Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe
Analysis ID:	1428927
MD5:	61769dd2942b6894e7dbd5f8af9e037a
SHA1:	c21221da05db3fd0786a2f2d8b27233df3afc446
SHA256:	38b55c3dcefd3f1d1c21c52d0f150c11010158377afabc8684d55afa1be7e62e
Tags:	exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to read the clipboard data

Detected potential crypto function

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe (PID: 4812 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe" MD5: 61769DD2942B6894E7DBD5F8AF9E037A)

conhost.exe (PID: 1340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

ReversingLabs: Detection: 31%

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe, 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_40d50803-a

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Fortn\Desktop\v4\remade\build\husXveru.pdb source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://scripts.sil.org/OFL
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://scripts.sil.org/OFLCopyright
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://scripts.sil.org/OFLProza
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://www.houseindustries.com/license
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://www.houseindustries.com/licenseBurbank
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://www.houseindustries.com/licenseCopyright
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: http://www.houseindustries.comhttp://www.talleming.comHouse
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: https://github.com/ThomasJockin/lexend)Lexend
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: https://github.com/cadsondemak/kanit)
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&o
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: https://scripts.sil.org/OFLThis
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: https://scripts.sil.org/OFLhttps://indiantypefoundry.comNinad
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	String found in binary or memory: https://scripts.sil.org/OFLhttps://www.katatrad.comhttps://cadsondemak.comKatatrad

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Code function: 0_2_00007FF68513CBB0 OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

0_2_00007FF68513CBB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Code function: 0_2_00007FF68513CBB0 OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

0_2_00007FF68513CBB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF685147260	0_2_00007FF685147260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF685168E70	0_2_00007FF685168E70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF6851406D4	0_2_00007FF6851406D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF685153170	0_2_00007FF685153170
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF68516A9C0	0_2_00007FF68516A9C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF68513CE20	0_2_00007FF68513CE20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF685141E00	0_2_00007FF685141E00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF685141200	0_2_00007FF685141200
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF6851508A0	0_2_00007FF6851508A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF6851310F0	0_2_00007FF6851310F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF6851464F0	0_2_00007FF6851464F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF68514B530	0_2_00007FF68514B530
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF68513CF40	0_2_00007FF68513CF40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Code function: 0_2_00007FF6851343F0	0_2_00007FF6851343F0

Source: classification engine

Classification label: mal56.winEXE@2/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1340:120:WilError_03

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

ReversingLabs: Detection: 31%

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

String found in binary or memory: kernel32LoadLibraryExA\/AddDllDirectory

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: d3dx11_43.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: d3dcompiler_43.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Section loaded: dxgi.dll	Jump to behavior

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static file information: File size 3709440 > 1048576

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x2d4c00

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\Fortn\Desktop\v4\remade\build\husXveru.pdb source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Static PE information: section name: _RDATA

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Code function: 0_2_00007FF6851BD354 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6851BD354

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Code function: 0_2_00007FF6851BD354 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6851BD354

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Code function: 0_2_00007FF6851BC154 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00007FF6851BC154

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Code function: 0_2_00007FF6851BD1B0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6851BD1B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	32%	ReversingLabs	Win64.Trojan.Generic
SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	100%	Avira	HEUR/AGEN.1315606

Name	Source	Malicious	Reputation
http://www.houseindustries.com/licenseBurbank	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	unknown
https://scripts.sil.org/OFLThis	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
http://www.houseindustries.comhttp://www.talleming.comHouse	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	unknown
http://www.houseindustries.com/licenseCopyright	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	unknown
https://scripts.sil.org/OFLhttps://www.katatrad.comhttps://cadsondemak.comKatatrad	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
https://github.com/ThomasJockin/lexend)Lexend	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
http://scripts.sil.org/OFLCopyright	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
http://scripts.sil.org/OFLProza	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
https://scripts.sil.org/OFLhttps://indiantypefoundry.comNinad	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
http://scripts.sil.org/OFL	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
https://github.com/cadsondemak/kanit)	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
https://curl.haxx.se/docs/http-cookies.html	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
https://github.com/itfoundry/Poppins)&&&&o	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	high
http://www.houseindustries.com/license	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428927
Start date and time:	2024-04-19 21:27:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe
Detection:	MAL
Classification:	mal56.winEXE@2/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe, PID 4812 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.626648756676915
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe
File size:	3'709'440 bytes
MD5:	61769dd2942b6894e7dbd5f8af9e037a
SHA1:	c21221da05db3fd0786a2f2d8b27233df3afc446
SHA256:	38b55c3dcefd3f1d1c21c52d0f150c11010158377afabc8684d55afa1be7e62e
SHA512:	f27bec6545e81600c50aaac5f24a62bb0b1a885998c842060fa46e91f15ed673ccaca11573ca096dda19af564b69f854820957ffe7c5e08c5801ea442f4d6c7d
SSDEEP:	49152:0BByWEq0jznJzco6QdasS+ZPCgeV6FZUFMOVr5SOlzddrI2Ye6XxOHGK5TxqYJ8a:Ft9XC2FZtOZ5SWdd1R6Ym8q3
TLSH:	E5060207F791468DE637683CC6A69323F7B1F821172183CB93994979EE8B5E48E36341
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......Z..k...8...8...8...8...8./j8...8./.9...8./.9...8./.98..8./.9...8...9w..8...9...8...9...8...8...8U..9=..8...8...8.,.9...8.,.9...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14008c138
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x661BEE50 [Sun Apr 14 14:55:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ad831b4bf551303dc56cd6637b65dcf9

