evaluate registry value condition: unsupported reg value type (%x), xrefs: 00EF54F0
Condition.cpp, xrefs: 00EF5395, 00EF54E6, 00EF5514, 00EF5523
RegistryValue condition: failed to get data for value, error %08x, xrefs: 00EF539F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: Condition.cpp$Evaluate registry value condition: failed to convert data to requested format (%x)$Evaluate registry value condition: unsupported reg value type (%x)$RegistryValue condition: failed to get data for value, error %08x
API String ID: 0-2993858370
Opcode ID: fc38b6d3eeee1c31986c0e3b278cb3b6deebe1724bbe4cf2e3de1b40e746c7f9
Instruction ID: 31ecfd8f752225d6c6650481eefc55f95113ce8f66922f782bf108076dda7a15
Opcode Fuzzy Hash: fc38b6d3eeee1c31986c0e3b278cb3b6deebe1724bbe4cf2e3de1b40e746c7f9
Instruction Fuzzy Hash: B091427190025EEEDB25DB54CC45BEEBBB8BB15304F0045AAE609B3181EB745B88DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF7500 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EF7570

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EBCA50: GetLastError.KERNEL32(33A37B94), ref: 00EBCABE
Part of subcall function 00EBCA50: SetLastError.KERNEL32(?), ref: 00EBCAFD

GetLastError.KERNEL32(ExtType,?,00000000), ref: 00EF76E4
GetLastError.KERNEL32 ref: 00EF76EA

Strings

Extension handler: error 0x%08x trying to get validator, xrefs: 00EF7709
ExtType, xrefs: 00EF7590
Condition.cpp, xrefs: 00EF7671, 00EF76EE, 00EF770E
Extension handler: failed to create extension delegate, xrefs: 00EF7688

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: Condition.cpp$ExtType$Extension handler: error 0x%08x trying to get validator$Extension handler: failed to create extension delegate
API String ID: 1452528299-3301772165
Opcode ID: 476693cbedb7141dc0a204cab600827740ecbca5e0694c8c507be9acba5534ba
Instruction ID: 377a798add24f0457a62b9c0b5f227c23e9a84dd4046995bfc7ebf11431a6e2d
Opcode Fuzzy Hash: 476693cbedb7141dc0a204cab600827740ecbca5e0694c8c507be9acba5534ba
Instruction Fuzzy Hash: 43618DB0D05258DADB20EF64DD45BEEBBB4AB04314F2042AAE519B72C1DB745F44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F448FC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74libraryregistryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F44903

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F4536E: __EH_prolog3.LIBCMT ref: 00F45375

LoadLibraryExW.KERNEL32(33A37B94,00000000,00000008), ref: 00F44975
GetLastError.KERNEL32 ref: 00F44986
RegOverridePredefKey.ADVAPI32(80000000,00000000), ref: 00F449D9

Part of subcall function 00F44EF0: GetVersionExW.KERNEL32(?), ref: 00F44F14

Part of subcall function 00F40823: RegOverridePredefKey.ADVAPI32(80000000,?), ref: 00F4085B

GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 00F449A1

Strings

DllUnregisterServer, xrefs: 00F44992
DllRegisterServer, xrefs: 00F44997, 00F4499F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3OverridePredef$AddressLibraryLoadProcVersion
String ID: DllRegisterServer$DllUnregisterServer
API String ID: 2457836926-2931954178
Opcode ID: 8f46cf8ee7617ad5b662d30f7b8db4263d91d96930863e65394484414e0c0d35
Instruction ID: 322720c12a3ebb168035956840271624683eac319e449ee455697655d91d68cc
Opcode Fuzzy Hash: 8f46cf8ee7617ad5b662d30f7b8db4263d91d96930863e65394484414e0c0d35
Instruction Fuzzy Hash: 1421D170905288AEEF00EFB4C8563EE3FA4AF11304F144058ED45B7283D734AA08FB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F425C6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,FindNextFileW,00000000,00000000), ref: 00F425EB
GetProcAddress.KERNEL32(00000000), ref: 00F425F2
GetModuleHandleW.KERNEL32(kernel32.dll,FindNextFileA), ref: 00F42628
GetProcAddress.KERNEL32(00000000), ref: 00F4262F

Strings

kernel32.dll, xrefs: 00F425E6, 00F42623
FindNextFileA, xrefs: 00F4261E
FindNextFileW, xrefs: 00F425E1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: FindNextFileA$FindNextFileW$kernel32.dll
API String ID: 1646373207-719559652
Opcode ID: 2bd676b455be6f2290a6472d39d92f5507b6be3036389a42f8b6766cc6b84253
Instruction ID: 9dd33c85d107d487ee30f4d54cc452dfdef510438519bdfd406a33d02a14ffd8
Opcode Fuzzy Hash: 2bd676b455be6f2290a6472d39d92f5507b6be3036389a42f8b6766cc6b84253
Instruction Fuzzy Hash: 8911E532A01618ABDB54AFA4DC0DFFEBBA89F84B11B410165BC05E3141DB74EE44EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F43185 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52libraryloadertimeCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetProcessId,00000000,00F43D8D,?,00F42EB5,00000000,?,?,?,?,?,00000068,00F454C9,00F43D8D,?), ref: 00F431A6
GetProcAddress.KERNEL32(00000000), ref: 00F431AD
OpenProcess.KERNEL32(001F0FFF,00000001,?,?,00000000,00F43D8D,?,00F42EB5,00000000,?,?,?,?,?,00000068,00F454C9), ref: 00F431CD
GetProcessTimes.KERNEL32(00F43D8D,00F454C9,00000068,?,?,?,00000000,00F43D8D,?,00F42EB5,00000000,?,?,?,?,?), ref: 00F431E6
CloseHandle.KERNEL32(00F43D8D,?,00F42EB5,00000000,?,?,?,?,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F431F3

Strings

kernel32.dll, xrefs: 00F431A1
GetProcessId, xrefs: 00F4319C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: HandleProcess$AddressCloseModuleOpenProcTimes
String ID: GetProcessId$kernel32.dll
API String ID: 4254294609-399901964
Opcode ID: f55335edac323755845d316daee491a69589e9568b780342877e40472da511a7
Instruction ID: 4de64ce733552b3ca12721741af8dc499d4e383ca9aae021e586b13f0e0d9a0b
Opcode Fuzzy Hash: f55335edac323755845d316daee491a69589e9568b780342877e40472da511a7
Instruction Fuzzy Hash: 22018F37E4161A7B4F221FA49C089AB3F59AFC6BB17090014FD10E7211DA21DD0167A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF26A0 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F43A91: __EH_prolog3_GS.LIBCMT ref: 00F43A9B
Part of subcall function 00F43A91: CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000044,00FD689C,?,00000000,00F44B64,?,00000000), ref: 00F43BAC
Part of subcall function 00F43A91: GetLastError.KERNEL32 ref: 00F43BC7

CloseHandle.KERNEL32 ref: 00EF291F
CloseHandle.KERNEL32 ref: 00EF2927

Strings

EXE for action '%s' returned value 0x%08x, xrefs: 00EF2940
wait, xrefs: 00EF2738, 00EF2747
EXE (non-elevated) launch failed with status 0x%08x, xrefs: 00EF28E6
no wait, xrefs: 00EF272C
Actions.cpp, xrefs: 00EF2731, 00EF2750, 00EF28DF, 00EF28EB, 00EF2939, 00EF2945
Launching EXE action (%s) '%s', file '%s', arguments '%s', xrefs: 00EF274B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$CloseHandle$CreateH_prolog3_Process
String ID: Actions.cpp$EXE (non-elevated) launch failed with status 0x%08x$EXE for action '%s' returned value 0x%08x$Launching EXE action (%s) '%s', file '%s', arguments '%s'$no wait$wait
API String ID: 49200223-560129040
Opcode ID: 9f54dc21bc8c7af2c8a809426ce19fbeae7885ddb3d1a0c5503d5887f4529b48
Instruction ID: 2e117ea161316d96bee71901db5660a5764e24901c53ae6871ca8a9bd9e70ae0
Opcode Fuzzy Hash: 9f54dc21bc8c7af2c8a809426ce19fbeae7885ddb3d1a0c5503d5887f4529b48
Instruction Fuzzy Hash: E4917F71900248DEDF10DFA4DC45BEE7BB8EF45304F24416DE944AB282DB746A49DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F5AF80 Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F549C0,00F549C0,?,?,?,00F5B1D1,00000001,00000001,62E85006), ref: 00F5AFDA
__alloca_probe_16.LIBCMT ref: 00F5B012
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F5B1D1,00000001,00000001,62E85006,?,?,?), ref: 00F5B060
__alloca_probe_16.LIBCMT ref: 00F5B0F7
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F5B15A
__freea.LIBCMT ref: 00F5B167

Part of subcall function 00F56B68: RtlAllocateHeap.NTDLL(00000000,00F3FBA7,?,?,00F4DFF8,?,?,?,?,?,00F3FACB,00F3FBA7,?,?,?,?), ref: 00F56B9A

__freea.LIBCMT ref: 00F5B170
__freea.LIBCMT ref: 00F5B195

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: 0c1064152316ad7ec7f57f5298a13036f13da997c483d69782086373009512d9
Instruction ID: b43304583e844905232ed0e33110093f306141a94b891be6a1dd4a8e691bfaf4
Opcode Fuzzy Hash: 0c1064152316ad7ec7f57f5298a13036f13da997c483d69782086373009512d9
Instruction Fuzzy Hash: AC511472A00A16AFDB258F60CC91FBB77A9EB407A1F144629FE04D7190EB38DC48E650

Uniqueness

Uniqueness Score: -1.00%

Function 00F462C2 Relevance: 12.2, APIs: 8, Instructions: 163COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,33A37B94,?,00000000,?,00EC0B4E,00000000,000000FF), ref: 00F46316
GetTickCount.KERNEL32 ref: 00F4631E
ResetEvent.KERNEL32(?), ref: 00F4632E
QueryPerformanceCounter.KERNEL32(00000000), ref: 00F46381
GetTickCount.KERNEL32 ref: 00F4638F
__alldvrm.LIBCMT ref: 00F463FD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F46417
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F4643C

Part of subcall function 00F465FF: GetTickCount.KERNEL32 ref: 00F4660E
Part of subcall function 00F465FF: GetTickCount.KERNEL32 ref: 00F46637

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CountTick$CounterPerformanceQueryUnothrow_t@std@@@__ehfuncinfo$??2@$EventReset__alldvrm
String ID:
API String ID: 3317835756-0
Opcode ID: 46be88025937186f68e5f3b09182e056b0360a62662b2daff8ed4bdf86acc6c8
Instruction ID: 8e2f0f2605d3b2e6147a1a92f59d48afd2f0260367d884538ade9db95de4e987
Opcode Fuzzy Hash: 46be88025937186f68e5f3b09182e056b0360a62662b2daff8ed4bdf86acc6c8
Instruction Fuzzy Hash: 17518E71E0074AAFDB14CFA4C884BAABBF4FF49325F008129E814D7650D738AD50EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFDA90 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

VariantInit.OLEAUT32(00000028), ref: 00EFDB30
VariantInit.OLEAUT32(00000038), ref: 00EFDB47
GetLastError.KERNEL32 ref: 00EFDB6C
SetLastError.KERNEL32(?), ref: 00EFDBAE
GetLastError.KERNEL32 ref: 00EFDBCA
SetLastError.KERNEL32(?), ref: 00EFDC06
GetLastError.KERNEL32 ref: 00EFDC25
SetLastError.KERNEL32(?), ref: 00EFDC61

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$InitVariant
String ID:
API String ID: 201494241-0
Opcode ID: f1dc7927edb06154143f2b5c6fefb173837ba1cd39f300936d32e2c706482ce8
Instruction ID: c36ef5bd209b7323e17fb69173348ce93142034b2158ec6693ced139702d1b0c
Opcode Fuzzy Hash: f1dc7927edb06154143f2b5c6fefb173837ba1cd39f300936d32e2c706482ce8
Instruction Fuzzy Hash: 706102B0804748DFDB20CFA9C54874ABFF0BF08314F14869ED4899B752D7B5AA08DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F054B0 Relevance: 10.8, APIs: 5, Strings: 2, Instructions: 338COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00F0553E
SetLastError.KERNEL32(?), ref: 00F0559F

Part of subcall function 00F4C948: __onexit.LIBCMT ref: 00F4C94E

GetLastError.KERNEL32 ref: 00F05610
SetLastError.KERNEL32(?), ref: 00F05677
SetLastError.KERNEL32(8004070E,00000000,00000002,00000002,00F966B4,?,00000001,?,00F9091C,IDS_STAGEDOWNLOAD_FAILRETRY,?), ref: 00F059B7

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Part of subcall function 00EB4CA0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F610C1,000000FF), ref: 00EB4CE2
Part of subcall function 00EB4CA0: SetLastError.KERNEL32(?,?,?,?,?,00F610C1,000000FF), ref: 00EB4D21

Strings

#, xrefs: 00F059EA
IDS_STAGEDOWNLOAD_FAILRETRY, xrefs: 00F05906

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString$__onexit
String ID: #$IDS_STAGEDOWNLOAD_FAILRETRY
API String ID: 696547012-4145211882
Opcode ID: 808454dc767873db0684e34ea3faf48bce4ba6ff4269ae48b122bc80bb97f107
Instruction ID: ad248227fbd66c07d3fe63b5eda3accf901c63ec4d9b5b30e3b80363d57f5a6c
Opcode Fuzzy Hash: 808454dc767873db0684e34ea3faf48bce4ba6ff4269ae48b122bc80bb97f107
Instruction Fuzzy Hash: EDE1B070A0A708DFDB00EF78ED55B9A7BA2EB04700F54416AE4059B2E2F7719A04FF52

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA9D0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 318COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00F9A694), ref: 00EFAB88

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Strings

Locale: ignoring presumed %s locale name '%s'; cannot verify on this system, xrefs: 00EFAD2E
, xrefs: 00EFAAA3, 00EFABAA
Condition.cpp, xrefs: 00EFAD24, 00EFADF4
abcdefghijklmnopqrstuvwxyz-*, xrefs: 00EFACD7
Locale: invalid %s language value '%s', xrefs: 00EFADFE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: FreeString$ErrorLast
String ID: $Condition.cpp$Locale: ignoring presumed %s locale name '%s'; cannot verify on this system$Locale: invalid %s language value '%s'$abcdefghijklmnopqrstuvwxyz-*
API String ID: 2541235897-449814090
Opcode ID: 51a86b48714d26ff3d6d1333d6047b52f4af64b4dfb13b9267bef02e3e6af864
Instruction ID: 10fa10cbed7fb2e483b4b1181eea9358d80f3af726c0ba79d799e6d8984fc1cb
Opcode Fuzzy Hash: 51a86b48714d26ff3d6d1333d6047b52f4af64b4dfb13b9267bef02e3e6af864
Instruction Fuzzy Hash: ABD1AEB0A0421CEFDF24DBA4CC95BEEB7B8AF15304F5440A9E519B7281DB705A88DF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F16A51 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 235COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F16AD8

Strings

Not, xrefs: 00F16AA9, 00F16B5F
Any, xrefs: 00F16A6E, 00F16B26
All, xrefs: 00F16A8B, 00F16B3F
ExtType, xrefs: 00F16D4A
D, xrefs: 00F16D84

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: All$Any$D$ExtType$Not
API String ID: 0-4154192528
Opcode ID: 5004a5b32e3c85337faa4dce2e0b8e23f32a9deeb8aea3cf6ab68c67544a928d
Instruction ID: b8aaf6be644d3605742bbbc64e24c3d701aff3c4bbf13a41fc1bee81ad9e0315
Opcode Fuzzy Hash: 5004a5b32e3c85337faa4dce2e0b8e23f32a9deeb8aea3cf6ab68c67544a928d
Instruction Fuzzy Hash: 23A1BC71904228DBDF24DB64CD55BEEB7B8AF84350F644299D00AA72C1EF74AF84EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A1D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00F0BE70: VariantInit.OLEAUT32(?), ref: 00F0BEF6
Part of subcall function 00F0BE70: VariantClear.OLEAUT32(00000009), ref: 00F0BF2B

__CxxThrowException@8.LIBVCRUNTIME ref: 00F0A38C

Strings

Parcel operation return status: %x, xrefs: 00F0A3B6
Parcel status appears to indicate a reboot is necessary, xrefs: 00F0A47C
Running parcel operation for parcel %s, xrefs: 00F0A219
Setup running after reboot, parcel operation already ran, xrefs: 00F0A296
Parcel.cpp, xrefs: 00F0A212, 00F0A271, 00F0A3A4, 00F0A3BB, 00F0A465

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$ClearException@8InitThrow
String ID: Parcel operation return status: %x$Parcel status appears to indicate a reboot is necessary$Parcel.cpp$Running parcel operation for parcel %s$Setup running after reboot, parcel operation already ran
API String ID: 538707214-425875968
Opcode ID: 9d344fdaf52ea445a160af04908de1e65df5aff91ecfb2a904d0a6e191376b04
Instruction ID: a5ca4c671e360ac97a5d2fc0e40c0e2a2e048a6f9993b6193122dd45af6240e9
Opcode Fuzzy Hash: 9d344fdaf52ea445a160af04908de1e65df5aff91ecfb2a904d0a6e191376b04
Instruction Fuzzy Hash: 67A19E70A04348DEEB24EF64DC45BEEBBB1BB04304F14425EE145AB2D2DBB55949EB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F0C350 Relevance: 10.7, APIs: 7, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F0C3EC
VariantClear.OLEAUT32(00000008), ref: 00F0C424
SysAllocString.OLEAUT32(?), ref: 00F0C43A
VariantClear.OLEAUT32(00000003), ref: 00F0C464
VariantClear.OLEAUT32(00000003), ref: 00F0C493
VariantClear.OLEAUT32(?), ref: 00F0C4BF
VariantClear.OLEAUT32(?), ref: 00F0C565

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$AllocInitString
String ID:
API String ID: 347172062-0
Opcode ID: 063f4d142901602741486b772443cf7ac85fc31eee6d26aac92d14a977dbb592
Instruction ID: c55f79a1c953209845c70a06b01a7d50486e703f50c086dbab38e45690755d7e
Opcode Fuzzy Hash: 063f4d142901602741486b772443cf7ac85fc31eee6d26aac92d14a977dbb592
Instruction Fuzzy Hash: 08712B74E013099BDB20CFA5C944BEDBBB4EF08300F14816AE509EB281E775AE45EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F39100 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB48D0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60F81,000000FF,?,00EB2726), ref: 00EB4907
Part of subcall function 00EB48D0: SetLastError.KERNEL32(?,?,?,?,?,00F60F81,000000FF), ref: 00EB4946

Part of subcall function 00EB33E0: SysStringLen.OLEAUT32(?), ref: 00EB33EE
Part of subcall function 00EB33E0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3408

GetDateFormatW.KERNEL32(00000800,00000000,00000000,M-d-yyyy,00000000,00000080,00000001,00000080,00000001,?), ref: 00F3917C

Part of subcall function 00EB3C90: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,?,00000000,00F60DB0,000000FF,?,00EB2773,?,?,00000000,00000410), ref: 00EB3CBD
Part of subcall function 00EB3C90: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,00000000,00F60DB0,000000FF,?,00EB2773,?,?,00000000,00000410), ref: 00EB3D4E

GetTimeFormatW.KERNEL32(00000800,00000000,00000000,hh':'mm':'ss tt,00000000,00000080,?,00000080), ref: 00F391D8

Strings

%s[%s]: %s -- File: %s, Line: %d, xrefs: 00F392FA
M-d-yyyy, xrefs: 00F3916E
hh':'mm':'ss tt, xrefs: 00F391CA
%s[%s]: %s, xrefs: 00F39323

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FormatString$AllocDateTime
String ID: %s[%s]: %s$%s[%s]: %s -- File: %s, Line: %d$M-d-yyyy$hh':'mm':'ss tt
API String ID: 3619946683-1641453432
Opcode ID: bd77b371469bdd2794fd27150eeb630d0cd1f5ce7d55ad2584dd8f977f45b947
Instruction ID: c9620c482794b3e0ef0bf508ade963904c0e9731c7b0f78c83935eda9f159fe7
Opcode Fuzzy Hash: bd77b371469bdd2794fd27150eeb630d0cd1f5ce7d55ad2584dd8f977f45b947
Instruction Fuzzy Hash: 94718D70905298EEDB15EBA4DD56BEEBBB8AF25300F10419DE405731C2DBB42B48DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF910 Relevance: 10.7, APIs: 7, Instructions: 169fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(-00000004,40000000,00000000,00000000,00000002,00000080,00000000,33A37B94,00000000,?,00000000), ref: 00EEF992
GetLastError.KERNEL32 ref: 00EEF9A0
ReadFile.KERNEL32(?,00000000,00000400,?,00000000), ref: 00EEF9D8
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00EEFA8A
ReadFile.KERNEL32(?,?,00000400,?,00000000), ref: 00EEFACE
FlushFileBuffers.KERNEL32(?), ref: 00EEFAE9
CloseHandle.KERNEL32(?), ref: 00EEFAF0