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE12152AFE4h
dec eax
add esp, 28h
jmp 00007FE121529DE7h
int3
int3
jmp 00007FE12152B2BAh
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00002FF3h]
dec eax
mov ecx, ebx
call dword ptr [00002FF2h]
call dword ptr [00003024h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00002FC8h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00002FACh]
test eax, eax
je 00007FE121529F79h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [002F8592h]
call 00007FE12152A13Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [002F8679h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [002F8609h], eax
dec eax
mov eax, dword ptr [002F8662h]
dec eax
mov dword ptr [002F84D3h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [002F85D7h], eax
mov dword ptr [002F84ADh], C0000409h
mov dword ptr [002F84A7h], 00000001h
mov dword ptr [000000B1h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac828	0x21c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x385000	0x60d8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x38e000	0xc94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa34f0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa3580	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa33b0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0xa18	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8db2c	0x8dc00	d9c2a5f878db5a897c58767713c2c3ec	False	0.5324831900352733	data	6.500298258635886	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x1f9f4	0x1fa00	a1e8aa048634d17c4365c8e4b94144d6	False	0.4442857583992095	data	5.903448855136923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xaf000	0x2d5cb0	0x2d4c00	bd358e984368a84eebfc18939197d2c0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x385000	0x60d8	0x6200	b2e3c5294d26e421a36ef5e7ce10e5e1	False	0.4799107142857143	data	5.87624813676978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x38c000	0x1d0	0x200	90c1a4c095bdcd0bd7c466f09ff97faa	False	0.37890625	data	4.523192804901079	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x38d000	0x1e8	0x200	c45cc2d052ec22895e96ad08870cbdfa	False	0.54296875	data	4.768131151703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x38e000	0xc94	0xe00	ae8f4f58829fa82915c9a2096247335b	False	0.3125	data	5.18554868628415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x38d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
ntdll.dll	RtlLookupFunctionEntry, RtlVirtualUnwind, RtlCaptureContext, VerSetConditionMask
d3dx11_43.dll	D3DX11CreateShaderResourceViewFromMemory
KERNEL32.dll	OutputDebugStringW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, SleepConditionVariableSRW, WakeAllConditionVariable, SetConsoleTitleA, GetLastError, InitializeCriticalSectionEx, DeleteCriticalSection, GetCurrentProcess, GlobalUnlock, GlobalLock, GlobalFree, MultiByteToWideChar, WideCharToMultiByte, QueryPerformanceCounter, QueryPerformanceFrequency, FreeLibrary, CreateToolhelp32Snapshot, GetProcAddress, LoadLibraryA, CreateFileW, ReadFile, CloseHandle, GetModuleHandleW, SetLastError, FormatMessageA, lstrcmpiA, EnterCriticalSection, LeaveCriticalSection, SleepEx, GetSystemDirectoryA, VerifyVersionInfoA, GetTickCount, MoveFileExA, WaitForSingleObjectEx, GetEnvironmentVariableA, GetStdHandle, GetFileType, PeekNamedPipe, DeviceIoControl, Sleep, ExitProcess, WaitForMultipleObjects, CreateFileA, GetFileSizeEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, CreateThread, Process32First, Process32Next, GetModuleHandleA, GlobalAlloc
USER32.dll	GetCursorPos, TranslateMessage, DispatchMessageA, DestroyWindow, SendInput, GetSystemMetrics, LoadCursorA, ScreenToClient, MessageBoxA, GetWindowLongA, SetCursorPos, GetClientRect, ClientToScreen, GetForegroundWindow, GetKeyState, EmptyClipboard, GetClipboardData, SetClipboardData, CloseClipboard, OpenClipboard, SetCursor
d3d11.dll	D3D11CreateDeviceAndSwapChain
MSVCP140.dll	?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?width@ios_base@std@@QEAA_J_J@Z, ?width@ios_base@std@@QEBA_JXZ, ?flags@ios_base@std@@QEBAHXZ, ?good@ios_base@std@@QEBA_NXZ, ?_Throw_Cpp_error@std@@YAXH@Z, _Cnd_do_broadcast_at_thread_exit, _Thrd_id, _Thrd_join, _Thrd_detach, _Query_perf_frequency, _Query_perf_counter, ?uncaught_exceptions@std@@YAHXZ, ?_Xlength_error@std@@YAXPEBD@Z
IMM32.dll	ImmReleaseContext, ImmSetCandidateWindow, ImmGetContext, ImmSetCompositionWindow
D3DCOMPILER_43.dll	D3DCompile
dwmapi.dll	DwmExtendFrameIntoClientArea
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertFindCertificateInStore, CertFreeCertificateContext, CryptStringToBinaryA, PFXImportCertStore, CertOpenStore, CertCloseStore, CryptDecodeObjectEx, CertAddCertificateContextToStore, CertFindExtension, CertGetNameStringA, CryptQueryObject, CertCreateCertificateChainEngine, CertFreeCertificateChainEngine, CertGetCertificateChain, CertFreeCertificateChain, CertEnumCertificatesInStore
WS2_32.dll	setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, closesocket, socket, WSASetLastError, WSAIoctl, WSAStartup, ntohl, WSACleanup, accept, htonl, listen, ioctlsocket, __WSAFDIsSet, select, getaddrinfo, freeaddrinfo, recvfrom, sendto, gethostname, recv
VCRUNTIME140.dll	__current_exception, __current_exception_context, strrchr, __C_specific_handler, memcmp, strchr, memchr, strstr, __std_terminate, memset, memmove, memcpy, __std_exception_copy, _CxxThrowException, __std_exception_destroy
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	system, _initialize_onexit_table, exit, _errno, _initialize_narrow_environment, terminate, _getpid, _beginthreadex, _register_onexit_function, _register_thread_local_exe_atexit_callback, _c_exit, __p___argv, __p___argc, _exit, _initterm_e, _initterm, _get_initial_narrow_environment, _set_app_type, _seh_filter_exe, _cexit, _configure_narrow_argv, strerror, __sys_nerr, _invalid_parameter_noinfo_noreturn, _crt_atexit
api-ms-win-crt-heap-l1-1-0.dll	calloc, free, malloc, realloc, _callnewh, _set_new_mode
api-ms-win-crt-string-l1-1-0.dll	strcspn, strpbrk, strspn, _strdup, isupper, strcmp, strncmp, tolower, strncpy
api-ms-win-crt-stdio-l1-1-0.dll	_wfopen, fclose, fflush, fread, fseek, __acrt_iob_func, fopen, _open, _close, _write, _read, ftell, __p__commode, _set_fmode, fwrite, __stdio_common_vfprintf, __stdio_common_vsprintf, __stdio_common_vsscanf, __stdio_common_vsnprintf_s, fgets, fputc, fputs, feof, _lseeki64
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-math-l1-1-0.dll	sinf, __setusermatherr, acosf, ceilf, cos, tanf, cosf, logf, pow, powf, sin, atan2, asin, sqrtf, log
api-ms-win-crt-convert-l1-1-0.dll	atoi, strtol, strtoll, strtoul, atof
api-ms-win-crt-filesystem-l1-1-0.dll	_fstat64, _stat64, _access, _unlink
api-ms-win-crt-time-l1-1-0.dll	_gmtime64, _time64
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
ADVAPI32.dll	CryptEncrypt, CryptDestroyKey, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGenRandom, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextA, CryptImportKey

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	21:27:59
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe"
Imagebase:	0x7ff685130000
File size:	3'709'440 bytes
MD5 hash:	61769DD2942B6894E7DBD5F8AF9E037A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	21:28:00
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FF68513CBB0 Relevance: 12.1, APIs: 8, Instructions: 83clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF68513CBFE
GetClipboardData.USER32 ref: 00007FF68513CC1D
CloseClipboard.USER32 ref: 00007FF68513CC2B
GlobalLock.KERNEL32 ref: 00007FF68513CC49
WideCharToMultiByte.KERNEL32 ref: 00007FF68513CC80
WideCharToMultiByte.KERNEL32 ref: 00007FF68513CCC0
GlobalUnlock.KERNEL32 ref: 00007FF68513CCCE
CloseClipboard.USER32 ref: 00007FF68513CCD4

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: Clipboard$ByteCharCloseGlobalMultiWide$DataLockOpenUnlock
String ID:
API String ID: 846020896-0
Opcode ID: f6423e5e97fd8ff2db5e71278bd4fd456674588dcff91b7da4b7babcf07aa635
Instruction ID: c654c67fa465d0704fb5abf0724b3f49f1a9fab16b0d65963be3af8fb4fc3759
Opcode Fuzzy Hash: f6423e5e97fd8ff2db5e71278bd4fd456674588dcff91b7da4b7babcf07aa635
Instruction Fuzzy Hash: 48315E36A18B81C2E7249F66E85406A6BE4FF84FA4F044539DE9D87B98DF3CD941CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851BD354 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF685131E88), ref: 00007FF6851BD36A
GetLastError.KERNEL32 ref: 00007FF6851BD3B5
IsDebuggerPresent.KERNEL32 ref: 00007FF6851BD3CD
OutputDebugStringW.KERNEL32 ref: 00007FF6851BD3DE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF6851BD3D7

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: 94845ba821d1e9a3c618b5a821ee3ab69a68ff60829b310fd299c90d79f0b291
Instruction ID: 9e3fe0afe9c6e33bafd31e4054a3d1ecb11b3171e8a61c168ef17d423bd52232
Opcode Fuzzy Hash: 94845ba821d1e9a3c618b5a821ee3ab69a68ff60829b310fd299c90d79f0b291
Instruction Fuzzy Hash: 9D114F32A14B42E3F744AB26D6553B936A4FF44B64F404139C68D82A99EF3CE878C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685153170 Relevance: 7.8, APIs: 6, Instructions: 328COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF685153253
memcmp.VCRUNTIME140 ref: 00007FF6851533A4
memmove.VCRUNTIME140 ref: 00007FF6851533DE
memcpy.VCRUNTIME140 ref: 00007FF6851534EB
memcpy.VCRUNTIME140 ref: 00007FF68515350D
memcmp.VCRUNTIME140 ref: 00007FF6851535F0