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$Read$BuffersCloseCreateErrorFlushHandleLastWrite
String ID:
API String ID: 1893000674-0
Opcode ID: 244320cd97350e8fc730f48d2f98b5c68503f7493fcc3c604848dc9f90d9e835
Instruction ID: 8b9381c578de96e2f28351be6ff9b418a4164189c48c103eab6d9a83047f2f69
Opcode Fuzzy Hash: 244320cd97350e8fc730f48d2f98b5c68503f7493fcc3c604848dc9f90d9e835
Instruction Fuzzy Hash: 0D615C71E00248AFDB24DFE5DC85BAEBBB5FF48704F104129E90AAB291DB71A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F12270 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32 ref: 00F1234B
SetLastError.KERNEL32(?), ref: 00F1238D
GetLastError.KERNEL32 ref: 00F123F5
SetLastError.KERNEL32(?), ref: 00F12431
GetLastError.KERNEL32 ref: 00F12459
SetLastError.KERNEL32(?), ref: 00F12495

Part of subcall function 00EDF770: new.LIBCMT ref: 00EDF79D

Part of subcall function 00EB48D0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60F81,000000FF,?,00EB2726), ref: 00EB4907
Part of subcall function 00EB48D0: SetLastError.KERNEL32(?,?,?,?,?,00F60F81,000000FF), ref: 00EB4946

Strings

$, xrefs: 00F12530

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: $
API String ID: 1452528299-3993045852
Opcode ID: 580a292d2647ab50da2c6d1bd2dfab9c05b62f088215465e8ff2a23faf370f7f
Instruction ID: d00fc2e08e1d23ada10af332d62a2c1b78e982439d338bd1e0167e61db81c4ad
Opcode Fuzzy Hash: 580a292d2647ab50da2c6d1bd2dfab9c05b62f088215465e8ff2a23faf370f7f
Instruction Fuzzy Hash: B7910AB0805784DFEB50CF69C58878ABFF0BF18308F1485ADC4899B792D3B59648DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE56B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 00EC1460: GetLastError.KERNEL32(33A37B94,74DEDFA0,?,?,?,00F645F9,000000FF,?,00EBF578,?,00000000), ref: 00EC1497
Part of subcall function 00EC1460: SetLastError.KERNEL32(?), ref: 00EC14D6

GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00EE58CA

Part of subcall function 00EC1570: GetLastError.KERNEL32(33A37B94,?,?,?,00F64628,000000FF), ref: 00EC15B0
Part of subcall function 00EC1570: new.LIBCMT ref: 00EC15C6

__CxxThrowException@8.LIBVCRUNTIME ref: 00EE5764

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

GetWindowsDirectoryW.KERNEL32(00000000,00000104,?,00000104,?,?), ref: 00EE5735

Part of subcall function 00EB9D60: GetLastError.KERNEL32(33A37B94,74DEDFA0,74DEE010), ref: 00EB9D8D
Part of subcall function 00EB9D60: SetLastError.KERNEL32(00000000), ref: 00EB9E1E

GetWindowsDirectoryW.KERNEL32(00000000,00000104,?,00000104,?,?), ref: 00EE5857

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Strings

sysnative, xrefs: 00EE5776
syswow64, xrefs: 00EE5886

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Directory$StringWindows$AllocExceptionException@8RaiseSystemThrow
String ID: sysnative$syswow64
API String ID: 904407786-1057783856
Opcode ID: 72aa1a99cb5206a79dfbfbf9dcf3748b82acd07198c6e6185f06ebeee0823abb
Instruction ID: f2c3bc16ca352fb0477b30cfc0ab435e29e32fe49f6d4a6a1e1c3aa9d8a197aa
Opcode Fuzzy Hash: 72aa1a99cb5206a79dfbfbf9dcf3748b82acd07198c6e6185f06ebeee0823abb
Instruction Fuzzy Hash: DF51AE71A0024CDEEB10EBA4CD46BDEBBF4BF15308F144099E541B7293DBB06A48DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D88D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00F5E002,?,00000000,?,00000000,00000000), ref: 00F5D8CF
__fassign.LIBCMT ref: 00F5D94A
__fassign.LIBCMT ref: 00F5D965
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00F5D98B
WriteFile.KERNEL32(?,?,00000000,00F5E002,00000000,?,?,?,?,?,?,?,?,?,00F5E002,?), ref: 00F5D9AA
WriteFile.KERNEL32(?,?,00000001,00F5E002,00000000,?,?,?,?,?,?,?,?,?,00F5E002,?), ref: 00F5D9E3

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: e48ab05d44aec3c7f433528daeffa533366d3cf81391b8abc6fb7a3c93acca02
Instruction ID: 4fd9e0d5398feeb73825992ae70cbb5f7a8217eb5f576666b1c305e76f492f08
Opcode Fuzzy Hash: e48ab05d44aec3c7f433528daeffa533366d3cf81391b8abc6fb7a3c93acca02
Instruction Fuzzy Hash: FA51B5B1D052499FCF20CFA8D845AEEBBF9FF09311F14411AEA55E7292E7309944DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F233E0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 133libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi.dll,MsiSetExternalUIRecord,?,00000000,00000000,?,?,?,?,00000000), ref: 00F23425
GetProcAddress.KERNEL32(00000000), ref: 00F2342C

Strings

MsiSetExternalUIRecord, xrefs: 00F2341B
+, xrefs: 00F2344A
msi.dll, xrefs: 00F23420
Could not obtain function proc address for MsiSetExternalUIRecord from msi.dll, xrefs: 00F23444

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: +$Could not obtain function proc address for MsiSetExternalUIRecord from msi.dll$MsiSetExternalUIRecord$msi.dll
API String ID: 1646373207-1877515688
Opcode ID: c17c4b60e82cc0114090bf1153194aa3450c7fb7b4f76118c4e8091354b4852c
Instruction ID: 0efc612cd89938a39f304069afec667fbf210504db9fd7427debc354350a7aaf
Opcode Fuzzy Hash: c17c4b60e82cc0114090bf1153194aa3450c7fb7b4f76118c4e8091354b4852c
Instruction Fuzzy Hash: CF41CEB1200218EFEB24DF18EC4EF6A37A5EF41319F140469F905DB291C778EA54EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EB34C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EB3568
std::_Xinvalid_argument.LIBCPMT ref: 00EB3572

Part of subcall function 00EB4370: SysAllocStringLen.OLEAUT32(00000000,?), ref: 00EB43E8
Part of subcall function 00EB4370: SysFreeString.OLEAUT32(00000000), ref: 00EB4460

Strings

>', xrefs: 00EB34FF
>', xrefs: 00EB35A4
string too long, xrefs: 00EB3563, 00EB356D
>', xrefs: 00EB359B, 00EB35FA

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: StringXinvalid_argumentstd::_$AllocFree
String ID: >'$>'$>'$string too long
API String ID: 2819953329-2006352014
Opcode ID: 4756e713a4a536e7885435a850220f7de506fcf877eea8e53665778a1d9247bc
Instruction ID: 3588a598d3e7c94fee2514d520774e5b5cb04724ac493056d33dccd61855f070
Opcode Fuzzy Hash: 4756e713a4a536e7885435a850220f7de506fcf877eea8e53665778a1d9247bc
Instruction Fuzzy Hash: DE41F0722043149BDB249F68E841AABF3E8FF94714F20452FE456D7650DB72EA048B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F44466 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F44470
GetModuleHandleW.KERNEL32(Ntdll.dll,NtQueryInformationProcess,?,00000400,?,000004A0,00F44454,00000000,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F444A0
GetProcAddress.KERNEL32(00000000), ref: 00F444A7
OpenProcess.KERNEL32(00000400,00000000,?,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F444D3

Part of subcall function 00F40200: __EH_prolog3_catch.LIBCMT ref: 00F40207

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Strings

Ntdll.dll, xrefs: 00F4449B
NtQueryInformationProcess, xrefs: 00F44496

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFreeLastString$AddressH_prolog3_H_prolog3_catchHandleModuleOpenProcProcess
String ID: NtQueryInformationProcess$Ntdll.dll
API String ID: 1707509531-801751246
Opcode ID: afdac83519fe65644f0113b2ad450de970d5d67167dccc3ddfc046d226d4cb57
Instruction ID: 5c970238709a9de77502371ebb576d895023294e578ecb0b5e2183940d78150d
Opcode Fuzzy Hash: afdac83519fe65644f0113b2ad450de970d5d67167dccc3ddfc046d226d4cb57
Instruction Fuzzy Hash: CC314FB19402299BDF20EB60CC85BDDBB78AF44704F4444D5AB08B7182DB74AF89EF59

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEA00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,?,000001F0,00000000,?,00F21826,80000002,?,00000000,00000000,0002001F,00000000,00000000,000001F0), ref: 00EEEA24
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00EEEA3B
RegCreateKeyExW.ADVAPI32(000001F0,00000000,00000000,00000000,0002001F,00000000,00000000,00000000,00000000,00000000,?,000001F0,00000000,?,00F21826,80000002), ref: 00EEEA8E
RegCloseKey.ADVAPI32(00000000,?,00F21826,80000002,?,00000000,00000000,0002001F,00000000,00000000,000001F0), ref: 00EEEAAD

Strings

Advapi32.dll, xrefs: 00EEEA1F
RegCreateKeyTransactedW, xrefs: 00EEEA35

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-2994018265
Opcode ID: 917cf53c56c8b23949012372430938447ec6c8e0246eb0738f8f112ac36a41b9
Instruction ID: 717dc805f9aa4a6bf89e1584585d978d2ed59e1e35e8cc4d4d2a1591d48879ba
Opcode Fuzzy Hash: 917cf53c56c8b23949012372430938447ec6c8e0246eb0738f8f112ac36a41b9
Instruction Fuzzy Hash: F921277220024EEBEF11CF4ADC45FAA7BA9FF48744F14842DF909A6250E772D960EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F47F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 00F3F4AE
ReleaseSRWLockExclusive, xrefs: 00F3F4BE
KERNEL32.DLL, xrefs: 00F3F499

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: e18127a9e7dcd9cc639910ca0805ed7e429046b62fdfb0c3a9a95843ce7ee1b6
Instruction ID: 116256356a93fb7c76f9ffaaffc420a3c300a187c8910baaac7562393787976f
Opcode Fuzzy Hash: e18127a9e7dcd9cc639910ca0805ed7e429046b62fdfb0c3a9a95843ce7ee1b6
Instruction Fuzzy Hash: 7301A472F523629B4F20AF78DC955E737D99F42B36B28003BE801D7205D612C849F7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F451F4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F451FB
GetModuleHandleW.KERNEL32(kernel32.dll,RemoveDirectoryW,00000004,00F41D52), ref: 00F45210
GetProcAddress.KERNEL32(00000000), ref: 00F45217

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

GetLastError.KERNEL32 ref: 00F45256

Part of subcall function 00F45315: __EH_prolog3_GS.LIBCMT ref: 00F4531C

Strings

kernel32.dll, xrefs: 00F4520B
RemoveDirectoryW, xrefs: 00F45206

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$AddressH_prolog3H_prolog3_HandleModuleProc
String ID: RemoveDirectoryW$kernel32.dll
API String ID: 516058616-3934976865
Opcode ID: 38b24629f063281b455081114ba6c72d918740e3b0304f738988c1eaa2c52793
Instruction ID: 1034253fe2bdddc2ae6a0ef7cd491e20dd04a2b3db0ee6cba955ae13a9e7d7a6
Opcode Fuzzy Hash: 38b24629f063281b455081114ba6c72d918740e3b0304f738988c1eaa2c52793
Instruction Fuzzy Hash: 5701D1B1A006089BDF55BFA8DC0A6AE3BA4AF18B11F404119FC04D6283DB74DA00EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F416C4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F416CB
GetModuleHandleW.KERNEL32(kernel32.dll,DeleteFileW,00000004,00F417B6,?,00000000,00000000), ref: 00F416E0
GetProcAddress.KERNEL32(00000000), ref: 00F416E7

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

GetLastError.KERNEL32 ref: 00F41726

Part of subcall function 00F45315: __EH_prolog3_GS.LIBCMT ref: 00F4531C

Strings

DeleteFileW, xrefs: 00F416D6
kernel32.dll, xrefs: 00F416DB

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$AddressH_prolog3H_prolog3_HandleModuleProc
String ID: DeleteFileW$kernel32.dll
API String ID: 516058616-2218860424
Opcode ID: 0186783956663630043d64f88fe28d97ef0d601766c5a9de18a7989d5fb60ae3
Instruction ID: 4037df2ddd46b2b1e89adddd4f9066eabc5674cc915997c3d7e59c1822b07282
Opcode Fuzzy Hash: 0186783956663630043d64f88fe28d97ef0d601766c5a9de18a7989d5fb60ae3
Instruction Fuzzy Hash: FA01D1B1A012089BDF54BFA8DC0A6AE3BA4AF08711B004128FC04D6283DB34CA40EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EB1000 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32), ref: 00EB1006
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00EB1014
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00EB102B

Strings

KERNEL32, xrefs: 00EB1001
SetDllDirectoryW, xrefs: 00EB100E
SetSearchPathMode, xrefs: 00EB1025

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: KERNEL32$SetDllDirectoryW$SetSearchPathMode
API String ID: 667068680-4129897381
Opcode ID: 9650aafedc27b24a86d3c04778fe3f7937208ee9ff8b351df0eece8158e48bec
Instruction ID: 3bf32024e61ba8d5b53884f8a86966cabcd35c33581252953eddca9a3d821cf4
Opcode Fuzzy Hash: 9650aafedc27b24a86d3c04778fe3f7937208ee9ff8b351df0eece8158e48bec
Instruction Fuzzy Hash: 4BD09E30341B15AAA72037B16C0EDFE3954AF45FA6B440050B801E1092DF52C945B7B7

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4B60 Relevance: 10.1, APIs: 8, Instructions: 135COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4BA6
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4BEB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4C0A
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4C46
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4C62
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4C9E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4CBD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC4CF9

Part of subcall function 00EDF680: new.LIBCMT ref: 00EDF6AD

Part of subcall function 00F477D1: __EH_prolog3.LIBCMT ref: 00F477D8

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3
String ID:
API String ID: 3502553090-0
Opcode ID: 3d6b4c25c8a3d75f5ff4b387520cf0b7f17d6150811bf0d28dd6724bba504dfe
Instruction ID: 80173a571b9817c09a9f9c1577d2af254565ebd12eb19829a908f5c5321b95fe
Opcode Fuzzy Hash: 3d6b4c25c8a3d75f5ff4b387520cf0b7f17d6150811bf0d28dd6724bba504dfe
Instruction Fuzzy Hash: 1A6127B0805784CFDB60CF69C54878ABBF0BF08304F148A5DD489A7752D775AA04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F1E9C0 Relevance: 9.3, APIs: 6, Instructions: 258registryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00F1EA17
SetLastError.KERNEL32(00F908E8), ref: 00F1EA66
GetLastError.KERNEL32 ref: 00F1EA7D
SetLastError.KERNEL32(00F908E8), ref: 00F1EAC3
RegCloseKey.ADVAPI32(00000000,?,?,00F908E8,?,00000000,000000FF,00F8B388,?,?,00000000,?,00000000,000000FF,00F8B388,?), ref: 00F1ED4C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Close
String ID:
API String ID: 2117561858-0
Opcode ID: ed30205daba14ef8f41d66b5dc3dcc3b39e826ef531172e506ed0ae4961ecc44
Instruction ID: 49667e2b938b87e376619d0d38ccb9d04313b2f6f6427f0b3d730c6a4e68d9a4
Opcode Fuzzy Hash: ed30205daba14ef8f41d66b5dc3dcc3b39e826ef531172e506ed0ae4961ecc44
Instruction Fuzzy Hash: 08C12671D00258DEDF20DFA8DC94BDEBBB4AF14304F148199E509BB282D7749A88DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB660 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EFB6A9

Strings

AppxInstalled: condition not supported on this platform, will return false, xrefs: 00EFB6F2
AppxInstalled: failed to obtain appx helper proxy handler, xrefs: 00EFB780
AppxInstalled: result 0x%08x, xrefs: 00EFB8F7
Condition.cpp, xrefs: 00EFB6CD, 00EFB75B, 00EFB8B9, 00EFB8F0
AppxInstalled: failed to evaluate condition, error 0x%08x, xrefs: 00EFB8C0

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: AppxInstalled: condition not supported on this platform, will return false$AppxInstalled: failed to evaluate condition, error 0x%08x$AppxInstalled: failed to obtain appx helper proxy handler$AppxInstalled: result 0x%08x$Condition.cpp
API String ID: 1452528299-4237545306
Opcode ID: fda1e4c2282c35dd2443cd1b8287e1087cd3c5411b55db6ab30e160bfac5fa6b
Instruction ID: ca11b990f6c505090a75f1b61a56bf40eb7f28d7044009c01037bb2109f7572b
Opcode Fuzzy Hash: fda1e4c2282c35dd2443cd1b8287e1087cd3c5411b55db6ab30e160bfac5fa6b
Instruction Fuzzy Hash: 63818EB0D00258EFEB20DFA8DC85BAEBBB4BF45304F14425EE545A7282DBB45A04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EDA620 Relevance: 9.2, APIs: 6, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EDA6AA
VariantClear.OLEAUT32(00000008), ref: 00EDA6E2
SysAllocString.OLEAUT32(?), ref: 00EDA6FA
VariantClear.OLEAUT32(00000014), ref: 00EDA729
VariantClear.OLEAUT32(00000014), ref: 00EDA75E
VariantClear.OLEAUT32(?), ref: 00EDA7F4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$AllocInitString
String ID:
API String ID: 347172062-0
Opcode ID: 527a53714145d7ad2cbc459a02b0d30dfa3178ceade227f0078025617e340b7e
Instruction ID: 81e0bb32d5465229ad982fa3aaf440ec76ac4b4213fd685e9ec2ec68d24c68f9
Opcode Fuzzy Hash: 527a53714145d7ad2cbc459a02b0d30dfa3178ceade227f0078025617e340b7e
Instruction Fuzzy Hash: 0861F475A00258EBDB10DFA8C884BEDBBB4FF08704F18512AE905FB390E7749A46DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00F0C110 Relevance: 9.2, APIs: 6, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F0C1A4
VariantClear.OLEAUT32(00000009), ref: 00F0C1D9
VariantClear.OLEAUT32(00000008), ref: 00F0C210
SysAllocString.OLEAUT32(?), ref: 00F0C22A
VariantClear.OLEAUT32(00000003), ref: 00F0C254
VariantClear.OLEAUT32(?), ref: 00F0C2E5

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$AllocInitString
String ID:
API String ID: 347172062-0
Opcode ID: 4012d973b84ab083e60ec0c643402ed4a5c9ea52d1c964ea555a7ad179d7d38a
Instruction ID: fb412500dc6a7b94b89d2db6d336f39fd8fe52abf1737f056481a80d97329013
Opcode Fuzzy Hash: 4012d973b84ab083e60ec0c643402ed4a5c9ea52d1c964ea555a7ad179d7d38a
Instruction Fuzzy Hash: ED71F671E00258EBDF20CFE8D844B9EBBB8FF08714F14422AE905EB281D7759945EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B1D0 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F0C1A4
VariantClear.OLEAUT32(00000009), ref: 00F0C1D9
VariantClear.OLEAUT32(00000008), ref: 00F0C210

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: ab6aa1305de4b3ab8ee72533abe22d343f84994d0ccdfdb339bd95419e871bb9
Instruction ID: 51f45f1c8aa18ebed122ca5d802e0a47faad47cfed18abc7eff281cb9ffc2f86
Opcode Fuzzy Hash: ab6aa1305de4b3ab8ee72533abe22d343f84994d0ccdfdb339bd95419e871bb9
Instruction Fuzzy Hash: B6611871E00258ABDF20CFE8D844B9DBBF8BF08714F14422AE505EB281E7749945EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F38450 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,00F92610,?,?), ref: 00F3848E
SetLastError.KERNEL32(00F908E8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F384DB

Strings

CWindowsFeatureParcel::CallDismApi result: 0x%08x, xrefs: 00F38622
ISInstallWindowsFeatures, xrefs: 00F385DA
CWindowsFeatureParcel::CallDismApi: failed to create extension, status 0x%08x, xrefs: 00F3854F
WindowsFeatureParcel.cpp, xrefs: 00F38545, 00F3861B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: CWindowsFeatureParcel::CallDismApi result: 0x%08x$CWindowsFeatureParcel::CallDismApi: failed to create extension, status 0x%08x$ISInstallWindowsFeatures$WindowsFeatureParcel.cpp
API String ID: 1452528299-3795504945
Opcode ID: 189f9f056899f3f24df4bbc6bbda1c07f333f28edfdbb63a2ca825f26e7fadf3
Instruction ID: d4a1258253375ef8defb16ce557303e5f416df985a8ea79c7c98dfe8a464ea60
Opcode Fuzzy Hash: 189f9f056899f3f24df4bbc6bbda1c07f333f28edfdbb63a2ca825f26e7fadf3
Instruction Fuzzy Hash: 5A717CB0D01258DFDB10DFA8C945BDEBBF4BF44714F248259E408A7282DBB89A09DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F06410 Relevance: 9.2, APIs: 6, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F06497
VariantClear.OLEAUT32(00000008), ref: 00F064CC
SysAllocString.OLEAUT32(?), ref: 00F064E4
VariantClear.OLEAUT32(00000003), ref: 00F06504
VariantClear.OLEAUT32(?), ref: 00F06531
VariantClear.OLEAUT32(?), ref: 00F065B1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$AllocInitString
String ID:
API String ID: 347172062-0
Opcode ID: 4198bdd28beced7b32a9a3d3bdd0fc7c5f139ead59afdf82e672c7ce79578c8f
Instruction ID: 05ad5c0c6984eaa5d65e502f49dfb0e7c9dc01b5c905282781f3a401947afa56
Opcode Fuzzy Hash: 4198bdd28beced7b32a9a3d3bdd0fc7c5f139ead59afdf82e672c7ce79578c8f
Instruction Fuzzy Hash: 7D514DB1E01348ABDB21CFA4C944BDEBBF8EF08714F24402AE504FB285D775AA45EB55

Uniqueness

Uniqueness Score: -1.00%

Function 00F85000 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00F85025
_memcmp.LIBVCRUNTIME ref: 00F8506B
_memcmp.LIBVCRUNTIME ref: 00F850AA
_memcmp.LIBVCRUNTIME ref: 00F850E9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 8825654a1f393153d23045d7280b992b42f0582be4eaf2be23049881e6d59623
Instruction ID: b81257756279d8cb7234d3bd9a386e98a1c0e6f798d77dd87ad7248570259da0
Opcode Fuzzy Hash: 8825654a1f393153d23045d7280b992b42f0582be4eaf2be23049881e6d59623
Instruction Fuzzy Hash: 17511975E0060CEFDB04DF94C998BEDBBB1EB48704F2485A9E509AB340D3759B84EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC7540 Relevance: 9.1, APIs: 6, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

SysStringByteLen.OLEAUT32(?), ref: 00EC7598
SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 00EC75A1
SysStringLen.OLEAUT32(?), ref: 00EC760B
VarBstrCat.OLEAUT32(00000000,?,?), ref: 00EC7624
SysFreeString.OLEAUT32(00000000), ref: 00EC762F
SysFreeString.OLEAUT32(00000000), ref: 00EC7658

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: String$ByteFree$AllocBstr
String ID:
API String ID: 2225039195-0
Opcode ID: 8dca0963bfc09b2f9c21a9f5cd7457b0cda730bbcd2631d10dd5622c5c19378d
Instruction ID: 9fa49123e558df6d8257e585b69449e8d43a20db8f9efa55cae89b63ebcacc8d
Opcode Fuzzy Hash: 8dca0963bfc09b2f9c21a9f5cd7457b0cda730bbcd2631d10dd5622c5c19378d
Instruction Fuzzy Hash: 7A41A071A04619AFDB10CFA8D944FAAFBB8FB04724F10422EE950E7350D772A900CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F38F80 Relevance: 9.1, APIs: 6, Instructions: 117fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(-00000004,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 00F38FE6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F3901E
ReadFile.KERNEL32(00000000,00000000,00000002,00000000,00000000), ref: 00F39031
WriteFile.KERNEL32(00000000,0000FEFF,00000002,00000000,00000000), ref: 00F39071
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00F39085
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00F390A4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$PointerWrite$CreateRead
String ID:
API String ID: 2028722953-0
Opcode ID: 74cbac80458328e2c0e65e55e3dc9ac829d73e6408372f07a09e5a4300846f93
Instruction ID: 3663d1966b600f8af11c6f728dd4733cdc5da2b441d62d6603c150e57bdc627f
Opcode Fuzzy Hash: 74cbac80458328e2c0e65e55e3dc9ac829d73e6408372f07a09e5a4300846f93
Instruction Fuzzy Hash: AA41A170A05248EEEB20DFB4DC49BED7BB8EB04714F200119F511E72D2DBB45908DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00F44B87 Relevance: 9.1, APIs: 6, Instructions: 111registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F44B8E

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F4536E: __EH_prolog3.LIBCMT ref: 00F45375

LoadTypeLib.OLEAUT32(33A37B94,?), ref: 00F44C06
RegisterTypeLib.OLEAUT32(?,33A37B94,00000000), ref: 00F44C20
RegOverridePredefKey.ADVAPI32(80000000,00000000), ref: 00F44CC2

Part of subcall function 00F44EF0: GetVersionExW.KERNEL32(?), ref: 00F44F14

Part of subcall function 00F40823: RegOverridePredefKey.ADVAPI32(80000000,?), ref: 00F4085B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorH_prolog3LastOverridePredefType$LoadRegisterVersion
String ID:
API String ID: 751726694-0
Opcode ID: 41bb3da409545f2d305d551a4b1dbbfe640ce9dc44ea91620bcb2100c16fea75
Instruction ID: 71b12633bbfee7a08710e91f257f2b65cddef03ad55af3eb95152850dc7d8e14
Opcode Fuzzy Hash: 41bb3da409545f2d305d551a4b1dbbfe640ce9dc44ea91620bcb2100c16fea75
Instruction Fuzzy Hash: B9416870A01249EFDF44DF64C884BAD3FA8AF04308F588059FE15EB252D775EA46EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F019E0 Relevance: 9.1, APIs: 6, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

SafeArrayGetElement.OLEAUT32(00000002,000000FF,00000000), ref: 00F01A3A
SysStringByteLen.OLEAUT32(00000000), ref: 00F01ACC
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 00F01AD6
__CxxThrowException@8.LIBVCRUNTIME ref: 00F01A50

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

SysFreeString.OLEAUT32(00000000), ref: 00F01A79
SysFreeString.OLEAUT32(00000000), ref: 00F01AAD

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: String$ByteFree$AllocArrayElementExceptionException@8RaiseSafeThrow
String ID:
API String ID: 904061660-0
Opcode ID: 6c5a80e1b74999fbdfb299aeeb5a397f2f7e37d8dd4aabe74a24da48480fcc58
Instruction ID: 50523729d08e2c1d0403b37cac9a2678931918a0870edb697854c5741282caab
Opcode Fuzzy Hash: 6c5a80e1b74999fbdfb299aeeb5a397f2f7e37d8dd4aabe74a24da48480fcc58
Instruction Fuzzy Hash: 82319E71A01259EFCB11DFA8C945BAEBBF8FF14310F10816AE814E7291D7789A04EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ED7740 Relevance: 9.1, APIs: 6, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00ED7755
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00ED778B
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00ED779B
DispatchMessageW.USER32(?), ref: 00ED77A1
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00ED77AF
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00ED77C4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Message$MultipleObjectsPeekWait$Dispatch
String ID:
API String ID: 1963227181-0
Opcode ID: cda3a56ed600c74b36dde7643d0b4ba044bb20ecbf69dd234e8e2f0567671c1d
Instruction ID: 2b57614f900c689ef34a7f7231081b546eb985e76b1633119ee099b0677c837a
Opcode Fuzzy Hash: cda3a56ed600c74b36dde7643d0b4ba044bb20ecbf69dd234e8e2f0567671c1d
Instruction Fuzzy Hash: CC11847178430D7AFB109BA59C86FEA739C9B04F51F204523BB10FA2C0EAE1E80587B4

Uniqueness

Uniqueness Score: -1.00%

Function 00F16542 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F165D5

Part of subcall function 00F11360: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F113DF
Part of subcall function 00F11360: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11421
Part of subcall function 00F11360: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F1143D
Part of subcall function 00F11360: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11479

Part of subcall function 00EFEEA0: std::_Xinvalid_argument.LIBCPMT ref: 00EFEF10

new.LIBCMT ref: 00F16722

Strings

File, xrefs: 00F166C7
Folder, xrefs: 00F16574
,, xrefs: 00F1678B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Xinvalid_argumentstd::_
String ID: ,$File$Folder
API String ID: 1024515993-1844102309
Opcode ID: 685e3415181510ddcd8db10ebafdf75c786a5d362a6d922edae854fd1157ffb2
Instruction ID: bb8dee28d82aace76fb56ef3b8ded7b4db376514362e174fc3a73c51d600d5a7
Opcode Fuzzy Hash: 685e3415181510ddcd8db10ebafdf75c786a5d362a6d922edae854fd1157ffb2
Instruction Fuzzy Hash: 1C817871900218DFDB21DF64CD54BDEBBB5AF48320F5082D9E809A7290DB35AE84EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F04630 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 163fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00F04690
SetLastError.KERNEL32(00F908E8), ref: 00F046FE
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00F04736
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 00F04776

Strings

%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X, xrefs: 00F0480B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFileLast$CreateRead
String ID: %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X
API String ID: 1307834717-2582415446
Opcode ID: 035cdac6ecdecfc8f5452c875181dcd42bf7f3b72772358a6ebd2c4e08bbd133
Instruction ID: a45926cf9b46f6cc635cad2dad97ccbac91cd111b20f6b714263080366207edb
Opcode Fuzzy Hash: 035cdac6ecdecfc8f5452c875181dcd42bf7f3b72772358a6ebd2c4e08bbd133
Instruction Fuzzy Hash: 766156B1D042D8AEDB21CB99CC44BEEBBF8AB09310F1441D6F598E2181D7B85B84DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F16327 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F163BA

Part of subcall function 00F11360: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F113DF
Part of subcall function 00F11360: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11421
Part of subcall function 00F11360: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F1143D
Part of subcall function 00F11360: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11479

new.LIBCMT ref: 00F164D6

Strings

File, xrefs: 00F1647B
Folder, xrefs: 00F16359
&, xrefs: 00F16501

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: &$File$Folder
API String ID: 1452528299-1471521411
Opcode ID: 4d449d768f16a3d953b5116566a988c4f7fcdcda83d1d4af760af148aac21884
Instruction ID: b8f2f731f101fdc7699a0c46fe5ee586d9bb8ef10c4d60fecff9b89a9c5baeb7
Opcode Fuzzy Hash: 4d449d768f16a3d953b5116566a988c4f7fcdcda83d1d4af760af148aac21884
Instruction Fuzzy Hash: 8B615871900218DFCB25DF64CD51ADABBB5BF48310F5046A9E809A7290DB35AE80EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED7A90 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 152COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00ED7C6B

Strings

Action '%s' returned status 0x%08x, xrefs: 00ED7C17
Action '%s' does not exist, xrefs: 00ED7B74
SetupEngine.cpp, xrefs: 00ED7B6A, 00ED7BCC, 00ED7C0D
Running event '%s', xrefs: 00ED7BD6

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Exception@8Throw
String ID: Action '%s' does not exist$Action '%s' returned status 0x%08x$Running event '%s'$SetupEngine.cpp
API String ID: 2005118841-2967741759
Opcode ID: 591861fc3cad8243b1b09b0488df8c33ca13705df20ee02370e8c9327f62d7f8
Instruction ID: 8a6eab928e4a63a1b4ade8e0ec139ee1f142fea9bb312d3891ed1340a86a1718
Opcode Fuzzy Hash: 591861fc3cad8243b1b09b0488df8c33ca13705df20ee02370e8c9327f62d7f8
Instruction Fuzzy Hash: C9515971A04218DFCB24DF54CC85B9AB7B9FB44304F5441AAE859BB241E731EE45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F38D20 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 151COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104,?,?,?,00000000), ref: 00F38E90

Strings

SOFTWARE\InstallShield\25.0\Professional, xrefs: 00F38DC5
InstallShield.log, xrefs: 00F38EFB
VerboseLogPath, xrefs: 00F38E32

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: FileModuleName
String ID: InstallShield.log$SOFTWARE\InstallShield\25.0\Professional$VerboseLogPath
API String ID: 514040917-4197916691
Opcode ID: 838e729c23bbed4acf1d6598642059df95ae6ffd6970316139a129a045a5b3df
Instruction ID: b1ea784c55b8979be13be4b4e76bf04259a123ebce3946af9a0182e1ad66d753
Opcode Fuzzy Hash: 838e729c23bbed4acf1d6598642059df95ae6ffd6970316139a129a045a5b3df
Instruction Fuzzy Hash: 6F61AD70905358EEEB20EBA4DD55BEEBBB4AF15304F10419DE409B72C2DBB41B48DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00ED3230 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,00F92610,00F8B388), ref: 00ED3281
SetLastError.KERNEL32(00F908E8), ref: 00ED32CE
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104), ref: 00ED3307

Strings

Failed to obtain the running setup path for elevated proxy, xrefs: 00ED3363
SetupEngine.cpp, xrefs: 00ED333B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID: Failed to obtain the running setup path for elevated proxy$SetupEngine.cpp
API String ID: 1026760046-2980962360
Opcode ID: a783a3df0766186ecca2efd629cea7d460ef75f28a5ac71b3ef9e949d5f4837f
Instruction ID: c7d39b9ca6295ff47bc6161f47df23a62d0ae07db6ae7737efe08b7fb590949b
Opcode Fuzzy Hash: a783a3df0766186ecca2efd629cea7d460ef75f28a5ac71b3ef9e949d5f4837f
Instruction Fuzzy Hash: 22515A70A04248EFEB14DBA4C949BDEBBB0FF09304F14519AE445B7292CBB45A45DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00ED3410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,00F9271C,00000000), ref: 00ED3461
SetLastError.KERNEL32(00F908E8), ref: 00ED34AE
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,00000104), ref: 00ED34E7

Strings

SetupEngine.cpp, xrefs: 00ED351B
Failed to obtain the running setup path for nonelevated proxy, xrefs: 00ED3543

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID: Failed to obtain the running setup path for nonelevated proxy$SetupEngine.cpp
API String ID: 1026760046-3061179590
Opcode ID: d77cbd7f811db4cda54af9cc5b9bdf77776b15bcae06a8d3e7ed9b03b5615e19
Instruction ID: 8f012981ebaf656c75fb5439e9d43460384d48cdf5285a8d14718080bd50b5bc
Opcode Fuzzy Hash: d77cbd7f811db4cda54af9cc5b9bdf77776b15bcae06a8d3e7ed9b03b5615e19
Instruction Fuzzy Hash: 02516C70A04248EFEB14DFA4D849BDEBBB0FF09304F14519AE105B7292DBB45A49DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5A60 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00000000,00020019,00000000,33A37B94), ref: 00EE5AF6
RegQueryValueExW.ADVAPI32(00000000,CommonFilesDir,00000000,00000000,?,?), ref: 00EE5B33

Strings

CommonFilesDir, xrefs: 00EE5B22, 00EE5B2C
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00EE5AEC
ProgramFilesDir, xrefs: 00EE5B1D

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: OpenQueryValue
String ID: CommonFilesDir$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 4153817207-3256072622
Opcode ID: bbb19c817ce01befcfe03c0e26917ffe8f88c46c02f2b09ba5272b3d79d73db5
Instruction ID: 5c7fe812875a8758c30b65e91c4a0551285019b56f966ad017d2fb5b61390b00
Opcode Fuzzy Hash: bbb19c817ce01befcfe03c0e26917ffe8f88c46c02f2b09ba5272b3d79d73db5
Instruction Fuzzy Hash: E64191B1A01258AFEB60DF54CC49BDEBBB8EB44704F1001E9E41DB7281DBB45A84DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F447D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F447D7

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F4536E: __EH_prolog3.LIBCMT ref: 00F45375

Part of subcall function 00EE5F80: GetLastError.KERNEL32(0000003C,00000000,33A37B94,0000003C,00000000,00000000), ref: 00EE5FEC
Part of subcall function 00EE5F80: SetLastError.KERNEL32(00F908E8), ref: 00EE602A

Part of subcall function 00F44A92: __EH_prolog3_GS.LIBCMT ref: 00F44A99

Strings

.EXE, xrefs: 00F44824
.OCX, xrefs: 00F448AC
.DLL, xrefs: 00F4489B
.TLB, xrefs: 00F44866

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$H_prolog3
String ID: .DLL$.EXE$.OCX$.TLB
API String ID: 532146472-324785130
Opcode ID: 2b9363902129bb994741783df8812909b34aad6e92ab4f3f606729bc0fe6348f
Instruction ID: 4029c5bdba1a3fe4bdd3af154e977927b3d0e4be8b1055d99596060de2d30324
Opcode Fuzzy Hash: 2b9363902129bb994741783df8812909b34aad6e92ab4f3f606729bc0fe6348f
Instruction Fuzzy Hash: E43188B5900208AFDF04FF64DC829FE7FA8AF04744B505029FC05B6252EB75E956EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F1D838 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00EB4CA0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F610C1,000000FF), ref: 00EB4CE2
Part of subcall function 00EB4CA0: SetLastError.KERNEL32(?,?,?,?,?,00F610C1,000000FF), ref: 00EB4D21

GetModuleHandleExW.KERNEL32(00000006,?,?), ref: 00F1D85F

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

GetModuleFileNameW.KERNEL32(?,00000000,00000104,?,00000104), ref: 00F1D899

Part of subcall function 00EB9D60: GetLastError.KERNEL32(33A37B94,74DEDFA0,74DEE010), ref: 00EB9D8D
Part of subcall function 00EB9D60: SetLastError.KERNEL32(00000000), ref: 00EB9E1E

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Strings

Exception address 0x%08x in module %s (base 0x%08x), xrefs: 00F1D935
Exception caught while running script action, exception code 0x%08x at 0x%08x, xrefs: 00F1D8F5
:, xrefs: 00F1D972

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$String$FreeModule$AllocFileHandleName
String ID: :$Exception address 0x%08x in module %s (base 0x%08x)$Exception caught while running script action, exception code 0x%08x at 0x%08x
API String ID: 1895926925-941225769
Opcode ID: a6d48178de412c0220dcfccb9df47e62f8b501c59452ead0ee71e019cca1c072
Instruction ID: 1705927619b3f84f26ca9e9aad7a157bee8c9061fb1b4bfe52657c2b6d741bf1
Opcode Fuzzy Hash: a6d48178de412c0220dcfccb9df47e62f8b501c59452ead0ee71e019cca1c072
Instruction Fuzzy Hash: 14412C70900248EFDB11EBA4CD8ABDEB7B8AF15304F6040A9E145B71A2DB716F44DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F34B70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(00000294,?,?,?,?,00F35ECD,00000000,?,?), ref: 00F34B92
GetModuleHandleW.KERNEL32(kernel32.dll,GetProductInfo,?,?), ref: 00F34BD5
GetProcAddress.KERNEL32(00000000), ref: 00F34BDC

Strings

kernel32.dll, xrefs: 00F34BC9
GetProductInfo, xrefs: 00F34BC4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: GetProductInfo$kernel32.dll
API String ID: 3310240892-182221857
Opcode ID: 696682540451a36ea70accbace1bf301be8d6e6370b27fe87ffa011b282a57fc
Instruction ID: 5a343fedb58a1640b60bca7c91bce8027f2dc97915f47a0b8ed4b16e0ab84e24
Opcode Fuzzy Hash: 696682540451a36ea70accbace1bf301be8d6e6370b27fe87ffa011b282a57fc
Instruction Fuzzy Hash: C1213831E022056ADF3457999C8D7ACF728A7467F0F281192E938D3060D368FC88A3C2

Uniqueness

Uniqueness Score: -1.00%

Function 00F1D984 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00F1D9AD
VariantClear.OLEAUT32(?), ref: 00F1D9EC
VariantClear.OLEAUT32(?), ref: 00F1DA03

Strings

(, xrefs: 00F1D984
!, xrefs: 00F1DA05

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ClearVariant$__set_se_translator
String ID: !$(
API String ID: 2601108747-43236505
Opcode ID: f55725e2cf8cc822297148c31867559a825b9dee3506b89f3c42deb931d5e750
Instruction ID: bb51372989c494ac35649074d76fc7d967bdd55d7111abca6e947755813b8147
Opcode Fuzzy Hash: f55725e2cf8cc822297148c31867559a825b9dee3506b89f3c42deb931d5e750
Instruction Fuzzy Hash: 0A31DE30909298DFDB10EBA4D999BDEBBF0AF24300F1440E9D048A7292DB745F88DF12

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2DC0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(33A37B94,?), ref: 00EC2E6F

Strings

x64, xrefs: 00EC2E42
Unknown, xrefs: 00EC2E2A
x86, xrefs: 00EC2E53
IA64, xrefs: 00EC2E36

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AllocString
String ID: IA64$Unknown$x64$x86
API String ID: 2525500382-3030484263
Opcode ID: ece011574b8c103e201ad27578d9d25c5fe1e23aefae8d90a4274096d73ded3b
Instruction ID: f976ab37043a3af424f6d69479f0a049d3aa1cd70f3edadbd08b231a0c627f64
Opcode Fuzzy Hash: ece011574b8c103e201ad27578d9d25c5fe1e23aefae8d90a4274096d73ded3b
Instruction Fuzzy Hash: 0221CF71E0421DDACF15EFA8DD52BEEB7B4BB04710F10412EE812B3281DB75AA06D795

Uniqueness

Uniqueness Score: -1.00%

Function 00F33250 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F332D4

Strings

yxxx, xrefs: 00F33253
yxxx, xrefs: 00F33296
yxxx, xrefs: 00F33276
vector<T> too long, xrefs: 00F332CF

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: vector<T> too long$yxxx$yxxx$yxxx
API String ID: 909987262-1981109606
Opcode ID: 6e2eb256d3b0ebd9a76a388d190db76679b4149a431e08826f50ef15c8c7d953
Instruction ID: b2d4e00dc73879dc812792d5a67008fbd29f6111635f5566b2ff4a35ce15ccd9
Opcode Fuzzy Hash: 6e2eb256d3b0ebd9a76a388d190db76679b4149a431e08826f50ef15c8c7d953
Instruction Fuzzy Hash: E40181737004251B4B0C983D8DA552B658797ED37432AC279E907DFF8AC824ED8AE6D4

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE7E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,?,00EEE9AD,?,?,00000000), ref: 00EEE80A
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00EEE81A

Part of subcall function 00EEE780: GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,?,00EEE7F7,00000000,?,00000000,?,00EEE9AD,?,?,00000000), ref: 00EEE790
Part of subcall function 00EEE780: GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 00EEE7A0