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memcmp$memcpy$memmove
String ID:
API String ID: 4275666740-0
Opcode ID: 384aa8621d7fadee16e343db363beead97bb65f25174450b2444aacf63689749
Instruction ID: 45fbf146d00616d1c4b12ad060c8c3688107d6ef1e174a462e9c73996703c521
Opcode Fuzzy Hash: 384aa8621d7fadee16e343db363beead97bb65f25174450b2444aacf63689749
Instruction Fuzzy Hash: D1F17E72B00B85CAEB14CF29D1847AD37A4FB48B98F419229DE9D97748DF38E991C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851343F0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6851345E3
memset.VCRUNTIME140 ref: 00007FF685134613
memcpy.VCRUNTIME140 ref: 00007FF685134657
memcpy.VCRUNTIME140 ref: 00007FF685134740

Strings

#MOVE, xrefs: 00007FF685134804

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memcpymemset
String ID: #MOVE
API String ID: 1297977491-3098322713
Opcode ID: 17379ea28b3cc4effd84867946dea9ddeb8801f763f25e77e24adb2d48d0cbe0
Instruction ID: 737cce030aa748c0db63923b2cf89b4daaa530abfc2de8d42d9e7dd2c3bdc951
Opcode Fuzzy Hash: 17379ea28b3cc4effd84867946dea9ddeb8801f763f25e77e24adb2d48d0cbe0
Instruction Fuzzy Hash: AAD17072605B81D6D758CF29E9987DC77A9FB08B54FA84239C7AC873A4CF399462C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68516A9C0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 257COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF68516AB43
memchr.VCRUNTIME140 ref: 00007FF68516AC01
memchr.VCRUNTIME140 ref: 00007FF68516AC9E

Strings

..., xrefs: 00007FF68516A9C4

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memchr
String ID: ...
API String ID: 3297308162-440645147
Opcode ID: d18ac005108971ec1fdfe9db1eba30e04027103a0c36cbc1292aa6135cee5082
Instruction ID: 0bbc4fff5360715e0e2900d1f860ee4ad7af08a3d0263520c72a2aa9443ff6e7
Opcode Fuzzy Hash: d18ac005108971ec1fdfe9db1eba30e04027103a0c36cbc1292aa6135cee5082
Instruction Fuzzy Hash: D3C1C432E08B84C9F7118B7285413FEB761BF6ABD8F049725DE4877A99DF28A446D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851BD1B0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6851BD1DC
GetCurrentThreadId.KERNEL32 ref: 00007FF6851BD1EA
GetCurrentProcessId.KERNEL32 ref: 00007FF6851BD1F6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6851BD206

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e2ba4243b32712ffa6fec923d3315ca65663becebc4e355a9e4c320e1c71681d
Instruction ID: 385c2be1e74aaea49aa7d638440c75c6579fe8db0b67e6245b22f9b668cb3b7b
Opcode Fuzzy Hash: e2ba4243b32712ffa6fec923d3315ca65663becebc4e355a9e4c320e1c71681d
Instruction Fuzzy Hash: 74114C22B15B01CAEB00DB60E8542A833A4FB18B68F440E35DAAD877A8DF38D554C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851464F0 Relevance: 5.0, APIs: 2, Strings: 1, Instructions: 525COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF685146C54
memcpy.VCRUNTIME140 ref: 00007FF685146D52

Strings

0, xrefs: 00007FF685146A6A

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: 0
API String ID: 3510742995-4108050209
Opcode ID: a49a2a0d80ed87fb891a279fcc9ff0ba0af4a8ee756ce0595a7f2d14bfdbdf24
Instruction ID: 3d9ca16e6c098b00cc45da7192af7bb8dc737065fd270125e1435c6e7320daae
Opcode Fuzzy Hash: a49a2a0d80ed87fb891a279fcc9ff0ba0af4a8ee756ce0595a7f2d14bfdbdf24
Instruction Fuzzy Hash: D342F532E18B85C6E721CB3690412B9B760FF59B58F189735DE8867269DF38F894DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851BC154 Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00000004,00007FF6851BC255,?,?,?,?,?,?,00007FF685133658), ref: 00007FF6851BC15F
UnhandledExceptionFilter.KERNEL32(?,?,00000004,00007FF6851BC255,?,?,?,?,?,?,00007FF685133658), ref: 00007FF6851BC168
GetCurrentProcess.KERNEL32(?,?,00000004,00007FF6851BC255,?,?,?,?,?,?,00007FF685133658), ref: 00007FF6851BC16E

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: e35401be68f8e376edc16d8163f2b059b606fa4740a90ae5168e559c3e0df87b
Instruction ID: c1b31a4b1e04f85c4f606950541ea2346c420b14f3097e4544ff43d9c08c7393
Opcode Fuzzy Hash: e35401be68f8e376edc16d8163f2b059b606fa4740a90ae5168e559c3e0df87b
Instruction Fuzzy Hash: 50D09261A28906C6EB182BA2E8190351624BF58F75B085838CACA86328DD3C988ACB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685141200 Relevance: 4.1, Strings: 3, Instructions: 359COMMON

Download Yara Rule

Strings

[nav] NavMoveRequestForward %d, xrefs: 00007FF685141298
<NULL>, xrefs: 00007FF685141523
[nav] NavInitRequest: from move, window "%s", layer=%d, xrefs: 00007FF685141531

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: <NULL>$[nav] NavInitRequest: from move, window "%s", layer=%d$[nav] NavMoveRequestForward %d
API String ID: 0-568746515
Opcode ID: b29f68f20d90a3d84859ed095c695ef6efeda42de5242e396a27e4e348bebb60
Instruction ID: c6a0f0c7596f88f00a398142fe4c43fcdd84594dcf5b41784254f1a3f7d00e34
Opcode Fuzzy Hash: b29f68f20d90a3d84859ed095c695ef6efeda42de5242e396a27e4e348bebb60
Instruction Fuzzy Hash: 15021732D487C585E7229F3681013F9BB61FF29BA8F089339DF9866599DF386991C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685147260 Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

#CLOSE, xrefs: 00007FF6851474B3
#COLLAPSE, xrefs: 00007FF685147417

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #CLOSE$#COLLAPSE
API String ID: 0-3250029216
Opcode ID: 9380e3737dbad993adabc6069fa09af9bc6d950142b7185646b5f5a4d62591ed
Instruction ID: 854f2df55d720fe53e92a877b8f20ad4a4c30009eed6bea100bc8f9ddedad1d3
Opcode Fuzzy Hash: 9380e3737dbad993adabc6069fa09af9bc6d950142b7185646b5f5a4d62591ed
Instruction Fuzzy Hash: B1E14A32E04B85C9E712CB3290405FCBB61BF697A8F059736DE88775A5DF38689AC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68514B530 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

#RESIZE, xrefs: 00007FF68514B690

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: #RESIZE
API String ID: 0-1383961720
Opcode ID: 4d81f655e3c3035c30e730b24666e765d8f34ff3795379d3de76068fc5cbc50f
Instruction ID: 1267440cfcc3f4456b3616dc6227da2ee32b8f1db1eb90caceb4fc8aec85a03f
Opcode Fuzzy Hash: 4d81f655e3c3035c30e730b24666e765d8f34ff3795379d3de76068fc5cbc50f
Instruction Fuzzy Hash: 2F52E833D08789C6E722CB3790411B9BBA1FF59754F199735EB88636A5DF38A984CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851406D4 Relevance: 1.7, Strings: 1, Instructions: 474COMMON

Download Yara Rule

Strings

[nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s", xrefs: 00007FF685140811

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: [nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s"
API String ID: 0-1553127323
Opcode ID: 6eb044a748e7e6c7f04065e5f71db4396c43c4354b784731315f160b9e291d94
Instruction ID: eb5c441094bb100b6d96033a7d73ec59c8b6459c742dc3184958a3dfea245fb3
Opcode Fuzzy Hash: 6eb044a748e7e6c7f04065e5f71db4396c43c4354b784731315f160b9e291d94
Instruction Fuzzy Hash: 9C329F76909781C5E7618F2690403B97BA1FF44F2CF18963DCB88AB2A9DF386C94C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851310F0 Relevance: 1.7, APIs: 1, Instructions: 403COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF685131118