Strings

Advapi32.dll, xrefs: 00EEE805
RegDeleteKeyExW, xrefs: 00EEE814

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 1646373207-2191092095
Opcode ID: 64f39eed04c0dc45bd9ebd3d7a9544a572d46e2e7e3ee227786de132a80a5c66
Instruction ID: 929e34d65b38b16d299b01fed412e06e161f7e61bfc9addec39cdcda2317a983
Opcode Fuzzy Hash: 64f39eed04c0dc45bd9ebd3d7a9544a572d46e2e7e3ee227786de132a80a5c66
Instruction Fuzzy Hash: 0D01B13610838CAEEB21AFA5FC04B957F95BB14790F18402BF945E6261DB728450FB59

Uniqueness

Uniqueness Score: -1.00%

Function 00F45694 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456A7
GetProcAddress.KERNEL32(00000000), ref: 00F456AE
GetCurrentProcess.KERNEL32(00000000,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456BE

Strings

IsWow64Process, xrefs: 00F4569D
kernel32, xrefs: 00F456A2

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 615ae155157f5d8401973fece86837a6801c73cd1a9bbb957a83ee13aa9b0311
Instruction ID: c602cf8b319a466f576a47cad38e8e596004f3de285ce5cdc127643ad0b7200c
Opcode Fuzzy Hash: 615ae155157f5d8401973fece86837a6801c73cd1a9bbb957a83ee13aa9b0311
Instruction Fuzzy Hash: 56E04F72D4172CBBCB10ABF09D0EAEE7B6CEB04B22F110555F800D7192D6398A04AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF6CD0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0000002D,00000000,00000000,00000001,?,00F96F78,00000000,00000001), ref: 00EF6DA3
SetLastError.KERNEL32(00F908E8), ref: 00EF6DF3
GetLastError.KERNEL32 ref: 00EF6E07
SetLastError.KERNEL32(00F908E8), ref: 00EF6E51

Strings

, xrefs: 00EF6ED0, 00EF6F0B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-410699589
Opcode ID: ac0a968abc6e5dc62e694e6cb1d4ef89206ffee07c7adb93bde239d6292856cd
Instruction ID: 093d1c25fe774bffb406c25c051ba827c2b7c011954856cafda1e5c586d78c57
Opcode Fuzzy Hash: ac0a968abc6e5dc62e694e6cb1d4ef89206ffee07c7adb93bde239d6292856cd
Instruction Fuzzy Hash: 5EA15471E0425CDFDF14CFA4C894BEEBBB4AF05304F14819AE559AB281DBB46A48CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F2C9C0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 203COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00F2CA0A
SetLastError.KERNEL32(00F908E8), ref: 00F2CA57

Strings

ISP parcel handler: failed to resolve source media file %s, error %x, requesting parcel abort, xrefs: 00F2CBED
IspParcelHandler.cpp, xrefs: 00F2CAC5, 00F2CBE6
ISP parcel handler: failed to unmarshal parcel, error 0x%08x. Progress information will not be available., xrefs: 00F2CACC

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: ISP parcel handler: failed to resolve source media file %s, error %x, requesting parcel abort$ISP parcel handler: failed to unmarshal parcel, error 0x%08x. Progress information will not be available.$IspParcelHandler.cpp
API String ID: 1452528299-1073711128
Opcode ID: d9ccf6e7d07978877a7cdc0871d280161f1c94d8cc2d1b7ab61a9ac828ec9aca
Instruction ID: 8404338bcfc3fa11ea95c40129a865f8fdd1901d08fa22a1193e4ad4edd6c45d
Opcode Fuzzy Hash: d9ccf6e7d07978877a7cdc0871d280161f1c94d8cc2d1b7ab61a9ac828ec9aca
Instruction Fuzzy Hash: B3918B71D00258DFDB04DFA8D849BDEBBF4BF48314F148159E416AB282DB74AA09DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ECB250 Relevance: 7.7, APIs: 5, Instructions: 192COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00ECB441
__CxxThrowException@8.LIBVCRUNTIME ref: 00ECB2C0

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

__CxxThrowException@8.LIBVCRUNTIME ref: 00ECB30C
__CxxThrowException@8.LIBVCRUNTIME ref: 00ECB3AB

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: 783abd660d624e4929d9ef0e23f23671804c9493f7528fbaff3b60187c293210
Instruction ID: 5e2bc79cfcedcbbea9618c0f224cb0f67cef2ad12431b8c9ff07bfdbe2e8ed82
Opcode Fuzzy Hash: 783abd660d624e4929d9ef0e23f23671804c9493f7528fbaff3b60187c293210
Instruction Fuzzy Hash: BD71AD7190425CDACB29EBA0CD52FEEB7B8BF14304F04509DE415B7082EB35AB49DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EE49C0 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00FD7548,33A37B94), ref: 00EE4A21
GetModuleFileNameW.KERNEL32(?,00000104), ref: 00EE4A9C
LoadTypeLib.OLEAUT32(?,00000000), ref: 00EE4AD1
LoadRegTypeLib.OLEAUT32(00F9F784,00000001,00000000,?,00000000), ref: 00EE4AFF
LeaveCriticalSection.KERNEL32(00FD7548), ref: 00EE4C24

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CriticalLoadSectionType$EnterFileLeaveModuleName
String ID:
API String ID: 2487232618-0
Opcode ID: bb71dbc4d662b8f74e6640238ff40e4879fe6b73e096d92f97300eb86c5ea953
Instruction ID: 874e1676499f486110d660b53b5eb6e7caaf25c7f70f3657d6ba320ecabbf9a6
Opcode Fuzzy Hash: bb71dbc4d662b8f74e6640238ff40e4879fe6b73e096d92f97300eb86c5ea953
Instruction Fuzzy Hash: 69717FB050125CEFDB21DFA5D848B9AB7F8AB48314F144099E409E7291DB75EE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F36029 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,Server,00000000,?,?), ref: 00F360C3
SetLastError.KERNEL32(00F908E8,?,?,?,?,?,?,Server,00000000,?,?), ref: 00F3610D
GetLastError.KERNEL32(?,?,?,?,Server,00000000,?,?), ref: 00F361CA
SetLastError.KERNEL32(00F908E8,?,?,?,?,Server,00000000,?,?), ref: 00F36214

Part of subcall function 00EB4810: GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
Part of subcall function 00EB4810: SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
Part of subcall function 00EB4810: SetLastError.KERNEL32(?), ref: 00EB48AA

Strings

Final feature list for current item is: %s, xrefs: 00F36254

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: Final feature list for current item is: %s
API String ID: 2425351278-4291577261
Opcode ID: 062033e528ec3e4069163fca339689aa66f380ce30935dee16724571184ad2f6
Instruction ID: 07630e0c2d51587093358f1d89e0dfe15a7c9e2c08e29406ffdbe0e685213ffa
Opcode Fuzzy Hash: 062033e528ec3e4069163fca339689aa66f380ce30935dee16724571184ad2f6
Instruction Fuzzy Hash: 168128B0D01298DEEF21DFA4C985BDDBBB0BF15314F148099D448B7242DB751A49EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EDA260 Relevance: 7.7, APIs: 5, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EDA2F4
VariantClear.OLEAUT32(00000009), ref: 00EDA329
VariantClear.OLEAUT32(00000008), ref: 00EDA360
SysAllocString.OLEAUT32(?), ref: 00EDA37A
VariantClear.OLEAUT32(?), ref: 00EDA40E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$AllocInitString
String ID:
API String ID: 347172062-0
Opcode ID: 24e8e48b710fe0797748e1c252505e135340281b5861edc8b23c3a9590b92bf7
Instruction ID: 4b85f3228b79bd00dff66463932b0b609ee3dc5ee219b85affe99ce0ef53cc47
Opcode Fuzzy Hash: 24e8e48b710fe0797748e1c252505e135340281b5861edc8b23c3a9590b92bf7
Instruction Fuzzy Hash: 7D613671E00258ABDB10CFE4C844BDEBBB5FF08704F18512AE515BB381D7B5AA45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F18AB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F18B39
VariantClear.OLEAUT32(00000009), ref: 00F18B6E
VariantCopy.OLEAUT32(?,?), ref: 00F18B9A
VariantClear.OLEAUT32(00000002), ref: 00F18BB3
VariantClear.OLEAUT32(?), ref: 00F18C3D

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$CopyInit
String ID:
API String ID: 24293632-0
Opcode ID: 6812ff8d7821bcc506646d35df0a88c045f929354173a8227efb61c88eb3e039
Instruction ID: e0346a9403419141caa84fb626ce42db63cc6d5826b7b36f3af7de9a6a2a047a
Opcode Fuzzy Hash: 6812ff8d7821bcc506646d35df0a88c045f929354173a8227efb61c88eb3e039
Instruction Fuzzy Hash: 305148B1E05258AFCB10CFE4C988BDEBBB8FF48714F14412AE505EB281D774A945DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00EBB990 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EBBA1E
SetLastError.KERNEL32(00F908E8), ref: 00EBBA68

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

VariantInit.OLEAUT32(?), ref: 00EBBAC0
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 00EBBB33
VariantClear.OLEAUT32(?), ref: 00EBBB80

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Variant$FreeString$ChangeClearInitType
String ID:
API String ID: 2032598660-0
Opcode ID: d3626b53ab230d7612e5c1821afe75aa87a85cad31eacffb8495f2e4089b8035
Instruction ID: 221cd398990f8f772f7140fd8f47c692e3087e7e3d678d734c354ae1fd9fe0b2
Opcode Fuzzy Hash: d3626b53ab230d7612e5c1821afe75aa87a85cad31eacffb8495f2e4089b8035
Instruction Fuzzy Hash: A061D571D00259DFDB10DFA8C985BDEBBB4FB08314F1081A9E559E7292DB74AA44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0E50 Relevance: 7.6, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

Part of subcall function 00EB48D0: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60F81,000000FF,?,00EB2726), ref: 00EB4907
Part of subcall function 00EB48D0: SetLastError.KERNEL32(?,?,?,?,?,00F60F81,000000FF), ref: 00EB4946

GetLastError.KERNEL32 ref: 00EF0ED7
SetLastError.KERNEL32(?), ref: 00EF0F19
GetLastError.KERNEL32 ref: 00EF0F35
SetLastError.KERNEL32(?), ref: 00EF0F71
GetLastError.KERNEL32 ref: 00EF0F90
SetLastError.KERNEL32(?), ref: 00EF0FCC

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: bc6769fecd7d7ab189e403bf261ba227f69f48c4b6f5d94f2ad256790c60f916
Instruction ID: caa194d600be3eb8c2e46d06e2308d58bc5a395c206bb83e4bf2719ac8bd3d4b
Opcode Fuzzy Hash: bc6769fecd7d7ab189e403bf261ba227f69f48c4b6f5d94f2ad256790c60f916
Instruction Fuzzy Hash: 9F6108B0805784DFE720CFA9C54879ABFF0BF09308F1485ADD4899B792D7B5A608DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F1C3D0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F43A91: __EH_prolog3_GS.LIBCMT ref: 00F43A9B
Part of subcall function 00F43A91: CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000044,00FD689C,?,00000000,00F44B64,?,00000000), ref: 00F43BAC
Part of subcall function 00F43A91: GetLastError.KERNEL32 ref: 00F43BC7

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

CloseHandle.KERNEL32 ref: 00F1C4DA
CloseHandle.KERNEL32 ref: 00F1C4E2

Strings

open, xrefs: 00F1C40C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$CloseFreeHandleString$CreateH_prolog3_Process
String ID: open
API String ID: 627463535-2758837156
Opcode ID: 756ff26c8295cd103e6abf81715e47fc929ee9adcedb2d5b83ab0b7f69d421fb
Instruction ID: d8c3206918f8400966c0bf6078527e7bab83059e08936cf797356c6fd3cbba88
Opcode Fuzzy Hash: 756ff26c8295cd103e6abf81715e47fc929ee9adcedb2d5b83ab0b7f69d421fb
Instruction Fuzzy Hash: 8941E171A00258EFEF10DFA8DC46BAEBBB5EF04714F10011AE914AB2D1DBB16905EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBC040 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,00000000,?,?), ref: 00EBC07A
SetLastError.KERNEL32(?), ref: 00EBC0B9
VariantInit.OLEAUT32(?), ref: 00EBC11F
VariantChangeType.OLEAUT32(?,00000000,00000000,00000008), ref: 00EBC12E
VariantClear.OLEAUT32(00000008), ref: 00EBC174

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$ErrorLast$ChangeClearInitType
String ID:
API String ID: 3873592113-0
Opcode ID: 2a99a9e5bc13548ac517b991a311fc70e3ac35860b3ca2d4dce22daadb5d713b
Instruction ID: 53a791f32fe04f685d8cc6749a637b4f3eedf22fe07f39af237d02e76865939d
Opcode Fuzzy Hash: 2a99a9e5bc13548ac517b991a311fc70e3ac35860b3ca2d4dce22daadb5d713b
Instruction Fuzzy Hash: 1141A3B5A04605EFCB04EF68CD09BEAB7F4FF08714F14821DE506A7692D774A940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F590AC Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00000008,00000000,00000000,00000000,?,00000000,?,00000001,00000008,?,00000001,00000000,00000000), ref: 00F590F9
__alloca_probe_16.LIBCMT ref: 00F59131
MultiByteToWideChar.KERNEL32(?,00000001,?,00000008,00000000,00000000,?,00000000,?,00000001,00000008,?,00000001,00000000,00000000,?), ref: 00F59182
GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,00000000,?,00000001,00000008,?,00000001,00000000,00000000,?,00000008,00000000), ref: 00F59194
__freea.LIBCMT ref: 00F5919D

Part of subcall function 00F56B68: RtlAllocateHeap.NTDLL(00000000,00F3FBA7,?,?,00F4DFF8,?,?,?,?,?,00F3FACB,00F3FBA7,?,?,?,?), ref: 00F56B9A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 9a34228bf062a933095a86b55d5a9f4aa53a0750913fcc4d4e3db9aa61bc5c2f
Instruction ID: 322518db6c2683ddf822bd0ece300a784315f055ea337ed5643b6ae9d452308e
Opcode Fuzzy Hash: 9a34228bf062a933095a86b55d5a9f4aa53a0750913fcc4d4e3db9aa61bc5c2f
Instruction Fuzzy Hash: 9431F032A0061AEFDF289F64CC49EAE7BA5EB01711F044128FD08D6291E775DD58EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EC52D0 Relevance: 7.6, APIs: 6, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC5356
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC5398
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC53B4
SetLastError.KERNEL32(00F908E8,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC53F0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC540C
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC5448

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7fb9dd46a3755cd14eecfcf83b41ab574f13e1136abb499ecb82daeaedcfe717
Instruction ID: 0f023cb7c663fcabc0bdff5f4efe892fc5dd5c2274b9a9f69f46924817dd6177
Opcode Fuzzy Hash: 7fb9dd46a3755cd14eecfcf83b41ab574f13e1136abb499ecb82daeaedcfe717
Instruction Fuzzy Hash: F05127B0901784DFDB60CFA9C64874ABBF0BF08318F14869DD4899B752D3B5A604DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD780 Relevance: 7.6, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32(33A37B94,?,00000000,?), ref: 00EFD80F
SetLastError.KERNEL32(?,?,00000000,?), ref: 00EFD851
GetLastError.KERNEL32(?,00000000,?), ref: 00EFD86D
SetLastError.KERNEL32(?,?,00000000,?), ref: 00EFD8A9
GetLastError.KERNEL32(?,00000000,?), ref: 00EFD8C5
SetLastError.KERNEL32(?,?,00000000,?), ref: 00EFD901

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 28e1f345dde0d68f2d8d17bf25427c7d654298a14565c7b090f96323670c12af
Instruction ID: 9649abe5044302a9b53ae14bae5cf21ce93a74a459902622f76175567a458f6b
Opcode Fuzzy Hash: 28e1f345dde0d68f2d8d17bf25427c7d654298a14565c7b090f96323670c12af
Instruction Fuzzy Hash: FC5104B1905788DFDB20CFA9C94874ABFF0BF08314F108A9DD48997752D3B5AA04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00F11710 Relevance: 7.6, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11793
SetLastError.KERNEL32(?), ref: 00F117D5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F117F1
SetLastError.KERNEL32(?), ref: 00F1182D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11849
SetLastError.KERNEL32(?), ref: 00F11885

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c5b0c00e758ca596fc1d3986b49a5c95ca73800494785e9bd955ee1c6e49707a
Instruction ID: 26a712dd751bad484eef95a32d0a447b447a8451614e455619f1f6908403e6cc
Opcode Fuzzy Hash: c5b0c00e758ca596fc1d3986b49a5c95ca73800494785e9bd955ee1c6e49707a
Instruction Fuzzy Hash: 105117B0905744DFDB20CFA9C94874ABBF0BF08318F10869DD4899B752D3B5AA04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD920 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

VariantInit.OLEAUT32(00000028), ref: 00EFD9C0
VariantInit.OLEAUT32(00000038), ref: 00EFD9D7
GetLastError.KERNEL32 ref: 00EFDA11
SetLastError.KERNEL32(?), ref: 00EFDA4D
VariantInit.OLEAUT32(00F98664), ref: 00EFDA6E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: InitVariant$ErrorLast
String ID:
API String ID: 313805207-0
Opcode ID: 5ac5df82ffb40adc0f15777155a29cf450727b0e26895b878afa894c9cd27a96
Instruction ID: a0337de3fefa0d68503b4624cdcbacda1bc3fd783d839f50313d317db7cc52fb
Opcode Fuzzy Hash: 5ac5df82ffb40adc0f15777155a29cf450727b0e26895b878afa894c9cd27a96
Instruction Fuzzy Hash: 6F4121B0804748DFDB20CF68D548B8ABFF4FB09314F11859ED4899B362D7B5AA08DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1790 Relevance: 7.6, APIs: 6, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00EF0E50: GetLastError.KERNEL32 ref: 00EF0ED7
Part of subcall function 00EF0E50: SetLastError.KERNEL32(?), ref: 00EF0F19
Part of subcall function 00EF0E50: GetLastError.KERNEL32 ref: 00EF0F35
Part of subcall function 00EF0E50: SetLastError.KERNEL32(?), ref: 00EF0F71
Part of subcall function 00EF0E50: GetLastError.KERNEL32 ref: 00EF0F90
Part of subcall function 00EF0E50: SetLastError.KERNEL32(?), ref: 00EF0FCC

GetLastError.KERNEL32 ref: 00EF17E5
SetLastError.KERNEL32(?), ref: 00EF1827
GetLastError.KERNEL32 ref: 00EF1846
SetLastError.KERNEL32(?), ref: 00EF1882
GetLastError.KERNEL32 ref: 00EF18A1
SetLastError.KERNEL32(00F908E8), ref: 00EF18DD

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c0ed76d28b19abef28bf2cceccb60abc72a779196c343930c0eb4c7baa2799dd
Instruction ID: 9d64782b2c9b88d7af9c666b912461d3392f5010fb17e9f47625e17a7beb3ded
Opcode Fuzzy Hash: c0ed76d28b19abef28bf2cceccb60abc72a779196c343930c0eb4c7baa2799dd
Instruction Fuzzy Hash: 6E4133B0901B84CFDB60CFA9C94874ABBF0BF08714F108A5DD48AA7B52D775AA04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD0D0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00EFCF80: GetLastError.KERNEL32 ref: 00EFD00F
Part of subcall function 00EFCF80: SetLastError.KERNEL32(?), ref: 00EFD051
Part of subcall function 00EFCF80: GetLastError.KERNEL32 ref: 00EFD06D
Part of subcall function 00EFCF80: SetLastError.KERNEL32(?), ref: 00EFD0A9

VariantInit.OLEAUT32(000000A0), ref: 00EFD144
VariantInit.OLEAUT32(000000B0), ref: 00EFD15B
GetLastError.KERNEL32 ref: 00EFD18D
SetLastError.KERNEL32(?), ref: 00EFD1C9
VariantInit.OLEAUT32(000000F0), ref: 00EFD1E9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$InitVariant
String ID:
API String ID: 201494241-0
Opcode ID: 16c373888ebe594883f1e62fe7ed4a1c30ebef2f02e9de66828ab0166a409c9f
Instruction ID: 4b2489bd9172ce3a24fb70c8a916158dd03881edb5573ddff043378575df1f70
Opcode Fuzzy Hash: 16c373888ebe594883f1e62fe7ed4a1c30ebef2f02e9de66828ab0166a409c9f
Instruction Fuzzy Hash: 444153B0904744DFD724CF68D948B8ABBF4FB09314F1086AEE049DB752D774AA04DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD360 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00EFD210: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13,000000FF), ref: 00EFD29F
Part of subcall function 00EFD210: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13), ref: 00EFD2E1
Part of subcall function 00EFD210: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13,000000FF), ref: 00EFD2FD
Part of subcall function 00EFD210: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13), ref: 00EFD339

VariantInit.OLEAUT32(00000098), ref: 00EFD3D1
VariantInit.OLEAUT32(000000A8), ref: 00EFD3E8
GetLastError.KERNEL32 ref: 00EFD417
SetLastError.KERNEL32(?), ref: 00EFD453
VariantInit.OLEAUT32(000000E8), ref: 00EFD473