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 40825ed50c8ba74b3d38fef8206d4481619e1532e3cb5ba79f2ede25e6b8566d
Instruction ID: 12f1b60d01cbcfbd1fb066ea774f0ca0f2764b4e2a4a8789fb6d84fc5f1c108e
Opcode Fuzzy Hash: 40825ed50c8ba74b3d38fef8206d4481619e1532e3cb5ba79f2ede25e6b8566d
Instruction Fuzzy Hash: 0D024A25D2D7928AF7039B3994001A8FB647F63B94F40D33AED88B1DA6EF2D6585C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685141E00 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726c62003a493a14ea76b4aaca55cd63beb86e83a258fea3b8b00e56f64c5e4f
Instruction ID: 52b15bf0ef2229b67551c79362f6310dd394045d64cd8cf75c19a7c82386caec
Opcode Fuzzy Hash: 726c62003a493a14ea76b4aaca55cd63beb86e83a258fea3b8b00e56f64c5e4f
Instruction Fuzzy Hash: 72222E72A086C5D2EA69CB3241402B97BA1FF55F58F089639DBA863295DF3C7CB4C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685168E70 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be982474098ea0a407c8e7d2c9d766fb871bb2356d034c7da29e4e95f4bfed5e
Instruction ID: b874284fcc1df84479a2272792cd5f0835217af1cd904ed0c6e9a9fe210aeec8
Opcode Fuzzy Hash: be982474098ea0a407c8e7d2c9d766fb871bb2356d034c7da29e4e95f4bfed5e
Instruction Fuzzy Hash: 21E1E833D18BC886E252C63750422B9B791FFAE7D4F189726FE8872565DF38A495CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851508A0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf86c858dc8c6d67b00b8bb2c16090afa9f60ae4abb6fb09acfbda26ddbcace
Instruction ID: e6f87229d1a2f22b0a005762b901eee90dc5da63b9529c0141b2f903839cc85f
Opcode Fuzzy Hash: baf86c858dc8c6d67b00b8bb2c16090afa9f60ae4abb6fb09acfbda26ddbcace
Instruction Fuzzy Hash: D1411E11A08689C5F521466650412BAB751BFAEFA4F5DC336EDCC6679CDF3CED81C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68513CF40 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bd2d6c0eb94a3fd422b851e29d41aeaacbac115de79f40d567ab8d7392222a
Instruction ID: d1b2b2d78e3bff80444ac5f4adbad4bf531284eb1469fb2ff174a0a5d2af1944
Opcode Fuzzy Hash: b4bd2d6c0eb94a3fd422b851e29d41aeaacbac115de79f40d567ab8d7392222a
Instruction Fuzzy Hash: 0441D3636390F65FE658C773847053E7BA0D68B742B98A11BEFC116986CA3ED150EF20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68513CE20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11661be1cab9cf60ca911a891f8ac1a591ae135a3de8d0f99e96b0534956db08
Instruction ID: 3d5c2b8f57169c8b0108b6fc694d5471428d98ab8d17883bf7db83d13faf4c62
Opcode Fuzzy Hash: 11661be1cab9cf60ca911a891f8ac1a591ae135a3de8d0f99e96b0534956db08
Instruction Fuzzy Hash: CB01F5A2A0029587EA48D6D6CCF54B93751E755706F85403BDB485B284CA3C550AC360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68514B1E0 Relevance: 12.1, APIs: 8, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF68513D8E0: MultiByteToWideChar.KERNEL32 ref: 00007FF68513D919
Part of subcall function 00007FF68513D8E0: MultiByteToWideChar.KERNEL32 ref: 00007FF68513D939
Part of subcall function 00007FF68513D8E0: MultiByteToWideChar.KERNEL32 ref: 00007FF68513D9A2
Part of subcall function 00007FF68513D8E0: MultiByteToWideChar.KERNEL32 ref: 00007FF68513D9C6
Part of subcall function 00007FF68513D8E0: _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF68513D9D2

ftell.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B236
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B250
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B261
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B27B
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B2CB
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B2D9
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B2E1

Part of subcall function 00007FF68513EDA0: memcpy.VCRUNTIME140 ref: 00007FF68513EE3A

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF6851429F9), ref: 00007FF68514B31E

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$fclose$fseekftell$_wfopenfreadmemcpy
String ID:
API String ID: 909671797-0
Opcode ID: 1033a08ba53183aa6980c80ca838d4bf0cf5632348725926b4f19364f4a25c98
Instruction ID: b41ea9bfdd979695e7cce7f6047e957e7045d54d44cc97f4ab541438031a5cd8
Opcode Fuzzy Hash: 1033a08ba53183aa6980c80ca838d4bf0cf5632348725926b4f19364f4a25c98
Instruction Fuzzy Hash: 56418E21F1DA42C5EF64AB27A4546392BA2BF45FB8F085239CD8D87799DF2CAC41C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685153660 Relevance: 10.8, APIs: 7, Instructions: 266COMMON

Download Yara Rule

APIs

ceilf.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF6851537C0
ceilf.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF6851537D5
cosf.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF6851538AE
sinf.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF6851538C7
cosf.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF685153972
sinf.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF68515398A
ceilf.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF685153A58

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: ceilf$cosfsinf
String ID:
API String ID: 125261001-0
Opcode ID: faad99527aedd3e93991ce523c8a43965c7a54667a0c90e22826314469793c5f
Instruction ID: 93290ed1a8c6477dc65f4e479fa72c99bc785d2a51a72e6a706f48fe44c6caab
Opcode Fuzzy Hash: faad99527aedd3e93991ce523c8a43965c7a54667a0c90e22826314469793c5f
Instruction Fuzzy Hash: 54B13C32D28A89C5D2129B3694412B9B750FF5DB95F18C336E9C9B3669DF38BCD1CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685142610 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 151stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF685142897

Strings

###NavWindowingList, xrefs: 00007FF6851427ED
##MainMenuBar, xrefs: 00007FF68514288D
(Untitled), xrefs: 00007FF6851428A7
(Main menu bar), xrefs: 00007FF68514289C
(Popup), xrefs: 00007FF68514287E

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: strcmp
String ID: ###NavWindowingList$##MainMenuBar$(Main menu bar)$(Popup)$(Untitled)
API String ID: 1004003707-1507373985
Opcode ID: dd557d84d1b8fae4f1546c9b6037d73ebde1dfb8b80e78677ba2427c80d9cc8e
Instruction ID: ab69ff34b2ea7718d1cd6967fd72ae0c92c399a8e40aae35c7f5a3a69870fbfa
Opcode Fuzzy Hash: dd557d84d1b8fae4f1546c9b6037d73ebde1dfb8b80e78677ba2427c80d9cc8e
Instruction Fuzzy Hash: D581FF71908686C5EB61CB26D440279BBA1FF48F64F049739DAAC531E9CF3DE985C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685132040 Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF685132131
memcpy.VCRUNTIME140 ref: 00007FF68513213F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF685132178
memcpy.VCRUNTIME140 ref: 00007FF685132182
memcpy.VCRUNTIME140 ref: 00007FF685132190
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6851321C2