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$InitVariant
String ID:
API String ID: 201494241-0
Opcode ID: 4e307db63ef7b85482cec791a4f056c9ac72b38e396b1277bbe59996541f445f
Instruction ID: dc28d1d5a6e73eea16282a668482c50790f278b79f05ab981f531b0953d38272
Opcode Fuzzy Hash: 4e307db63ef7b85482cec791a4f056c9ac72b38e396b1277bbe59996541f445f
Instruction Fuzzy Hash: 9A4144B0804784DFDB24CF68D948B4ABBF4FB08314F1085AED0499B362D774AA04DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00EF7770 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00EBD270: SetLastError.KERNEL32(80004005,33A37B94), ref: 00EBD2C3

GetLastError.KERNEL32(33A37B94), ref: 00EF77C4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00EF77CE

Strings

Extension condition evaluation failed with status %x, xrefs: 00EF781D
Extension handler: error 0x%08x trying to get evaluator, xrefs: 00EF77E8
Condition.cpp, xrefs: 00EF77D6, 00EF77ED, 00EF7816

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: Condition.cpp$Extension condition evaluation failed with status %x$Extension handler: error 0x%08x trying to get evaluator
API String ID: 1452528299-1845061947
Opcode ID: 3c0524fcf00daa07f16d979f3c6a6b70620986e41398eb11dc19e7a2cf95702d
Instruction ID: 670cc7cf7005769e83197598a96d423f252de1f82473b415401649238388bbe5
Opcode Fuzzy Hash: 3c0524fcf00daa07f16d979f3c6a6b70620986e41398eb11dc19e7a2cf95702d
Instruction Fuzzy Hash: A1319FB1D0429C9BDB14DFE4C945BEEBBF8EB04750F108229E816FB281EB749A04C791

Uniqueness

Uniqueness Score: -1.00%

Function 00EB8210 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,00000000), ref: 00EB8221
CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,00000000), ref: 00EB8231
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?,?,00000000,00000004,00000000,00000000,00000000,?,00000000), ref: 00EB8244
UnmapViewOfFile.KERNEL32(00000000), ref: 00EB8264
CloseHandle.KERNEL32(00000000,?,?,00000000,00000004,00000000,00000000,00000000,?,00000000), ref: 00EB826B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: File$View$CloseCreateHandleMappingSizeUnmap
String ID:
API String ID: 1558290345-0
Opcode ID: 429165cd9ab0a0c0be42c08d5108a9335ec40a336ecfbff7dc67683eb2e5dff7
Instruction ID: 74f8f7f2ac7bcc7ae1bea49f8664f40121e1a1c2cc6307372b7672c5acc19723
Opcode Fuzzy Hash: 429165cd9ab0a0c0be42c08d5108a9335ec40a336ecfbff7dc67683eb2e5dff7
Instruction Fuzzy Hash: 94F08C32A01A58BBD7201BAAAC4DCEF7EBCDBC6F15F400069FA05E2212DA704D01C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00EB78F0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 406COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EB7D0D
std::_Xinvalid_argument.LIBCPMT ref: 00EB7D17

Part of subcall function 00EB4370: SysAllocStringLen.OLEAUT32(00000000,?), ref: 00EB43E8
Part of subcall function 00EB4370: SysFreeString.OLEAUT32(00000000), ref: 00EB4460

Strings

invalid string position, xrefs: 00EB7CF4, 00EB7CFE
string too long, xrefs: 00EB7D08, 00EB7D12

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: StringXinvalid_argumentstd::_$AllocFree
String ID: invalid string position$string too long
API String ID: 2819953329-4289949731
Opcode ID: 823ad7a4d0a60d722ddb7f560760153eb015461c4e976f3b29874807e13f8121
Instruction ID: a620c290ec26f609e2fa3b0e04daee071689f4a993c7405f9e4902e77f718710
Opcode Fuzzy Hash: 823ad7a4d0a60d722ddb7f560760153eb015461c4e976f3b29874807e13f8121
Instruction Fuzzy Hash: 7FE1297060820ADBCB24CF58D9C08DBB7B6FFC87047205969E895ABA15D730EE55CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F20AC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F20CC5
std::_Xinvalid_argument.LIBCPMT ref: 00F20CCF

Strings

invalid string position, xrefs: 00F20CB6
string too long, xrefs: 00F20CC0, 00F20CCA

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: d354bcc3bfeb0c24594f2d238a987387a1215eae0fa8b6c343979005faf48cea
Instruction ID: 8086365747af694cc9d4134c512445a57a3402c0747951cf57ea3ab4103e7cb4
Opcode Fuzzy Hash: d354bcc3bfeb0c24594f2d238a987387a1215eae0fa8b6c343979005faf48cea
Instruction Fuzzy Hash: 9C61A372B00229DB8B24DF58E88086AB3F6FFC4714720462EE846CB652DF31D915EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00EC8FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32 ref: 00EC8FF3

Part of subcall function 00ED7740: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00ED7755
Part of subcall function 00ED7740: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00ED778B
Part of subcall function 00ED7740: GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00ED779B
Part of subcall function 00ED7740: DispatchMessageW.USER32(?), ref: 00ED77A1
Part of subcall function 00ED7740: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00ED77AF
Part of subcall function 00ED7740: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00ED77C4

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

ReleaseMutex.KERNEL32(?), ref: 00EC9043
CloseHandle.KERNEL32(?), ref: 00EC904F

Strings

', xrefs: 00EC9238

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Message$ErrorFreeLastMultipleObjectsPeekStringWait$CloseDispatchHandleMutexPostReleaseThread
String ID: '
API String ID: 3972460781-1997036262
Opcode ID: f3b0dc8685d27a62bd27aa66f28c572d36d99173742815e84e84246d91fcf3da
Instruction ID: f61eb17643a8923a0408119b75bd24ae8f800931a3959af9ecbf08dd24172f52
Opcode Fuzzy Hash: f3b0dc8685d27a62bd27aa66f28c572d36d99173742815e84e84246d91fcf3da
Instruction Fuzzy Hash: EFA1CF70A09689EEDB05DBA4C9457DEFFB0AF15304F14419DE544A7382CBB52B08EBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00ED4610 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Part of subcall function 00EBAE70: VariantClear.OLEAUT32(?), ref: 00EBAE86
Part of subcall function 00EBAE70: SysAllocString.OLEAUT32(?), ref: 00EBAE99

VariantClear.OLEAUT32(00F9091C), ref: 00ED46BB
VariantClear.OLEAUT32(?), ref: 00ED4737

Strings

Engine: couldn't get feature '%s', xrefs: 00ED47F7
SetupEngine.cpp, xrefs: 00ED47F0

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ClearStringVariant$Alloc
String ID: Engine: couldn't get feature '%s'$SetupEngine.cpp
API String ID: 4285173129-2539324038
Opcode ID: c3ad4ff12811b45aa5ad033377838c95a5fd82f84e401956498377cdc6547529
Instruction ID: 359fc3c1513bb54a05d7e76185fb5c960652fcadc165a1c066376ba99826c10a
Opcode Fuzzy Hash: c3ad4ff12811b45aa5ad033377838c95a5fd82f84e401956498377cdc6547529
Instruction Fuzzy Hash: F9812EB4A00249DFDB04DFA8C544BAEBBB9FF59304F14819EE405EB381D735AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD980 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EDDB23
std::_Xinvalid_argument.LIBCPMT ref: 00EDDB2D

Part of subcall function 00EB4370: SysAllocStringLen.OLEAUT32(00000000,?), ref: 00EB43E8
Part of subcall function 00EB4370: SysFreeString.OLEAUT32(00000000), ref: 00EB4460

Strings

invalid string position, xrefs: 00EDDB0A, 00EDDB14
string too long, xrefs: 00EDDB1E, 00EDDB28

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: StringXinvalid_argumentstd::_$AllocFree
String ID: invalid string position$string too long
API String ID: 2819953329-4289949731
Opcode ID: 5180611e269e1936a0c691683648a7de400a31a14b169acb0145231b8c97d091
Instruction ID: 5c7376d885da483fa382fc05edf65b12b53e9e14157ba0e5df2a4fa3f5090dd8
Opcode Fuzzy Hash: 5180611e269e1936a0c691683648a7de400a31a14b169acb0145231b8c97d091
Instruction Fuzzy Hash: 19516D7170820A9FCB24DF58DC8089AB7E9FF84344721992FE846D7351EB31E956CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ECC779 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00ECC8A5
SysFreeString.OLEAUT32(?), ref: 00ECCA05

Strings

., xrefs: 00ECC97C
The resource %s failed to initialize, status %x, xrefs: 00ECC931
SetupEngine.cpp, xrefs: 00ECC916, 00ECC93C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Exception@8FreeStringThrow
String ID: .$SetupEngine.cpp$The resource %s failed to initialize, status %x
API String ID: 59539279-1675980340
Opcode ID: 5e11203e36db536baf35bf2763b12371594cf68b799b2bc53d4fc5649300f1df
Instruction ID: dd994ef23425745f17cba4947d43baf3a653ccb1a9679a558cb5546083f226c7
Opcode Fuzzy Hash: 5e11203e36db536baf35bf2763b12371594cf68b799b2bc53d4fc5649300f1df
Instruction Fuzzy Hash: 986197709042189BDF25DB64CA84BDEB7B8AF01304F2052EDE549BB292DB31AF41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA3B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00ECA4E6

Strings

SetupEngine.cpp, xrefs: 00ECA401, 00ECA54E
Engine: disallowing use of suite update since we're running with existing state information., xrefs: 00ECA573
Failed to initialize state information, is SuiteId missing from the setup element?, xrefs: 00ECA426

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Exception@8Throw
String ID: Engine: disallowing use of suite update since we're running with existing state information.$Failed to initialize state information, is SuiteId missing from the setup element?$SetupEngine.cpp
API String ID: 2005118841-1047235996
Opcode ID: 2f81586f55b5715266bcc4251519c038e1fdb993ab4b8416ef12b2c231c11295
Instruction ID: 82e0bd7ab3eb5ffcb4f4b66af2453e3b62581dd0985e2d1a4f3f9b8e7eeff235
Opcode Fuzzy Hash: 2f81586f55b5715266bcc4251519c038e1fdb993ab4b8416ef12b2c231c11295
Instruction Fuzzy Hash: AC5181B090538CDEEF24EBA4DD45BDDBBB0AB01318F28525DE411771D2DBB45A06DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F28AB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?), ref: 00F28AD6

Strings

TrustedPeople, xrefs: 00F28B3F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ExistsFilePath
String ID: TrustedPeople
API String ID: 1174141254-1224236647
Opcode ID: 56e6f94cb1b25942fa1e23817ed8effe77538f9ae8d192c2e1572f4b7cad47c5
Instruction ID: b90ff459ebc393637dab58f7e02275edcd1d347a0275ef3fa527c035499cc4cb
Opcode Fuzzy Hash: 56e6f94cb1b25942fa1e23817ed8effe77538f9ae8d192c2e1572f4b7cad47c5
Instruction Fuzzy Hash: F831C431B4222CBBDF209F94EC09B997BA9EB08756F100096F908E7190DF719E51EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EB25E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82libraryCOMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 00EB2623
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00EB2656
LoadLibraryA.KERNEL32(00000000), ref: 00EB26B2

Strings

api-ms-win-core-, xrefs: 00EB261D

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem_strstr
String ID: api-ms-win-core-
API String ID: 3099798052-1285793476
Opcode ID: 24de4a1684d135c83089994b868cbcbe70d75c5e59d96cdc4f4afc0d52c4904c
Instruction ID: 996cce8911ee2112d18f0e0cc3d41f7c5ba757de0dfb0140581234bfe9da96d3
Opcode Fuzzy Hash: 24de4a1684d135c83089994b868cbcbe70d75c5e59d96cdc4f4afc0d52c4904c
Instruction Fuzzy Hash: CC2127319052089FDF20EB749C49BEB7BE4DF15304F04549DD9C2F7189DAB1A988CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F44A92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F44A99

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F4536E: __EH_prolog3.LIBCMT ref: 00F45375

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB9C30: GetLastError.KERNEL32(33A37B94,74DEDFA0,?,00000000,?,?,?,?,?,?,?,?,?,?,00F62401,000000FF), ref: 00EB9C87
Part of subcall function 00EB9C30: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F62401,000000FF,?,00EB9DF1), ref: 00EB9CC8

Part of subcall function 00F43A91: __EH_prolog3_GS.LIBCMT ref: 00F43A9B
Part of subcall function 00F43A91: CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000044,00FD689C,?,00000000,00F44B64,?,00000000), ref: 00F43BAC
Part of subcall function 00F43A91: GetLastError.KERNEL32 ref: 00F43BC7

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Strings

open, xrefs: 00F44AE3
/REGSERVER, xrefs: 00F44B31, 00F44B39
/UNREGSERVER, xrefs: 00F44B27

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeH_prolog3_String$CreateH_prolog3Process
String ID: /REGSERVER$ /UNREGSERVER$open
API String ID: 811671759-1423703008
Opcode ID: b5d9fafb6743b1ce1baf71a619a7710fe107c0619a2ce6a4d79ccced02aba7cf
Instruction ID: a8963bd923f29b232ea77585a222e7931d915e087ab32acf112def2cd699b7fa
Opcode Fuzzy Hash: b5d9fafb6743b1ce1baf71a619a7710fe107c0619a2ce6a4d79ccced02aba7cf
Instruction Fuzzy Hash: 1D2185B5E50348AEEF10EBA4CC427EDBFA8AF50700F140059FD04AB2C2D7B59A469792

Uniqueness

Uniqueness Score: -1.00%

Function 00F38C90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC3B20: GetModuleHandleW.KERNEL32(Advapi32.dll,?,00000000,?,00000000,?,00F38DE1,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,33A37B94,?), ref: 00EC3B44
Part of subcall function 00EC3B20: RegCloseKey.ADVAPI32(00000000,?,00F38DE1,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,33A37B94,?), ref: 00EC3BA7

RegQueryValueExW.ADVAPI32(00000000,DoVerboseLogging,00000000,00F8B388,00000000,?,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,00000001,?), ref: 00F38CED
RegCloseKey.ADVAPI32(00000000,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,00000001,?), ref: 00F38D0D

Strings

DoVerboseLogging, xrefs: 00F38CE7
SOFTWARE\InstallShield\25.0\Professional, xrefs: 00F38C9D

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Close$HandleModuleQueryValue
String ID: DoVerboseLogging$SOFTWARE\InstallShield\25.0\Professional
API String ID: 2971604672-3930117262
Opcode ID: a21fdc23f8e9ae18594a57b8786dfb66e5a702854900a4c29df356624c931c4c
Instruction ID: c305828c3e0396960ad77ff219bfe9ca3a41314a57c41e12a8365ca645fa4f3a
Opcode Fuzzy Hash: a21fdc23f8e9ae18594a57b8786dfb66e5a702854900a4c29df356624c931c4c
Instruction Fuzzy Hash: 60017CB1D41319EADB20CB90DC49BEFBBB8EF15769F100145E901B6180D7795B09EBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE780 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,?,00EEE7F7,00000000,?,00000000,?,00EEE9AD,?,?,00000000), ref: 00EEE790
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 00EEE7A0

Strings

Advapi32.dll, xrefs: 00EEE78B
RegDeleteKeyTransactedW, xrefs: 00EEE79A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedW
API String ID: 1646373207-2168864297
Opcode ID: a05833786f5a91036f0697ae4c8e3b7d48f90a90e22d79913ac600c2a239459f
Instruction ID: f8791b9f0f506041b805dbf8d14203fc3092aaed1a5cb0e49204a45161c16b20
Opcode Fuzzy Hash: a05833786f5a91036f0697ae4c8e3b7d48f90a90e22d79913ac600c2a239459f
Instruction Fuzzy Hash: 7FF0303225031CAAFB202F95EC4AFE67799AB04F56F144027FA44F51D1D7B2D490EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F4315C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetProcessId,?,00F43D65,?), ref: 00F43169
GetProcAddress.KERNEL32(00000000), ref: 00F43170

Strings

kernel32.dll, xrefs: 00F43164
GetProcessId, xrefs: 00F4315F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetProcessId$kernel32.dll
API String ID: 1646373207-399901964
Opcode ID: 870c22a0f4e39e08a3af65628c859622c3c0e094cf8bccf83fff5771d5045b75
Instruction ID: affffeadeb5d00e89061bda5b7bc318096497d90b62ac36753ade35feb711172
Opcode Fuzzy Hash: 870c22a0f4e39e08a3af65628c859622c3c0e094cf8bccf83fff5771d5045b75
Instruction Fuzzy Hash: F2D01231A8470C7BAF046FF5BC0D8A93F5C9B80F527004021B40CD5052DA76C511B755

Uniqueness

Uniqueness Score: -1.00%

Function 00F41031 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00F4103B

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F43E17: __EH_prolog3.LIBCMT ref: 00F43E1E

GetLastError.KERNEL32 ref: 00F41085

Part of subcall function 00F4536E: __EH_prolog3.LIBCMT ref: 00F45375

Part of subcall function 00F43968: __EH_prolog3_GS.LIBCMT ref: 00F43972
Part of subcall function 00F43968: __CxxThrowException@8.LIBVCRUNTIME ref: 00F439D4
Part of subcall function 00F43968: GetFileTime.KERNEL32(?,00000000,00F9091C,00F9091C,00000108,00F4121B,?,?,?,00F9091C,80000000,00000001,00000080,00000003,00000000,00000000), ref: 00F439DE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3$Exception@8FileH_prolog3_H_prolog3_catch_ThrowTime
String ID:
API String ID: 2315665788-0
Opcode ID: 59ead20004b62ad4f0e734f0ae020560983060e6028576747e5ceaf354eb1bec
Instruction ID: dffe18f0201573bf57f97eee1ba22816c50a3d1c9601ae8741a98659020d18d6
Opcode Fuzzy Hash: 59ead20004b62ad4f0e734f0ae020560983060e6028576747e5ceaf354eb1bec
Instruction Fuzzy Hash: 84D1817180125CEEEF20EF64CC45BEE7BB8AF40314F104199E81967292EB745F88EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6290 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 231COMMON

Download Yara Rule

APIs

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

GetLastError.KERNEL32(00F928C0,000000FF,00000001,0000003C,00000000,00F8B388,00000000,00F8B388,00000000,33A37B94,0000003C,74DEDFA0,0000003C), ref: 00EC64C6
SetLastError.KERNEL32(00F908E8), ref: 00EC6510

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Strings

http://, xrefs: 00EC6369, 00EC6525
https://, xrefs: 00EC6415, 00EC653D

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: http://$https://
API String ID: 1452528299-1916535328
Opcode ID: a79ee983f44439f9bae272f9f5834a6297dfda8eac4d9c5ac49fce4822a5bd76
Instruction ID: 4ae86254e00284d46a667583c019ae25811c1f1781a575c30cd09d7a79e9aa6c
Opcode Fuzzy Hash: a79ee983f44439f9bae272f9f5834a6297dfda8eac4d9c5ac49fce4822a5bd76
Instruction Fuzzy Hash: ECA1D270904258EEDF20DBA4DD95BEEBBB4AF14304F2401A9E115B72C2DBB15F49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EF70E0 Relevance: 6.2, APIs: 4, Instructions: 228COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(00000294), ref: 00EF7157
GetVersionExW.KERNEL32(00000294), ref: 00EF71D7
GetVersionExW.KERNEL32(00000294), ref: 00EF728C
GetVersionExW.KERNEL32(00000294), ref: 00EF72C3

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: ddb892d0d15108808e98fe15b14e75bcde9a47854e0da18efce16d68c919072c
Instruction ID: 8f5e2add53492aed6a7fe1bee8074eb585a30e8edb7889fc55920dcedd494a57
Opcode Fuzzy Hash: ddb892d0d15108808e98fe15b14e75bcde9a47854e0da18efce16d68c919072c
Instruction Fuzzy Hash: 8191E03050E34CCEEB35DB28C948BF977A1AF52308F182069DAC6AB2A1D775588AD751

Uniqueness

Uniqueness Score: -1.00%

Function 00F0EE80 Relevance: 6.2, APIs: 4, Instructions: 212COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(?), ref: 00F0EFDD

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CopyVariant
String ID:
API String ID: 3840901598-0
Opcode ID: b51da4b65689dcfa6282ba15cecc218212821abe82f1ae9700871e2485739f53
Instruction ID: 3d878690858c4948073c5da43fcd671a9d6dbd4682b83baccf3562cbca6f60d6
Opcode Fuzzy Hash: b51da4b65689dcfa6282ba15cecc218212821abe82f1ae9700871e2485739f53
Instruction Fuzzy Hash: 47716172E00209AFDB18DF68C944BAEB7F5EF88311F148569E915EB381E731AD05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF3820 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EF3860
SetLastError.KERNEL32(00F908E8), ref: 00EF38AD

Strings

Can't run CLR action, clrwrap.dll not present, xrefs: 00EF390A
Actions.cpp, xrefs: 00EF38E2

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: Actions.cpp$Can't run CLR action, clrwrap.dll not present
API String ID: 1452528299-3708759318
Opcode ID: 983b89408ae11f7f595c9bf8ac70a18e129a76c9b5c88cb328e1cc560dae4658
Instruction ID: b2c059dd1a25da29df17c2a97c9d7dea55bd1ea23a72282debf810acbfb3af88
Opcode Fuzzy Hash: 983b89408ae11f7f595c9bf8ac70a18e129a76c9b5c88cb328e1cc560dae4658
Instruction Fuzzy Hash: C5915B7090529CDEEF21DFA4DC44BEEBBF4AB05304F14419AE149B7282D7B45B48DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EC7300 Relevance: 6.2, APIs: 4, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(-00000004), ref: 00EC7489
SysStringLen.OLEAUT32(00000000), ref: 00EC74AD
SysFreeString.OLEAUT32(00000000), ref: 00EC74BF
SysFreeString.OLEAUT32(00000000), ref: 00EC7526

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: a2afcaae0dc494daae19de318b608dbb91c19927aa98b4b55bb9d1a3124703c1
Instruction ID: 6db4d0de207e7ced72047d115274c4a981959f72f4c2fb1a41d47e53f9088f99
Opcode Fuzzy Hash: a2afcaae0dc494daae19de318b608dbb91c19927aa98b4b55bb9d1a3124703c1
Instruction Fuzzy Hash: 266179719042189BDB24CFA8C984BEEBBB4FF04314F24425DE865B7281DB319A46DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF2DA0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EF2DE0
SetLastError.KERNEL32(00F908E8), ref: 00EF2E2D

Strings

Actions.cpp, xrefs: 00EF2E62
Can't run powershell action, clrwrap.dll not present, xrefs: 00EF2E8A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: Actions.cpp$Can't run powershell action, clrwrap.dll not present
API String ID: 1452528299-1221417118
Opcode ID: 0546cdd48e91301d1aade514b5a8966b2c2d7504e1244145410f7430b4876934
Instruction ID: e215ad088ad4d8c627a77fd3a27b167bd4bf49bdc6237279de94b4e1e5448c66
Opcode Fuzzy Hash: 0546cdd48e91301d1aade514b5a8966b2c2d7504e1244145410f7430b4876934
Instruction Fuzzy Hash: EE716B7090529CDEEF20DFA4D848BEEBBF4AB05308F14419EE105BB282D7B45A48DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F386B0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00F3872E
SetLastError.KERNEL32(00F908E8), ref: 00F38778

Part of subcall function 00F45694: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456A7
Part of subcall function 00F45694: GetProcAddress.KERNEL32(00000000), ref: 00F456AE
Part of subcall function 00F45694: GetCurrentProcess.KERNEL32(00000000,?,?,00F455A3,?,?,00EBEFA6,00000000,FileProvider: check is on 64-bit path,?,00000000,c:\codebases\isdev\src\runtime\shared\setupsuite\FileProvider.h,?), ref: 00F456BE

Strings

/norestart /quiet /iu:, xrefs: 00F38829
pkgmgr.exe, xrefs: 00F387B3

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$AddressCurrentHandleModuleProcProcess
String ID: /norestart /quiet /iu:$pkgmgr.exe
API String ID: 2162457882-2476661344
Opcode ID: e08ebe07fa5965075eb1d2dedeb61683de99e292587ec807770f4b047625f1d1
Instruction ID: bc594e88ff3ddd616dbeb5964fed7ce3f8d8de6a29f25f839460cf84469661db
Opcode Fuzzy Hash: e08ebe07fa5965075eb1d2dedeb61683de99e292587ec807770f4b047625f1d1
Instruction Fuzzy Hash: F1715BB1D0025CDEDB20DFA4C945BDEBBF4AF04314F148199E419B7282DBB45A49DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF3030 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

GetLastError.KERNEL32 ref: 00EF30E1
SetLastError.KERNEL32(00F908E8), ref: 00EF312B

Strings

Actions.cpp, xrefs: 00EF30A6, 00EF30CA
Launching InstallScript action in function '%s', xrefs: 00EF30C5

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID: Actions.cpp$Launching InstallScript action in function '%s'
API String ID: 1452528299-2626941881
Opcode ID: 0eda76b1acf608014e49fd38e95e249d8ad1bb4d9191c9c898faef983fd99c6a
Instruction ID: 5c8a290e7858e4d99b0534c6485b4d07ea5ea3db1961f5a81a33bda53049e0a3
Opcode Fuzzy Hash: 0eda76b1acf608014e49fd38e95e249d8ad1bb4d9191c9c898faef983fd99c6a
Instruction Fuzzy Hash: 3B616A70A04358DFDF10CFA4C848BEEBBB5BF49304F148199D549AB282DB745A48DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F2A510 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F2A599
VariantClear.OLEAUT32(00000003), ref: 00F2A5C9
VariantClear.OLEAUT32(00000009), ref: 00F2A5FF
VariantClear.OLEAUT32(?), ref: 00F2A67F

Part of subcall function 00EBAF20: __CxxThrowException@8.LIBVCRUNTIME ref: 00EBAF32

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$Clear$Exception@8InitThrow
String ID:
API String ID: 3663099706-0
Opcode ID: 09291b80ba3c0196ab0477bb6fc16e05dc4ed135796ac0615fd6cb3b7ae9075d
Instruction ID: a3bbbef407e6d7d6bc9d54f897569c0e5f1153be193047118bb846a1bb3d8550
Opcode Fuzzy Hash: 09291b80ba3c0196ab0477bb6fc16e05dc4ed135796ac0615fd6cb3b7ae9075d
Instruction Fuzzy Hash: F9513771E04368EFDB11CFA8D949BDEBBF8AF08710F18412AE805EB281D774A945DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00ED91A0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00EB4150: GetLastError.KERNEL32(33A37B94,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4193
Part of subcall function 00EB4150: SetLastError.KERNEL32(?,00F8B388,00000000,?,?,?,?,?,00F60E09,000000FF,?,00EB304D), ref: 00EB4210

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

GetLastError.KERNEL32(?,?,Software\InstallShield\SuiteInstallers\Parcels,?,00000000,33A37B94,00000000), ref: 00ED927C
SetLastError.KERNEL32(00F908E8), ref: 00ED92C6

Strings

Software\InstallShield\SuiteInstallers\Parcels, xrefs: 00ED9217
Clients, xrefs: 00ED92EB

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID: Clients$Software\InstallShield\SuiteInstallers\Parcels
API String ID: 2425351278-1925417990
Opcode ID: e8c4a0fdb89de251d9ec4c84f20c74d8e622f97cae5df1a24e780493b2091046
Instruction ID: 76b4aadd324e44bb943533fd0d595bfb2a7ee346cd71b6491008ae390df21e5d
Opcode Fuzzy Hash: e8c4a0fdb89de251d9ec4c84f20c74d8e622f97cae5df1a24e780493b2091046
Instruction Fuzzy Hash: D16146B1900258EFDB10DFA8CC58BEEBBB4FF04304F148199E415B7282DB745A49DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EE62A0 Relevance: 6.1, APIs: 4, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(-00000002), ref: 00EE62D8
SysAllocStringLen.OLEAUT32(00000002), ref: 00EE632A
SysStringLen.OLEAUT32(00000000), ref: 00EE6346
SysFreeString.OLEAUT32(00000000), ref: 00EE638E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 2f47b0a7693c284db9da74a21d968998b18ec7fa86425c712240f695efbce099
Instruction ID: cb42ab24e476ee5f0c726380d4f1e828143e099972708e1788a81bb1bb3c26c7
Opcode Fuzzy Hash: 2f47b0a7693c284db9da74a21d968998b18ec7fa86425c712240f695efbce099
Instruction Fuzzy Hash: 8131CB3660014D9BDF249F6EE84456DF7A9EFA4364B10822FFC04E7361DA72DD249790

Uniqueness

Uniqueness Score: -1.00%

Function 00EFFA80 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EFFAC3
Concurrency::cancel_current_task.LIBCPMT ref: 00EFFAE2
new.LIBCMT ref: 00EFFAE8

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2c16820f92f5b23dca2f28d048d3569721f427231d1ccb103de6338e301ce95d
Instruction ID: 0245088af0a50eb68b8aee204485aed30723bb472b13c2be59990dab62ab6232
Opcode Fuzzy Hash: 2c16820f92f5b23dca2f28d048d3569721f427231d1ccb103de6338e301ce95d
Instruction Fuzzy Hash: 7941F5B19002099BC718DF5CC881BAEBBF9EF84750F10823EE816A7350E735A904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE870 Relevance: 6.1, APIs: 4, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC3B20: GetModuleHandleW.KERNEL32(Advapi32.dll,?,00000000,?,00000000,?,00F38DE1,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,33A37B94,?), ref: 00EC3B44
Part of subcall function 00EC3B20: RegCloseKey.ADVAPI32(00000000,?,00F38DE1,80000001,SOFTWARE\InstallShield\25.0\Professional,00020019,33A37B94,?), ref: 00EC3BA7

RegEnumKeyExW.ADVAPI32(00000000,00000000,?,?,00000000,00000000,00000000,33A37B94,?,?,?,33A37B94,?,00000000), ref: 00EEE921
RegEnumKeyExW.ADVAPI32(00000000,00000000,?,00000100,00000000,00000000,00000000,?,?,00000000), ref: 00EEE971
RegCloseKey.ADVAPI32(00000000,?,00000000), ref: 00EEE982
RegCloseKey.ADVAPI32(00000000,?,?,?,33A37B94,?,00000000), ref: 00EEE9C1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Close$Enum$HandleModule
String ID:
API String ID: 2852649468-0
Opcode ID: 1263d9d6ac406bc2c4b6c7966ac29471e1043a2266406a6d4726036f7d0f7a55
Instruction ID: 9f7abf7f09248bf28e49cef50f3f747d366b63c86234396b4b41928aad69130f
Opcode Fuzzy Hash: 1263d9d6ac406bc2c4b6c7966ac29471e1043a2266406a6d4726036f7d0f7a55
Instruction Fuzzy Hash: DB415B7184122CABDB20DF55DC88BEABBF8FF48354F1042D9E808A6240D7359E84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F242F0 Relevance: 6.1, APIs: 4, Instructions: 86fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000010,?,00000000,00000000,00000000), ref: 00F2431A
GetLastError.KERNEL32 ref: 00F24324
ReadFile.KERNEL32(?,00000000,?,00000000,00000000), ref: 00F2439D
GetLastError.KERNEL32 ref: 00F243A7

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: d15c26ec9ef1e958e4bcb051f82da49d26a8549c8c82012265c3adcd197495f9
Instruction ID: d2e19863f801612e8464a61f875e71c57c4ece098266a3df6c2396d61c9f3597
Opcode Fuzzy Hash: d15c26ec9ef1e958e4bcb051f82da49d26a8549c8c82012265c3adcd197495f9
Instruction Fuzzy Hash: 9B216271A01519ABDB10DFA5EC55BAEBBB8EB08310F00416AED05E7640EBB4AD14EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F240D0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F24110
Concurrency::cancel_current_task.LIBCPMT ref: 00F2412A
new.LIBCMT ref: 00F24130

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c5037d630e42c4e6056e4c4d4ef631960a26ec2e8793e81ee3ed2e26998d94cc
Instruction ID: d08bd4eab63bd6cbc1f7b10ca4abf190f732fd5dc6a4abae976f92df4a859e9f
Opcode Fuzzy Hash: c5037d630e42c4e6056e4c4d4ef631960a26ec2e8793e81ee3ed2e26998d94cc
Instruction Fuzzy Hash: F221F1B2900215AFCB15DF68DC81A6ABBE8FB04360F10432AFC15D3290E775FA50DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F07490 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F074D0
Concurrency::cancel_current_task.LIBCPMT ref: 00F074E6
new.LIBCMT ref: 00F074EC

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2ccb92fc488060a8ce498a6495df1c2b0be68745c6de64d87e4032d14de91ef2
Instruction ID: 2a2ac98b5d788b2072f50fe2ae3f4a9cff44d4b809d7b708661cfb436f65b69d
Opcode Fuzzy Hash: 2ccb92fc488060a8ce498a6495df1c2b0be68745c6de64d87e4032d14de91ef2
Instruction Fuzzy Hash: AA2182B2D04615AFC714EF68CD81A6ABBA8FB04360B10472AF815D3290EB75F914EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC0DE0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00EC0D30: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,33A37B94,00000000,00000000,?,00F64466,000000FF,?,00EC0E10,33A37B94,00000003,00EC1332,33A37B94), ref: 00EC0D75
Part of subcall function 00EC0D30: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00EC0E10,33A37B94), ref: 00EC0D8D

new.LIBCMT ref: 00EC0E2D
GetDesktopWindow.USER32 ref: 00EC0EAB
new.LIBCMT ref: 00EC0EDB
QueryPerformanceFrequency.KERNEL32(?), ref: 00EC0F09

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CreateEvent$DesktopFrequencyPerformanceQueryWindow
String ID:
API String ID: 3646735809-0
Opcode ID: ce461dcd4f134a6afc2cea9d3d302c87d57b414cf651dc3b3c91f6d83f3041f2
Instruction ID: e64950b186d699c81392cd658a9f90f5e1d239c6b8e1fa70d40a08b40aab1713
Opcode Fuzzy Hash: ce461dcd4f134a6afc2cea9d3d302c87d57b414cf651dc3b3c91f6d83f3041f2
Instruction Fuzzy Hash: 304123B0800B84CFE760DF64C55978BBBF0BB04308F10895DD49A9BB81DBBAA108DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE54C0 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,33A37B94), ref: 00EE5510
GetLastError.KERNEL32 ref: 00EE5541
new.LIBCMT ref: 00EE5560
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE5584

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorExceptionException@8LastPathRaiseTempThrow
String ID:
API String ID: 1555486328-0
Opcode ID: 8fd3e73278a80afb17ad3a3d49ce1c73d87a5dd612042b74b0cc3acd43589396
Instruction ID: aaa159a0e2cd65850689f23b1c3ac82b1edf460a5090013d840197f523f9e3f4
Opcode Fuzzy Hash: 8fd3e73278a80afb17ad3a3d49ce1c73d87a5dd612042b74b0cc3acd43589396
Instruction Fuzzy Hash: 75311BB19012589EDB60EF94DC497DDBBB8EB04704F1001D9E409A7291DBB45B88DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F243E0 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000010,00000000,00000000,00000000,00000000), ref: 00F24447
GetLastError.KERNEL32 ref: 00F24451
WriteFile.KERNEL32(?,00000001,00ECAEEB,00000000,00000000), ref: 00F24475
GetLastError.KERNEL32 ref: 00F2447F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 57e4dcb0b1540332f6cd1015399f8a521e2d221343e8127130ae86f7062c4bd7
Instruction ID: bb1b6ebd59b202aba6526168439e971e6bf7a8e723398e7efd11b027e58ba668
Opcode Fuzzy Hash: 57e4dcb0b1540332f6cd1015399f8a521e2d221343e8127130ae86f7062c4bd7
Instruction Fuzzy Hash: 97216272A0111D9BCB10EF94E815BFFBBB8EF48711F00416AED05E6241D7B59901AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2CC70 Relevance: 6.1, APIs: 4, Instructions: 74fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Part of subcall function 00F0C110: VariantInit.OLEAUT32(?), ref: 00F0C1A4
Part of subcall function 00F0C110: VariantClear.OLEAUT32(00000009), ref: 00F0C1D9
Part of subcall function 00F0C110: VariantClear.OLEAUT32(00000008), ref: 00F0C210
Part of subcall function 00F0C110: SysAllocString.OLEAUT32(?), ref: 00F0C22A

WriteFile.KERNEL32(?,?,?,?,?,?,00000010,?,00000000,?,00000000,?,00000000), ref: 00F2CD07
GetLastError.KERNEL32(?,?,?,?,?,?,00000010,?,00000000,?,00000000,?,00000000), ref: 00F2CD17
WriteFile.KERNEL32(?,?,0000000C,?,00000000,?,?,?,?,?,?,00000010,?,00000000,?,00000000), ref: 00F2CD2E
GetLastError.KERNEL32(?,?,?,?,?,?,00000010,?,00000000,?,00000000,?,00000000), ref: 00F2CD38

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: StringVariant$AllocClearErrorFileLastWrite$Init
String ID:
API String ID: 579143929-0
Opcode ID: b3fbb4318168aa555eb2256fec0c5672db75fb064e2d7bc5fff79566e4f070b9
Instruction ID: bf19b18c47673a8e37ec3e190eff193b38e4942f04d8e1d0e33dbe0751f8319b
Opcode Fuzzy Hash: b3fbb4318168aa555eb2256fec0c5672db75fb064e2d7bc5fff79566e4f070b9
Instruction Fuzzy Hash: FA214871208305AFD710DF64C881AABBBE8FF88754F000A2EF999D7251E770E904DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F2CD50 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB3ED0: SysStringLen.OLEAUT32(?), ref: 00EB3EDE
Part of subcall function 00EB3ED0: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 00EB3EF8

Part of subcall function 00F0C350: VariantInit.OLEAUT32(?), ref: 00F0C3EC
Part of subcall function 00F0C350: VariantClear.OLEAUT32(00000008), ref: 00F0C424
Part of subcall function 00F0C350: SysAllocString.OLEAUT32(?), ref: 00F0C43A
Part of subcall function 00F0C350: VariantClear.OLEAUT32(00000003), ref: 00F0C464
Part of subcall function 00F0C350: VariantClear.OLEAUT32(00000003), ref: 00F0C493

WriteFile.KERNEL32 ref: 00F2CDE7
GetLastError.KERNEL32 ref: 00F2CDF1
WriteFile.KERNEL32(?,00000000,0000000C,?,00000000), ref: 00F2CE0C
GetLastError.KERNEL32 ref: 00F2CE16

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$ClearString$AllocErrorFileLastWrite$Init
String ID:
API String ID: 1952979597-0
Opcode ID: 674437de5ff575c555997390cd425c1beefb63d896fe5b9ce56163d49b8c8b7b
Instruction ID: 72eed024ae9743a7ec2ddf0dd4c78cc6ffb2deda95d46c6dd62db05834888412
Opcode Fuzzy Hash: 674437de5ff575c555997390cd425c1beefb63d896fe5b9ce56163d49b8c8b7b
Instruction Fuzzy Hash: BA215971208305AFD710DF50D885BABBBE8FF48754F404A1DF989D62A1E770D910DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4810 Relevance: 6.1, APIs: 4, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,00F908F0,00F9091C,?,00F60F29,000000FF,?,00EB394A,00F8B388,?,?,00000000,33A37B94,?,00F908F0), ref: 00EB484B
SysFreeString.OLEAUT32(6F6C206F), ref: 00EB4865
SysFreeString.OLEAUT32(00F90920), ref: 00EB487A
SetLastError.KERNEL32(?), ref: 00EB48AA

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: bbcb943596aa5c749d6a30ab6ab35d52417d9afaeb54fe504e6b77d7e9c79cc8
Instruction ID: 3e4dad9ea0fa399aeb539f16ac64aac8ad6f60c0d81a1717cb000b3b53178b52
Opcode Fuzzy Hash: bbcb943596aa5c749d6a30ab6ab35d52417d9afaeb54fe504e6b77d7e9c79cc8
Instruction Fuzzy Hash: 6521AC75805744EFC720CF58E908B89FBF5FF08720F104669E859A37A1D771AA14DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EB4BE0 Relevance: 6.1, APIs: 4, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
SysFreeString.OLEAUT32(?), ref: 00EB4C35
SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorFreeLastString
String ID:
API String ID: 3822639702-0
Opcode ID: c561111f46f4f172e3278d7f6beebdf246f00e0e865c35d94d02e5d61d796589
Instruction ID: fcd6eb183ea2fbb6af74ce87e118e66766a545f86ed7aab169eb34c08bb2aca4
Opcode Fuzzy Hash: c561111f46f4f172e3278d7f6beebdf246f00e0e865c35d94d02e5d61d796589
Instruction Fuzzy Hash: 72219A75401744EFDB20CF58E908B89FBF5FF08B20F104669E859A37A1D771AA14DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F5881C Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00F587C3,00000000,00000000,00000000,00000000,?,00F589C0,00000006,FlsSetValue), ref: 00F5884E
GetLastError.KERNEL32(?,00F587C3,00000000,00000000,00000000,00000000,?,00F589C0,00000006,FlsSetValue,00F88DF0,00F88DF8,00000000,00000364,?,00F573D8), ref: 00F5885A
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F587C3,00000000,00000000,00000000,00000000,?,00F589C0,00000006,FlsSetValue,00F88DF0,00F88DF8,00000000), ref: 00F58868

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 1dc4bfd9e68d799ff27838ba5a6413a08b707e2e9342c1b16fb1101d817fc7cd
Instruction ID: 6e27a7c9f51afa6ce4fe497f9b8c8dc747c16158017c98ec453e9f88d7343c26
Opcode Fuzzy Hash: 1dc4bfd9e68d799ff27838ba5a6413a08b707e2e9342c1b16fb1101d817fc7cd
Instruction Fuzzy Hash: 8B01FC36A412266BCB215B789C44AA67798EF05BF37550620FF05E7241DF20D806EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F5729C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F51EB5,?,?,?,00F51F0F,?,?,?,?,?,00000410,00000000), ref: 00F572A0
SetLastError.KERNEL32(00000000,?,?,?,?,?,00000410,00000000,?,?,?,?,?,?,?,?), ref: 00F57308
SetLastError.KERNEL32(00000000,?,?,?,?,?,00000410,00000000,?,?,?,?,?,?,?,?), ref: 00F57314
_abort.LIBCMT ref: 00F5731A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: aec8e8e6ec18eba3326e365daa8cd84e17be204fee38e3fce838dea25da0a423
Instruction ID: a751631a80da512f77ab0f82a24082e0cbd54d347b300183ac00b00ddfa98ab4
Opcode Fuzzy Hash: aec8e8e6ec18eba3326e365daa8cd84e17be204fee38e3fce838dea25da0a423
Instruction Fuzzy Hash: 57F0A436908B0437D6127335BD0AB6A3A5BABC1B73F240014FF14E31D3EE28880EB561