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 7208d47d681c284362d3cfc8b553e05461b77ef3e405080b044e546ec075383d
Instruction ID: 2a1daf1187f5b81de9be86099da4c98e9db060926d1220c4e0c911affeda2b3a
Opcode Fuzzy Hash: 7208d47d681c284362d3cfc8b553e05461b77ef3e405080b044e546ec075383d
Instruction Fuzzy Hash: 3141DE61B09642C1EE64AB12E9142ADAA51BF44FE0F544639DFAD4BB9DDE3CE881C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68516BB30 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6851321D0: memcpy.VCRUNTIME140(?,?,?,00007FF68516BB8D,?,?,?,?,?,?,?,0000000200000001,00000000,?,0000000100000000,00007FF6851317A6), ref: 00007FF6851322C3

Part of subcall function 00007FF6851321D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF68516BB8D,?,?,?,?,?,?,?,0000000200000001,00000000,?,0000000100000000,00007FF6851317A6), ref: 00007FF68513229D
Part of subcall function 00007FF6851321D0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6851322DF

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF68516BDA0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF68516BDA7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF68516BDAE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF68516BDB5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF68516BDBC

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskmemcpy
String ID:
API String ID: 2318677668-0
Opcode ID: c724ea108b7be75e9a1544b361aca1c9ab9f8ce36b846c5099b828ee5f94a5fd
Instruction ID: 521a4f9792c6f0574d3f9235e0d86e3439897fd834b30757a789235441b42ca9
Opcode Fuzzy Hash: c724ea108b7be75e9a1544b361aca1c9ab9f8ce36b846c5099b828ee5f94a5fd
Instruction Fuzzy Hash: 24615A72A14B8595EA20EB21E8983AD3BA1FF51F98F504029DB8D4AA59DF7DD980C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68513D8E0 Relevance: 7.6, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF68513D919
MultiByteToWideChar.KERNEL32 ref: 00007FF68513D939
MultiByteToWideChar.KERNEL32 ref: 00007FF68513D9A2
MultiByteToWideChar.KERNEL32 ref: 00007FF68513D9C6
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF68513D9D2

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$_wfopen
String ID:
API String ID: 1670196454-0
Opcode ID: 27ab861d11e6cea32abc6edd48c0d862822bdd74c13d4ff21e42ec84b3e4a26f
Instruction ID: 5e2f2bc27264aa8a3d7c2087464d2f3cfdb4531d2d62d60fa1f5287f6e45e93f
Opcode Fuzzy Hash: 27ab861d11e6cea32abc6edd48c0d862822bdd74c13d4ff21e42ec84b3e4a26f
Instruction Fuzzy Hash: A4311035608B42C6E7249F56E550179BAA5FF88FE0F084239DA8E87B69DF3CD511C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685131A90 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6851BB668: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF68513107E), ref: 00007FF6851BB682

memset.VCRUNTIME140 ref: 00007FF685131AB7

Strings

d, xrefs: 00007FF685131B67
d, xrefs: 00007FF685131B49
d, xrefs: 00007FF685131B7B
d, xrefs: 00007FF685131B3F

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: mallocmemset
String ID: d$d$d$d
API String ID: 2882185209-3382918743
Opcode ID: 049987d676977aa7bce698424944e12c19727a7a4ba521b1ea876bd0ac9bf106
Instruction ID: 8bd6a91dd23846fb8f71d4aec3a484a51dc34cd00781baac1b5d9ba063184658
Opcode Fuzzy Hash: 049987d676977aa7bce698424944e12c19727a7a4ba521b1ea876bd0ac9bf106
Instruction Fuzzy Hash: B93191B2509381CAE754DF35D4583993AA1FB05B0CF184178CB884E39EDBBA9488CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685134010 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF68513374B), ref: 00007FF685134074
memset.VCRUNTIME140(?,?,?,00007FF68513374B), ref: 00007FF6851340CC

Strings

imgui_log.txt, xrefs: 00007FF68513408E
imgui.ini, xrefs: 00007FF685134079

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memset
String ID: imgui.ini$imgui_log.txt
API String ID: 2221118986-3179804127
Opcode ID: 99d20ef4a65612cb918c091178b5d710ea9c93e0520ef1db80763e3ef977b1c1
Instruction ID: b2a4b5d7fd389c1776ea327cc41c9101e598114ba97990361113677debd0df4d
Opcode Fuzzy Hash: 99d20ef4a65612cb918c091178b5d710ea9c93e0520ef1db80763e3ef977b1c1
Instruction Fuzzy Hash: 43510AB2105B81DAC711DF28E95038D7BACFB15F48F684139CA980F76CCB358559CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF685131EA0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000000,?,FFFFFFFF,00007FF6851312EC), ref: 00007FF685131ED8
memcpy.VCRUNTIME140(?,00000000,?,FFFFFFFF,00007FF6851312EC), ref: 00007FF685131F79
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF685131F97