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E775 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00F4E78C

Part of subcall function 00F4EDC4: ___AdjustPointer.LIBCMT ref: 00F4EE0E

_UnwindNestedFrames.LIBCMT ref: 00F4E7A3
___FrameUnwindToState.LIBVCRUNTIME ref: 00F4E7B5
CallCatchBlock.LIBVCRUNTIME ref: 00F4E7D9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 4056feabde770098383f8d373bf91f4ae19ead3c68d4d0ccba28ff6cc4da5191
Instruction ID: e26b12581aac788f6e0c26202f15ba85c5276d38625dee300be9afa53d36d947
Opcode Fuzzy Hash: 4056feabde770098383f8d373bf91f4ae19ead3c68d4d0ccba28ff6cc4da5191
Instruction Fuzzy Hash: 1B01E532400109BBCF129F65DC41EDA3FBAFF48764F158424FE1866120D33AE8A1EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EB6A50 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EB6A7B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc978cc889e40049f6676613c9accee11237620b85b9323038526c00a13686a1
Instruction ID: 486d7780011c519efcbbc23181fbc58611c4c0ef632a13f8b733e9527d3b4e15
Opcode Fuzzy Hash: dc978cc889e40049f6676613c9accee11237620b85b9323038526c00a13686a1
Instruction Fuzzy Hash: 2DF05CF36042040A9F28E7749C13D7F77849B20364700D23AF81FE2291F52BED10D19A

Uniqueness

Uniqueness Score: -1.00%

Function 00EDF710 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EDF73B

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b82be66d9b7f57e999b9b9356d376a45b5be56236216bcf9e074ef363957e6
Instruction ID: 6b92c4b6e4ffe278778bf270956adb1a4dd4b1db14b85b972bf6aba2a7129cfd
Opcode Fuzzy Hash: f8b82be66d9b7f57e999b9b9356d376a45b5be56236216bcf9e074ef363957e6
Instruction Fuzzy Hash: 2EF05CF36141040A9718E7745C42C7E7684CB20364700523FF81FD6391F923E911D19A

Uniqueness

Uniqueness Score: -1.00%

Function 00EBC370 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00EBC39E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d253d5f1bc75003ff249671036eb7cd1ebb9bbe2da2241c4e9248067d64837f
Instruction ID: 7bd9afa4640b516304e79ed774d6fee54786eaef472e235560c6090f499734b9
Opcode Fuzzy Hash: 4d253d5f1bc75003ff249671036eb7cd1ebb9bbe2da2241c4e9248067d64837f
Instruction Fuzzy Hash: CDF027B32082040BE728E7B89C92E7F77C8DB20354751A07AF91ED7151FA23ED14D25A

Uniqueness

Uniqueness Score: -1.00%

Function 00F4599B Relevance: 6.0, APIs: 4, Instructions: 37windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F459CB
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000004FF), ref: 00F459E4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: MessageMultipleObjectsPeekWait
String ID:
API String ID: 3986374578-0
Opcode ID: eb7309a7f0b1955f83b97b8db7b57fe50cce5cfbb18b351d6e918a6ae0c8dd0a
Instruction ID: 28fb92f034d360663b46f9f7c967f4e63cfb6543422aee118e5f090065fbd94e
Opcode Fuzzy Hash: eb7309a7f0b1955f83b97b8db7b57fe50cce5cfbb18b351d6e918a6ae0c8dd0a
Instruction Fuzzy Hash: 5FF0BDB294020EBFDF00AFE4DC89EBA77ACFB08755F408421FA15D6151D675D905AB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F333F0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F3341E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 901f6e5775b60f4b596ae9248164c26d9d70438d9510b4ebaee3e4f28b06b90a
Instruction ID: 914b3cd0f96b2437bab54edd69bb40b6205d23c3f2c0084853b9599c69cc4dee
Opcode Fuzzy Hash: 901f6e5775b60f4b596ae9248164c26d9d70438d9510b4ebaee3e4f28b06b90a
Instruction Fuzzy Hash: D2F0A7F2A041040A972DE778DC5792EBA889B24370F01443AF90EC7692F527EA54F15B

Uniqueness

Uniqueness Score: -1.00%

Function 00F51821 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00F51821
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00F51826
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00F5182B

Part of subcall function 00F51CCE: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00F51CDF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00F51840

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 0eee5113ad118f836d94d3046ddd1d69c662c15e477f19fc3b677e335823fb7f
Instruction ID: 67cab69079442af9b811a9acb70636ca666b1821b578b162b823d511a2b3bbe1
Opcode Fuzzy Hash: 0eee5113ad118f836d94d3046ddd1d69c662c15e477f19fc3b677e335823fb7f
Instruction Fuzzy Hash: 31C04824842AC0501E303AB12E533ED37943C6379BBD911C1BF6227203AE8E3C0EB472

Uniqueness

Uniqueness Score: -1.00%

Function 00F42862 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 00F42B58

Part of subcall function 00EB4A50: GetLastError.KERNEL32(33A37B94,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4A92
Part of subcall function 00EB4A50: SetLastError.KERNEL32(?,?,?,00FD1000,?,00F60FF9,000000FF,?,00EB23E3,?,00000000), ref: 00EB4AD1

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

__EH_prolog3_GS.LIBCMT ref: 00F4286C

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F417CE: __EH_prolog3_GS.LIBCMT ref: 00F417D8

Part of subcall function 00F424D4: __EH_prolog3_GS.LIBCMT ref: 00F424DE
Part of subcall function 00F424D4: GetModuleHandleW.KERNEL32(kernel32.dll,FindFirstFileW,00000254,00F418E0), ref: 00F424FA
Part of subcall function 00F424D4: GetProcAddress.KERNEL32(00000000), ref: 00F424FD

Strings

*.*, xrefs: 00F42BCE

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3_$FreeString$AddressCloseFindHandleModuleProc
String ID: *.*
API String ID: 2540153828-438819550
Opcode ID: 0c4fc5f03b9dfc0279466f58d8ad1c9216c8baa6abaff785461c370a7e8c8a4e
Instruction ID: 55a1bf61856a22478e79fcef071bfd33af33ff8d256d6bc6fb19b943081e133c
Opcode Fuzzy Hash: 0c4fc5f03b9dfc0279466f58d8ad1c9216c8baa6abaff785461c370a7e8c8a4e
Instruction Fuzzy Hash: E6D169B1D0021C9EEF21EF64CC95BEEBBB8AF15314F500199E808A7282DB719B85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F4B85C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00F4B866
std::_Xinvalid_argument.LIBCPMT ref: 00F4B8DE

Part of subcall function 00F3FB96: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F3FBA2
Part of subcall function 00F3FB96: __CxxThrowException@8.LIBVCRUNTIME ref: 00F3FBB0

Strings

vector<T> too long, xrefs: 00F4B8D9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Exception@8H_prolog3_catch_ThrowXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: vector<T> too long
API String ID: 3455652888-3788999226
Opcode ID: c74917d0e2abf29bb0eb5ca6f037b8a91bc44e26a30aff91d4645f4a7a33f4f7
Instruction ID: c9d7e38429892d9586d266feac6276379e6dbfe39cfcc95eca2ba28012d16ae2
Opcode Fuzzy Hash: c74917d0e2abf29bb0eb5ca6f037b8a91bc44e26a30aff91d4645f4a7a33f4f7
Instruction Fuzzy Hash: 49815DB2A001189FDF14DF68CD86B9EBBB9EF54310F148169F809AB246D774EA44DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EDCD60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EDCEA6
std::_Xinvalid_argument.LIBCPMT ref: 00EDCEB0

Part of subcall function 00EB4370: SysAllocStringLen.OLEAUT32(00000000,?), ref: 00EB43E8
Part of subcall function 00EB4370: SysFreeString.OLEAUT32(00000000), ref: 00EB4460

Strings

string too long, xrefs: 00EDCEA1, 00EDCEAB

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: StringXinvalid_argumentstd::_$AllocFree
String ID: string too long
API String ID: 2819953329-2556327735
Opcode ID: 19f0dcb6b5529869f9b13c1305d4c7b65694ad9286d3b104c6a3e3aebaef9251
Instruction ID: 3bd0478680aa49b095b06e5200c9df1bd28ee3cba79b9d80fdda718af6cb3e51
Opcode Fuzzy Hash: 19f0dcb6b5529869f9b13c1305d4c7b65694ad9286d3b104c6a3e3aebaef9251
Instruction Fuzzy Hash: 225103723142059BD724CF18EC80A7AB7EAEF85791B30192FE946D7740DB31AC02D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00F42E81 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42E88
CompareFileTime.KERNEL32(00000000,?,?,?,PSTORES.EXE,00000000,00000000,?,?,00000068,00F454C9,00F43D8D,?,?), ref: 00F43001

Strings

PSTORES.EXE, xrefs: 00F42FB4, 00F42FC1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CompareFileH_prolog3Time
String ID: PSTORES.EXE
API String ID: 2703394530-1209905799
Opcode ID: 5e96823891d12ae5c97639666b726176ffd901945818d97772d9aecf5c4574fc
Instruction ID: 70ad5645db82b4e4186f9ae36860549564eabdaca5ee424617ef18a843b6a52f
Opcode Fuzzy Hash: 5e96823891d12ae5c97639666b726176ffd901945818d97772d9aecf5c4574fc
Instruction Fuzzy Hash: FB514F72D002099FCF11DFE4C9819EEBFB8AF58310FA44565E911B7241DB34AE49EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00ED9570 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

RegCloseKey.ADVAPI32(00000000,80000002,?,00020019,?,00F9091C,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00000000,{00000000-0000-0000-0000-000000000000},?,00000000,33A37B94,00000000,?,00000000), ref: 00ED976C

Strings

{00000000-0000-0000-0000-000000000000}, xrefs: 00ED95E3
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00ED9673

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Close
String ID: Software\Microsoft\Windows\CurrentVersion\Uninstall${00000000-0000-0000-0000-000000000000}
API String ID: 2117561858-829741748
Opcode ID: c671d93d54b3cc10bf333ef4e27f7d4342ed2807ad8757226eb6e01bc4f22044
Instruction ID: 8ee3617d221e520b6e4a02e6f985babd7fd2e36d9af7b609cb8aa4e3f5940227
Opcode Fuzzy Hash: c671d93d54b3cc10bf333ef4e27f7d4342ed2807ad8757226eb6e01bc4f22044
Instruction Fuzzy Hash: DD615B71900258DEDB20DFA4CD94BDEFBB4FB04304F14859AD519B7282DB716A89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F18270 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F182E0

Part of subcall function 00F3FB96: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F3FBA2
Part of subcall function 00F3FB96: __CxxThrowException@8.LIBVCRUNTIME ref: 00F3FBB0

std::_Xinvalid_argument.LIBCPMT ref: 00F18366

Strings

vector<T> too long, xrefs: 00F182DB, 00F18361

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwstd::invalid_argument::invalid_argument
String ID: vector<T> too long
API String ID: 1284171080-3788999226
Opcode ID: 62353efd82872c96b5787b3a3ed87c7ea7753375a981bb18ae211eaf3b1786a5
Instruction ID: 69e786795962a74d5f9fa3e39b4e6879acb584e7cbef4108cadf224db5628a66
Opcode Fuzzy Hash: 62353efd82872c96b5787b3a3ed87c7ea7753375a981bb18ae211eaf3b1786a5
Instruction Fuzzy Hash: B941D571B046069FCB18CF29CA906ADBBE1FB58750F28C62DE456C7780DB71E881D780

Uniqueness

Uniqueness Score: -1.00%

Function 00F183E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F18450

Part of subcall function 00F3FB96: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F3FBA2
Part of subcall function 00F3FB96: __CxxThrowException@8.LIBVCRUNTIME ref: 00F3FBB0

std::_Xinvalid_argument.LIBCPMT ref: 00F184D6

Strings

vector<T> too long, xrefs: 00F1844B, 00F184D1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwstd::invalid_argument::invalid_argument
String ID: vector<T> too long
API String ID: 1284171080-3788999226
Opcode ID: 9f34ae9350b90d830dc51d0fabe9a57a3df9347e8a0b1943068975c7ad4d65c2
Instruction ID: 67d1b3d5f7b1cd80a9d7bcf82f89810bb8fc5ae6db17c6fbae12898863578799
Opcode Fuzzy Hash: 9f34ae9350b90d830dc51d0fabe9a57a3df9347e8a0b1943068975c7ad4d65c2
Instruction Fuzzy Hash: 8A4195717046069FCB18CF29CA946A9BBE6FB95360F24C62DE456C7780DB71E841D780

Uniqueness

Uniqueness Score: -1.00%

Function 00EFEEA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EFEF10

Part of subcall function 00F3FB96: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F3FBA2
Part of subcall function 00F3FB96: __CxxThrowException@8.LIBVCRUNTIME ref: 00F3FBB0

std::_Xinvalid_argument.LIBCPMT ref: 00EFEF96

Strings

vector<T> too long, xrefs: 00EFEF0B, 00EFEF91

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwstd::invalid_argument::invalid_argument
String ID: vector<T> too long
API String ID: 1284171080-3788999226
Opcode ID: 2ece35303588b69eb83f5a8ead8235d969af94fcc2beba05a49bf5969de01661
Instruction ID: e9f59a80fe39c7c501d57125cf2b63372b301a4821eee77c4e0df6c4085058db
Opcode Fuzzy Hash: 2ece35303588b69eb83f5a8ead8235d969af94fcc2beba05a49bf5969de01661
Instruction Fuzzy Hash: 3B41AF72B0460A9FCB18CF28C994669BBE1FB88310F24C66EE55AD7790C771F940C780

Uniqueness

Uniqueness Score: -1.00%

Function 00F46A22 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F46B41
__EH_prolog3_catch.LIBCMT ref: 00F46B4E

Strings

map/set<T> too long, xrefs: 00F46B3C

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: H_prolog3_catchXinvalid_argumentstd::_
String ID: map/set<T> too long
API String ID: 4202626062-1285458680
Opcode ID: 1e935035b6f9fdd901a557c709e37b6c16641cf65eca157511a76b08ae3920e4
Instruction ID: 2138a5e7df44cb217355e074f9f5fbd840810c7d3ce989d6f68e2f3b26b92e19
Opcode Fuzzy Hash: 1e935035b6f9fdd901a557c709e37b6c16641cf65eca157511a76b08ae3920e4
Instruction Fuzzy Hash: 5A511E306046409FDB15CF18C588B59BFE1AF4A328F19C498E849DB262C77AEC81EF52

Uniqueness

Uniqueness Score: -1.00%

Function 00F18550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F185BB

Part of subcall function 00F3FB96: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F3FBA2
Part of subcall function 00F3FB96: __CxxThrowException@8.LIBVCRUNTIME ref: 00F3FBB0

std::_Xinvalid_argument.LIBCPMT ref: 00F18633

Strings

vector<T> too long, xrefs: 00F185B6, 00F1862E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwstd::invalid_argument::invalid_argument
String ID: vector<T> too long
API String ID: 1284171080-3788999226
Opcode ID: 919208462271e6a667d8131da124ecd481f769a186482dc797c6109dc996d374
Instruction ID: 36060fedd5702938eed860e6574dec53fe4f6eb8a39ce317c07244e31e81483b
Opcode Fuzzy Hash: 919208462271e6a667d8131da124ecd481f769a186482dc797c6109dc996d374
Instruction Fuzzy Hash: 544197717006069FCB28CE29CED565ABBE2FB94760F24C63DE456C7784DA71E881D780

Uniqueness

Uniqueness Score: -1.00%

Function 00F186A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F1870B

Part of subcall function 00F3FB96: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F3FBA2
Part of subcall function 00F3FB96: __CxxThrowException@8.LIBVCRUNTIME ref: 00F3FBB0

std::_Xinvalid_argument.LIBCPMT ref: 00F18783

Strings

vector<T> too long, xrefs: 00F18706, 00F1877E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwstd::invalid_argument::invalid_argument
String ID: vector<T> too long
API String ID: 1284171080-3788999226
Opcode ID: 377e017cbc41a568ead04c488b38511b40896e756b69e8bc9f27fe0042a34749
Instruction ID: f30bd955e106e25ac254d2324a6ef807eca2064927a035fb4bff30d246faa88e
Opcode Fuzzy Hash: 377e017cbc41a568ead04c488b38511b40896e756b69e8bc9f27fe0042a34749
Instruction Fuzzy Hash: 5241A6757006069FCB28CF29CAD465ABBE2FB94760F24CA3DE456C77C4DA31E8819740

Uniqueness

Uniqueness Score: -1.00%

Function 00EB6520 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EB661B
std::_Xinvalid_argument.LIBCPMT ref: 00EB6625

Strings

vector<T> too long, xrefs: 00EB6616, 00EB6620

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 909987262-3788999226
Opcode ID: 46656312a14af3f7b312f32aeca08f2a22a6d46d3edcb5f8dfa237f04888d411
Instruction ID: f1757329eef30896726b0e655871169c6442c64f80c024c7775efe8a65e00c8d
Opcode Fuzzy Hash: 46656312a14af3f7b312f32aeca08f2a22a6d46d3edcb5f8dfa237f04888d411
Instruction Fuzzy Hash: D23191717016028FDB2C8E3DC9D546BB7D2FB94324728CA3DE587DB688DA75E8418A40

Uniqueness

Uniqueness Score: -1.00%

Function 00F07390 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F0747A
std::_Xinvalid_argument.LIBCPMT ref: 00F07484

Strings

vector<T> too long, xrefs: 00F07475, 00F0747F

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 909987262-3788999226
Opcode ID: 9bb34757cb60c85c44a8a35608b955e9a6c129814a6181cfae1ce72029c4395d
Instruction ID: 6f4d7d3f08d30d98aac3bcbc42a0ff0d13f4b7048414d97263d91d49f60f1874
Opcode Fuzzy Hash: 9bb34757cb60c85c44a8a35608b955e9a6c129814a6181cfae1ce72029c4395d
Instruction Fuzzy Hash: 0E31A235B14702CFCB2CEE3DC9D442EBB96AB94760324CA7DE956C76C4DA30F845A644

Uniqueness

Uniqueness Score: -1.00%

Function 00F0C010 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F0C0FD
std::_Xinvalid_argument.LIBCPMT ref: 00F0C107

Strings

vector<T> too long, xrefs: 00F0C0F8, 00F0C102

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 909987262-3788999226
Opcode ID: b958e6ef6e8d05660c561b6561bd9bfd403d7af89a9d93c2edf62f8e611e5769
Instruction ID: 78162b14023b6bec6d112d56324144c8f34d42156defc0959324036c1d55e6e7
Opcode Fuzzy Hash: b958e6ef6e8d05660c561b6561bd9bfd403d7af89a9d93c2edf62f8e611e5769
Instruction Fuzzy Hash: 5B3181717012068FCB2C9E7DCDD546AB7D6EB98320328CB3DE596CB684D671F840E680

Uniqueness

Uniqueness Score: -1.00%

Function 00F16F67 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00F16F6C

Part of subcall function 00F183E0: std::_Xinvalid_argument.LIBCPMT ref: 00F18450

Strings

J, xrefs: 00F16FA9
When, xrefs: 00F1702E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: J$When
API String ID: 909987262-2313060179
Opcode ID: add1661cbb7d2694d03dc559631780cf49bc30da95d8c0977a331ca78f929595
Instruction ID: 18f944cb5c7c638c296f8d6c4597f36af3d34900285608d8a80150da36bf6e78
Opcode Fuzzy Hash: add1661cbb7d2694d03dc559631780cf49bc30da95d8c0977a331ca78f929595
Instruction Fuzzy Hash: 73417971A00219DFDF25DF64C950BEAB7B1BF44314F5081A9E40EA7290DB35AE84EF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EC47A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EC48AC

Strings

RegistryProvider.cpp, xrefs: 00EC4882
Convert reg data: unsupported reg value type (%x), xrefs: 00EC4889

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: InitVariant
String ID: Convert reg data: unsupported reg value type (%x)$RegistryProvider.cpp
API String ID: 1927566239-2501269308
Opcode ID: c93cece29c327cff902b5d48485353cd61e060238895378ac2ed49d15803dd63
Instruction ID: 028e96037c180743c242562f6664483d767826a3f5812443a862c52a538ac7ed
Opcode Fuzzy Hash: c93cece29c327cff902b5d48485353cd61e060238895378ac2ed49d15803dd63
Instruction Fuzzy Hash: 804159B1A00249DFDB14DFA4C855BAEBBF4FF48704F10852EE806A7391D775AA05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F419C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00F419CD

Part of subcall function 00EBF530: new.LIBCMT ref: 00EBF581

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EBF630: new.LIBCMT ref: 00EBF65E

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Part of subcall function 00EBF330: GetLastError.KERNEL32(33A37B94,00000000), ref: 00EBF393
Part of subcall function 00EBF330: new.LIBCMT ref: 00EBF3A9

__CxxThrowException@8.LIBVCRUNTIME ref: 00F41A8C

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

Part of subcall function 00EBF940: FindCloseChangeNotification.KERNELBASE(?,33A37B94,74DEE010), ref: 00EBF9A0
Part of subcall function 00EBF940: __CxxThrowException@8.LIBVCRUNTIME ref: 00EBF9E9