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: 1d2c8200066f793c4ef6d7cdc5974767324fe2e3727188f0c40d85aa05135a8a
Instruction ID: eeaebcab327fc3b8881221ba3c476b00d71eb81efb02551f9ca419e262fbf006
Opcode Fuzzy Hash: 1d2c8200066f793c4ef6d7cdc5974767324fe2e3727188f0c40d85aa05135a8a
Instruction Fuzzy Hash: B821D622A0A745C5EA19A751A4103B86944BF04FF0F540A38DAAD47BD9DF3CAC86C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6851332E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF68513330B

Strings

map/set too long, xrefs: 00007FF6851332E4
string too long, xrefs: 00007FF685133304

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: map/set too long$string too long
API String ID: 1004598685-1536985473
Opcode ID: cc008363d9018da13d603e2743682b26219ba15127764e8efc6f34439111a081
Instruction ID: 8bbad49e12a518376ed5b13568133f2ecb914061f812e859b14f83399fa4cf39
Opcode Fuzzy Hash: cc008363d9018da13d603e2743682b26219ba15127764e8efc6f34439111a081
Instruction Fuzzy Hash: E671AD72A18641DAE711DB32D8512ED3B60FF48B98F044639EE8C976A9CF3DE945CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68514C6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF68514C701
__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF68514C7A9

Part of subcall function 00007FF68514CBB0: memcpy.VCRUNTIME140 ref: 00007FF68514CBFE

Strings

[focus] SetNavWindow("%s"), xrefs: 00007FF68514C6CA

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: __stdio_common_vsprintf$memcpy
String ID: [focus] SetNavWindow("%s")
API String ID: 2965294037-2701392973
Opcode ID: beb17ed66ef49d407b689d496f3505a3a6cbc569e6c7574d9a2992c40066ceac
Instruction ID: de7724d2529c226563b26f77cf5292a5c099382bb891500990f33e5cf5399eac
Opcode Fuzzy Hash: beb17ed66ef49d407b689d496f3505a3a6cbc569e6c7574d9a2992c40066ceac
Instruction Fuzzy Hash: 1F318832B04A51C7E7249A55A98036A7B91BF88FA9F144139EE9DC3B58DF3CE851C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68514D220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,[focus] SetNavWindow("%s"),00000000,00007FF68513AE0C,?,?,00000000,00007FF685148523,?,?,?,00007FF685140090), ref: 00007FF68514D244
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,[focus] SetNavWindow("%s"),00000000,00007FF68513AE0C,?,?,00000000,00007FF685148523,?,?,?,00007FF685140090), ref: 00007FF68514D265

Strings

[focus] SetNavWindow("%s"), xrefs: 00007FF68514D235

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: [focus] SetNavWindow("%s")
API String ID: 2168557111-2701392973
Opcode ID: 13919cf1a7cfa46ea43c2651ef535355820812a0d94b26745258bad443156a03
Instruction ID: 0a324b291339b8404b6d2d85a29de804b96a43c5dbd128c425a40a6e7d3be608
Opcode Fuzzy Hash: 13919cf1a7cfa46ea43c2651ef535355820812a0d94b26745258bad443156a03
Instruction Fuzzy Hash: 6DE03972A08B81C2D6109B50F90445AB7A5FF98BD8F904039EBCC87B28CF7CC5A4CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF68513EDA0 Relevance: 5.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF68513EE3A
memchr.VCRUNTIME140 ref: 00007FF68513EF09
memchr.VCRUNTIME140 ref: 00007FF68513EF25
memcpy.VCRUNTIME140 ref: 00007FF68513EFAC

Memory Dump Source

Source File: 00000000.00000002.2483311625.00007FF685131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF685130000, based on PE: true

Associated: 00000000.00000002.2483236343.00007FF685130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483449039.00007FF6851BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483491466.00007FF6851C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483634721.00007FF6851DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483974713.00007FF6854B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854B5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2484081459.00007FF6854BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff685130000_SecuriteInfo.jbxd

Similarity

API ID: memchrmemcpy
String ID:
API String ID: 3039221550-0
Opcode ID: 5ec827c2311c9d9a378f929e0a85d0caebf51467e4afec34fea618418cffc1c5
Instruction ID: 5de178acccf50374bd4a7e490f36561a377d7df9df19e451a29b3a4460596a05
Opcode Fuzzy Hash: 5ec827c2311c9d9a378f929e0a85d0caebf51467e4afec34fea618418cffc1c5
Instruction Fuzzy Hash: 29612812B09B82C6EA188A2584502FA6F81FF45FE0F444639EF9D87389DF7CE985C301

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exePID: 4812, Parent PID: 4056

General

Chronological Activities

Analysis Process: conhost.exePID: 1340, Parent PID: 4812

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Win64.Evo-gen.28415.5583.exePID: 4812, Parent PID: 4056COMMON

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.28415.5583.exe