Strings

, xrefs: 00F41A4A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$Exception@8FreeStringThrow$ChangeCloseExceptionFindH_prolog3_catch_NotificationRaise
String ID:
API String ID: 2271739304-3916222277
Opcode ID: 59277fc5d90efec1769a5aab00a3ed634f0700491101b2ed8209cdc76b41be51
Instruction ID: 6e7f512a6d6b816c29679d0a42c0b47a72fdc430f53e4f4a8f326f20faa23be8
Opcode Fuzzy Hash: 59277fc5d90efec1769a5aab00a3ed634f0700491101b2ed8209cdc76b41be51
Instruction Fuzzy Hash: 94417274C10258EAEF10EBA4DC95FDEBBB4AF10304F445099E90977283EBB45B48EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EE64A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EE652D
std::_Xinvalid_argument.LIBCPMT ref: 00EE6537

Part of subcall function 00EB4370: SysAllocStringLen.OLEAUT32(00000000,?), ref: 00EB43E8
Part of subcall function 00EB4370: SysFreeString.OLEAUT32(00000000), ref: 00EB4460

Strings

string too long, xrefs: 00EE6528, 00EE6532

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: StringXinvalid_argumentstd::_$AllocFree
String ID: string too long
API String ID: 2819953329-2556327735
Opcode ID: f344b34f58105a5436e499d820aba3b6501d3ee0b46e4ecee64e9b0228f2aca9
Instruction ID: 894e43b2a3b4e00bfc1150bfd7848b07b9a51d1e518045ca016ab0d1c6e6f108
Opcode Fuzzy Hash: f344b34f58105a5436e499d820aba3b6501d3ee0b46e4ecee64e9b0228f2aca9
Instruction Fuzzy Hash: 952105323047489BCB309F99E801A1AF7F5FB95B71F000A2FE556D7690DB32E4088796

Uniqueness

Uniqueness Score: -1.00%

Function 00EFC780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(00000294,33A37B94), ref: 00EFC7CA

Strings

UWPIsTypePresent: unsupported platform (minimum required Windows 8.x), condition evaluated as false, xrefs: 00EFC82C
Condition.cpp, xrefs: 00EFC807

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Version
String ID: Condition.cpp$UWPIsTypePresent: unsupported platform (minimum required Windows 8.x), condition evaluated as false
API String ID: 1889659487-4227069442
Opcode ID: 56154a9b442426756e4c69bae022894c59cbdd1354f6c0de4eab64f8c2975ea5
Instruction ID: 1ec8356a94d14d96bd7ffa596a4cd30fed69411c3ae6b9268959a2b224735302
Opcode Fuzzy Hash: 56154a9b442426756e4c69bae022894c59cbdd1354f6c0de4eab64f8c2975ea5
Instruction Fuzzy Hash: 3341157090528CDEEB14EF64EC457EDBBB1FB01308F28022AE0016B2D2D7B42945DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4266B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F42672

Part of subcall function 00EE5F80: GetLastError.KERNEL32(0000003C,00000000,33A37B94,0000003C,00000000,00000000), ref: 00EE5FEC
Part of subcall function 00EE5F80: SetLastError.KERNEL32(00F908E8), ref: 00EE602A

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F447D0: __EH_prolog3_GS.LIBCMT ref: 00F447D7

Strings

.EXE, xrefs: 00F4268F
SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00F426F4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$H_prolog3_
String ID: .EXE$SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 3339191932-4260402741
Opcode ID: 6bdb74a585e5ab53d974e471a4b0c193dae4b15e233ae0a662fb5542768d0c4f
Instruction ID: b6447085d50377a85eeff9dae614d228a631b2a380dc900ccad68e27c4aada01
Opcode Fuzzy Hash: 6bdb74a585e5ab53d974e471a4b0c193dae4b15e233ae0a662fb5542768d0c4f
Instruction Fuzzy Hash: 5721D3B4D01208AEDB10FF64CC86ADEBFA8EF05300F10005DF8086B382D7759646DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F12C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F12C9A
VariantClear.OLEAUT32(?), ref: 00F12D1C

Strings

Failed to convert string to safe array, error %x, xrefs: 00F12CC1

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Failed to convert string to safe array, error %x
API String ID: 2610073882-4186055195
Opcode ID: 0459fa450cfe676800175dae5d77f8aaadec52888f597cf146593b739911c7c2
Instruction ID: 12028ba2e45f88fd42b3f7ac4ccb7409683f2f150210a4518366fc1a42977aac
Opcode Fuzzy Hash: 0459fa450cfe676800175dae5d77f8aaadec52888f597cf146593b739911c7c2
Instruction Fuzzy Hash: 8421EEB5D002099FCB44DFA8C945ADEBBF8FB08314F10466AE815E7341E775AA05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBE380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

true, xrefs: 00EBE3F3, 00EBE405
false, xrefs: 00EBE3E7

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID:
String ID: false$true
API String ID: 0-2658103896
Opcode ID: 281bcee4a1e92a08c078c64c882bed0c699cd53ea2706ecb059a46063a9d31e3
Instruction ID: 6aef53dd64ad8b412ceb91353b74145491437c4d34d7637320d6693a30fbe47f
Opcode Fuzzy Hash: 281bcee4a1e92a08c078c64c882bed0c699cd53ea2706ecb059a46063a9d31e3
Instruction Fuzzy Hash: 23217A71A00208DFCB14DF94C884BEEBBB9FF08714F50422DE826A7390DB749945DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F459F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 00F45A7D
SetEvent.KERNEL32(00000046), ref: 00F45A8C

Strings

d, xrefs: 00F45A09

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: Event
String ID: d
API String ID: 4201588131-2564639436
Opcode ID: a7d92322d6a1e7f5bb8d3a6237b1c40e50035dc4d1ccfd63e749076695cb9b5d
Instruction ID: c773a3106bd7281eb15ca6acfa990c33719f9ac6c8dff8fd11a0c282743a9c2e
Opcode Fuzzy Hash: a7d92322d6a1e7f5bb8d3a6237b1c40e50035dc4d1ccfd63e749076695cb9b5d
Instruction Fuzzy Hash: 6C213B71500A09DFCB24DF54D884B667BF4FF09725F20865AF9068B261C775E851EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F1105F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F11074

Part of subcall function 00F4E44A: RaiseException.KERNEL32(?,?,00F3FBB5,?,?,00000000,?,?,?,?,?,00F3FBB5,?,00FCBE10,?), ref: 00F4E4A9

Strings

End transaction result: %x, xrefs: 00F11086
Transaction.cpp, xrefs: 00F11139, 00F1113A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: End transaction result: %x$Transaction.cpp
API String ID: 3976011213-34192366
Opcode ID: 9e2a30d3129bc008c0698bb101d3b20cd2c4cfcfd2a7acc6e0c0983dd4492795
Instruction ID: 223c3643f25b66bdea5996c00067999cf39bc7cdd6f308830141f4f98b97bc98
Opcode Fuzzy Hash: 9e2a30d3129bc008c0698bb101d3b20cd2c4cfcfd2a7acc6e0c0983dd4492795
Instruction Fuzzy Hash: 78F09C71A00108AAEB20EB949C42BADBB74FB44710F104269FA19B62D2DB7519446B15

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F9C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00EEC310: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,00F3F9F2,?,?,?,00EB23C3), ref: 00EEC315
Part of subcall function 00EEC310: GetLastError.KERNEL32(?,?,?,00EB23C3), ref: 00EEC31F

IsDebuggerPresent.KERNEL32(?,?,?,00EB23C3), ref: 00F3F9F6
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00EB23C3), ref: 00F3FA05

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F3FA00

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 652f8816a12c3dec12f471e25dc24a5a7547e92cbdf61ec386f9b95fb053029a
Instruction ID: 5ad7ae16a0611993baa008ee87343cc645a26c6a0911e2381c034c82a2561d16
Opcode Fuzzy Hash: 652f8816a12c3dec12f471e25dc24a5a7547e92cbdf61ec386f9b95fb053029a
Instruction Fuzzy Hash: 63E09270A013918FDB20AF38E8057827BE4AF04354F048D6DE459DB740FBB8E448AB51

Uniqueness

Uniqueness Score: -1.00%

Function 00ED84D0 Relevance: 5.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32(00FD21B8,00000000,33A37B94,74DEE010,00000000), ref: 00ED85BE
SetLastError.KERNEL32(00F908E8), ref: 00ED8604
GetLastError.KERNEL32 ref: 00ED8618
SetLastError.KERNEL32(00F908E8), ref: 00ED865E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1711225aeffe189acc0bddc42431f1f775b054f16ecbb93c13f2a5275f589cd8
Instruction ID: f21b1dca194ad04a98f708c208fa202cd464980bfee6a86368c6e26be7eca1c2
Opcode Fuzzy Hash: 1711225aeffe189acc0bddc42431f1f775b054f16ecbb93c13f2a5275f589cd8
Instruction Fuzzy Hash: 1681F3B0D0529CDEEB51CFA8C958BDDBBF4AB14308F2041AAD408A7282D7B55B48DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00ED4E20 Relevance: 5.1, APIs: 4, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

GetLastError.KERNEL32(00000000,00000000,33A37B94,?,00000000), ref: 00ED4EAE
SetLastError.KERNEL32(00F908E8), ref: 00ED4EF4
GetLastError.KERNEL32 ref: 00ED4F08
SetLastError.KERNEL32(00F908E8), ref: 00ED4F4E

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4a04e597f435252ffa45bca524c96008a45098d234e52e546d8c01c89d18957e
Instruction ID: db6e191bde2cfd6febd0ace0a427cc631c5d505f7da75da3fbcb4bd4ebb86a6b
Opcode Fuzzy Hash: 4a04e597f435252ffa45bca524c96008a45098d234e52e546d8c01c89d18957e
Instruction Fuzzy Hash: 2B6136B1D0425CDFDB10DFA8D948BDDBBF0AB18304F2481AAD444BB282DBB56A49DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EB70D0 Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,33A37B94), ref: 00EB7151
SetLastError.KERNEL32(00F908E8,?,00000000,33A37B94), ref: 00EB719B
GetLastError.KERNEL32(?,00000000,33A37B94), ref: 00EB71B3
SetLastError.KERNEL32(00F908E8,?,00000000,33A37B94), ref: 00EB71FD

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 842ed22663bd3d01c2b8ff32ee87f482952cc43bba4c4bc66c1c8e051e93f287
Instruction ID: e3490413a540c1e85e1267beb8a1c4098bea520e8b60f0be1f876b7dbfe5e6c7
Opcode Fuzzy Hash: 842ed22663bd3d01c2b8ff32ee87f482952cc43bba4c4bc66c1c8e051e93f287
Instruction Fuzzy Hash: 1C5127B0D04248DEDF50CFA8C998BEEBBF4AF04308F248199E455B7292D7759A48DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EBB1D0 Relevance: 5.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00EBB21F
SetLastError.KERNEL32(00F908E8), ref: 00EBB272
GetLastError.KERNEL32 ref: 00EBB289
SetLastError.KERNEL32(00F908E8), ref: 00EBB2D3

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: dd39f0da0dc9c094007d10852f44d0441da53f36ccb21f119ae9a03a26b5b9ec
Instruction ID: 51b776eec06954f63f443afa70fa98899d848222fe6252af93b7e25dd2001c08
Opcode Fuzzy Hash: dd39f0da0dc9c094007d10852f44d0441da53f36ccb21f119ae9a03a26b5b9ec
Instruction Fuzzy Hash: 0351E4B1D04258DFDB50CFA8C948BDEBBF4AF08304F1481A9E405AB292D7B59A04DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F040D0 Relevance: 5.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94), ref: 00F0411E
SetLastError.KERNEL32(00F908E8), ref: 00F0416B
GetLastError.KERNEL32 ref: 00F04186
SetLastError.KERNEL32(00F908E8), ref: 00F041D0

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f5a0929b6df6a983344485e07158eb0151ed0f1f06f0889a7f80e1a380220500
Instruction ID: 9d62563f9518b54a6c3cffa5c87a1b78234dd8b41df4235f89984998f1ccfacf
Opcode Fuzzy Hash: f5a0929b6df6a983344485e07158eb0151ed0f1f06f0889a7f80e1a380220500
Instruction Fuzzy Hash: AE41E1B1D04288EFDF10DFA8D948BDEBBB4FB08314F14816AE414A7292D7756A09DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC65F0 Relevance: 5.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,00F9091C,00000000), ref: 00EC663C
SetLastError.KERNEL32(00F908E8), ref: 00EC668F
GetLastError.KERNEL32 ref: 00EC66A6
SetLastError.KERNEL32(00F908E8), ref: 00EC66F0

Part of subcall function 00EB6F90: GetLastError.KERNEL32(33A37B94,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB6FD2
Part of subcall function 00EB6F90: SetLastError.KERNEL32(?,33A37B94,00000000,000000FF,?,?,?,?,00F60FF9,000000FF,?,00EB4F40), ref: 00EB7034

Part of subcall function 00EB4BE0: GetLastError.KERNEL32(33A37B94,?,?,33A37B94,?,00F61069,000000FF,?,00EB2A81,33A37B94), ref: 00EB4C1B
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(?), ref: 00EB4C35
Part of subcall function 00EB4BE0: SysFreeString.OLEAUT32(33A37B98), ref: 00EB4C4A
Part of subcall function 00EB4BE0: SetLastError.KERNEL32(?,?,?,?,?,?,000000FF), ref: 00EB4C7A

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast$FreeString
String ID:
API String ID: 2425351278-0
Opcode ID: bdafc4c20b9b2b8832772bde4daaaa8fc6f9f79385ec5af797323db1a2919618
Instruction ID: 79b010691280f1c7adbee6c2fce34f412793b78f74fa2ada3391f0cd847c7d41
Opcode Fuzzy Hash: bdafc4c20b9b2b8832772bde4daaaa8fc6f9f79385ec5af797323db1a2919618
Instruction Fuzzy Hash: 0541C1B0D04298DEEB50DFE8D9487DEBBF4AB08308F248169D404AB292D7B55A08DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F11360 Relevance: 5.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F113DF
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11421
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F1143D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00F11479

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f86500089e5eb4ddc4798dbcffe8fdbf38337de04265a873aa121005f553b63c
Instruction ID: 79b5f2ae0f3f11dc3580ece700c196f314cb074d1c2553f20d677fddaf3b87dd
Opcode Fuzzy Hash: f86500089e5eb4ddc4798dbcffe8fdbf38337de04265a873aa121005f553b63c
Instruction Fuzzy Hash: BF4108B0805744DFDB20CFA9C54874ABBF0FF08318F10869DD4899B792D7B5A608DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFCF80 Relevance: 5.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32 ref: 00EFD00F
SetLastError.KERNEL32(?), ref: 00EFD051
GetLastError.KERNEL32 ref: 00EFD06D
SetLastError.KERNEL32(?), ref: 00EFD0A9

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: fa34719d273fb507d995877a126ae67bbb4d4541720cfebcade806e894ffb424
Instruction ID: 3ef74738b8bb5c1a0f93c9ee411576336a0b713e8bafe8f1cedec69550667a4d
Opcode Fuzzy Hash: fa34719d273fb507d995877a126ae67bbb4d4541720cfebcade806e894ffb424
Instruction Fuzzy Hash: 884103B1905788DFDB20CFA9CA4874ABBF0FB08714F10869DD48997752D3B5A604DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD210 Relevance: 5.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00F0D230: new.LIBCMT ref: 00F0D25D

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13,000000FF), ref: 00EFD29F
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13), ref: 00EFD2E1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13,000000FF), ref: 00EFD2FD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F73A13), ref: 00EFD339

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 098f8611dd141ea49ca0e125093748fd4940a98cd45f0cdbf17b6671c3f8c1a9
Instruction ID: 0a6ec947499f49d52dc75ced86287adc1ba67f378eae9aad5a4890f02a518d42
Opcode Fuzzy Hash: 098f8611dd141ea49ca0e125093748fd4940a98cd45f0cdbf17b6671c3f8c1a9
Instruction Fuzzy Hash: 314114B1905744DFDB20CFA9C94874ABBF0FF08314F10865DD489AB752D3B5AA04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F115E0 Relevance: 5.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00EC5220: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC525C
Part of subcall function 00EC5220: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC529B

GetLastError.KERNEL32 ref: 00F11635
SetLastError.KERNEL32(?), ref: 00F11677
GetLastError.KERNEL32 ref: 00F11697
SetLastError.KERNEL32(?), ref: 00F116D3

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 81539fc3c7c4773a57eb88042360af3f340d2cb003c8e4e52b9a23b2841e7e96
Instruction ID: df5bea9ab077e842fefb2d98045ddd9a7a4f81c9e7dc46d822c9ff9549351ee0
Opcode Fuzzy Hash: 81539fc3c7c4773a57eb88042360af3f340d2cb003c8e4e52b9a23b2841e7e96
Instruction Fuzzy Hash: 764178B1905784DFD720CFA9C948B4ABBF0FF08314F10869DD48997752D3B5AA04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC5580 Relevance: 5.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00EC5220: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC525C
Part of subcall function 00EC5220: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EC529B

GetLastError.KERNEL32 ref: 00EC55D5
SetLastError.KERNEL32(?), ref: 00EC5617
GetLastError.KERNEL32 ref: 00EC5637
SetLastError.KERNEL32(?), ref: 00EC5673

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ddc0be0dfd1b11978adfa7ff99e4293afcb82bb46fd177960c9b128a69ccc118
Instruction ID: a79ce93ee84220ad3e82b29e47efe6c39220b4ad55e2cf644f17af1aa43390b4
Opcode Fuzzy Hash: ddc0be0dfd1b11978adfa7ff99e4293afcb82bb46fd177960c9b128a69ccc118
Instruction Fuzzy Hash: 294177B0905B84DFD720CFA9C948B4ABBF0FF08314F108A9DD48997752D3B5AA04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF13E0 Relevance: 5.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(33A37B94,0000001F,?), ref: 00EF1433
SetLastError.KERNEL32(?), ref: 00EF146F
GetLastError.KERNEL32 ref: 00EF148F
SetLastError.KERNEL32(?), ref: 00EF14CB

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 684c15df9864604f8f7b28a56a114618867869c11d74077780a44a03bad60a6e
Instruction ID: 8f084fd5414a87a7539bceb52e13659a8ae2599a50dd2e3f575eddd9bdd50071
Opcode Fuzzy Hash: 684c15df9864604f8f7b28a56a114618867869c11d74077780a44a03bad60a6e
Instruction Fuzzy Hash: EC3112B0905B88DFDB20CF69C90874ABBF0BF08714F10869DD48997762D7B5AA08DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE6AC0 Relevance: 5.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000FF), ref: 00EE6AFC
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 00EE6B3B
GetLastError.KERNEL32 ref: 00EE6B68
SetLastError.KERNEL32(?), ref: 00EE6BA4

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5c9a110d958352256c800e56610aa46f43b25cdf06bff79a1b31241167a42816
Instruction ID: 52376f7eee09718896116f9f1dd42277a455b960180de9db62c4b4d4dcbb85c5
Opcode Fuzzy Hash: 5c9a110d958352256c800e56610aa46f43b25cdf06bff79a1b31241167a42816
Instruction Fuzzy Hash: EA3130B0905A89EFD750CF69CA4878ABBF0FF08718F10825AD449D3B92D7B4A614DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F466CA Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F466AF,?,?,?), ref: 00F466D0
GetLastError.KERNEL32(?,?,00F466AF,?,?,?), ref: 00F466DA
SetLastError.KERNEL32(00000000,?,?,00F466AF,?,?,?), ref: 00F4671C
SetLastError.KERNEL32(00000000,?,?,00F466AF,?,?,?), ref: 00F46726

Memory Dump Source

Source File: 00000000.00000002.2923630768.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2923602041.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923769646.0000000000F86000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923820515.0000000000FD1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923845677.0000000000FD3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923867936.0000000000FD6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923887658.0000000000FD8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2923916130.0000000000FDA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_WebSigner_SuiteMSI_Barclays.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: d5e3782de293703eeb44ad2263b8c792ae20fd71b8a743d176d24da5ffe146da
Instruction ID: b6477faf239f6235a3c69e8f70940448f779fbd4b6419248642181cac988fbbc
Opcode Fuzzy Hash: d5e3782de293703eeb44ad2263b8c792ae20fd71b8a743d176d24da5ffe146da
Instruction Fuzzy Hash: 01F0543050064897DF312F11DC4D7AD7F59EB16B6DF105415FC45C51A2CB798891F752

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WebSigner_SuiteMSI_Barclays.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\1reader.bmp

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\40LE.bmp

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Application.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Custom.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\EzioBLE.bmp

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Folder.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\GBDM.rtf

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISBEW64.exe

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISLogoBig.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISLogoSmall.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISRT.dll

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\ISSetup.dll

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Remove.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Repair.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup.inx

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.dll

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Setup_UI.xml

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Typical.png

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\Xmessage.exe

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\_is24E1

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\addExtension.bmp

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\eula.rtf

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\extensionOK.bmp

C:\Users\user\AppData\Local\Temp\{D29D5C03-D231-4280-AB2D-8B995FA7ABB9}\gemalto48.png

Windows Analysis Report
WebSigner_SuiteMSI_Barclays.exe

Function 00F43200 Relevance: 12.2, APIs: 8, Instructions: 244
memoryCOMMON

Function 00EEEB40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146
fileCOMMON

Function 00F49DF3 Relevance: 19.6, APIs: 13, Instructions: 140
threadmemoryCOMMON

Function 00EEED70 Relevance: 16.7, APIs: 11, Instructions: 180
fileCOMMON

Function 00F43A91 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 258
processCOMMON

Function 00F415C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 40
libraryloaderCOMMON