Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Crypt.14125.25529.exe
Analysis ID:	1431788
MD5:	e9d2d1f8d13bfc61b8eba5899b98cacd
SHA1:	595d42f95c0c5f35d7f13931836b7378bea997bc
SHA256:	7a84132479f6c500730b87327c0bcb5cf550d889a6c116d87ce00fad7c21bb15
Tags:	exe
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Crypt.14125.25529.exe (PID: 2936 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe" MD5: E9D2D1F8D13BFC61B8EBA5899B98CACD)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Code function: 0_2_009A1034 WSAStartup,WSACleanup,socket,WSACleanup,gethostbyname,WSACleanup,shutdown,closesocket,htons,connect,lstrlenA,send,recv,StrStrA,StrStrA,StrStrA,shutdown,closesocket,WSACleanup,

0_2_009A1034

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

String found in binary or memory: http://www.e-sushi.net/minibin/

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A16DC	0_2_009A16DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A8ADC	0_2_009A8ADC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A902D	0_2_009A902D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009AB060	0_2_009AB060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A5132	0_2_009A5132
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A9D5D	0_2_009A9D5D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A957E	0_2_009A957E

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe, 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameminibin.exep( vs SecuriteInfo.com.Trojan.Crypt.14125.25529.exe
Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Binary or memory string: OriginalFilenameminibin.exep( vs SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean4.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Mutant created: \Sessions\1\BaseNamedObjects\MiniBin

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: MiniBin	0_2_009A2502
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: minibin.ini	0_2_009A2502
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: \empty.ico	0_2_009A2502
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: \25.ico	0_2_009A2502
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: \50.ico	0_2_009A2502
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: \75.ico	0_2_009A2502
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: \full.ico	0_2_009A2502
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Command line argument: MiniBin	0_2_009A2502

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4a04656d-52aa-49de-8a09-cb178760e748}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Code function: 0_2_009A784C LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_009A784C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Code function: 0_2_009A4E95 push ecx; ret

0_2_009A4EA8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A11A5 lstrcatW,GetPrivateProfileStringW,lstrcpyW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,		0_2_009A11A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A1602 __aulldiv,__floor_pentium4,GetPrivateProfileIntW,SHEmptyRecycleBinW,		0_2_009A1602

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-5010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-4826

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	API call chain: ExitProcess graph end node			graph_0-5012
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	API call chain: ExitProcess graph end node			graph_0-5022

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Code function: 0_2_009A64F9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009A64F9

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

0_2_009A784C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A64F9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009A64F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A6FEE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009A6FEE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	Code function: 0_2_009A3D5A SetUnhandledExceptionFilter,	0_2_009A3D5A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Code function: 0_2_009A503F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_009A503F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	5%	ReversingLabs
SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	6%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://www.e-sushi.net/minibin/	0%	Avira URL Cloud	safe
http://www.e-sushi.net/minibin/	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.e-sushi.net/minibin/	SecuriteInfo.com.Trojan.Crypt.14125.25529.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431788
Start date and time:	2024-04-25 19:23:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Crypt.14125.25529.exe
Detection:	CLEAN
Classification:	clean4.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:24:47	API Interceptor	3587x Sleep call for process: SecuriteInfo.com.Trojan.Crypt.14125.25529.exe modified

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.097493247257242
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Crypt.14125.25529.exe
File size:	71'168 bytes
MD5:	e9d2d1f8d13bfc61b8eba5899b98cacd
SHA1:	595d42f95c0c5f35d7f13931836b7378bea997bc
SHA256:	7a84132479f6c500730b87327c0bcb5cf550d889a6c116d87ce00fad7c21bb15
SHA512:	69409dd718f243ee794dc1287985f3d91539fc25d3c78fe5d861588811268ed2e2806d00eb5d7e2d5db95328fe67ca967a524f6cc7dfddee3b141be52bf143d9
SSDEEP:	1536:ZxLf6c9eHYhgK10Jrn0IVHXPqIdUzd09:ZxLfTkHHNiIdUzd0
TLSH:	63634C52B6D14875D0A24E3458B2D7B12A7EFC122635498FABE42FBF1EB06C04E74367
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}/...A...A...A.......A.......A..d....A...@...A.......A.......A.......A.Rich..A.........................PE..L...L..P...........

File Icon


Icon Hash:	0bb2686171617117

Static PE Info

General

Entrypoint:	0x402cf1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x50BBA04C [Sun Dec 2 18:39:08 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e826a19427ea857b57a365b0dc3b2bbe

Entrypoint Preview

Instruction
call 00007FA8555AFC5Eh
jmp 00007FA8555AD79Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 28h
xor eax, eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-04h], eax
cmp dword ptr [004177E0h], eax
je 00007FA8555AD920h
push dword ptr [0041867Ch]
call dword ptr [0040C0D4h]
jmp 00007FA8555AD917h
mov eax, 0040512Fh
mov ecx, dword ptr [ebp+14h]
mov edx, 000000A6h
push esi
cmp ecx, edx
jg 00007FA8555ADAB8h
je 00007FA8555ADA9Fh
cmp ecx, 19h
jg 00007FA8555ADA2Eh
je 00007FA8555ADA1Ch
push 00000002h
pop edx
sub ecx, edx
je 00007FA8555ADA02h
dec ecx
je 00007FA8555AD9F2h
sub ecx, 05h
je 00007FA8555AD9DAh
dec ecx
je 00007FA8555AD9B2h
sub ecx, 05h
je 00007FA8555AD999h
dec ecx
je 00007FA8555AD960h
sub ecx, 09h
jne 00007FA8555ADB22h
mov dword ptr [ebp-28h], 00000003h
mov dword ptr [ebp-24h], 0040CBD8h
mov ecx, dword ptr [ebp+08h]
fld qword ptr [ecx]
mov ecx, dword ptr [ebp+0Ch]
mov esi, dword ptr [ebp+10h]
fstp qword ptr [ebp-20h]
fld qword ptr [ecx]
lea ecx, dword ptr [ebp-28h]
fstp qword ptr [ebp-18h]
push ecx
fld qword ptr [esi]
fstp qword ptr [ebp-10h]
call eax
pop ecx
test eax, eax
jne 00007FA8555ADAE8h

Rich Headers

Programming Language:

[ASM] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[IMP] VS2008 SP1 build 30729
[C++] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5ec	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x1aec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1b000	0xae0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe3d8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x1c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa35c	0xa400	37e3b829f9fe014e4208e1533f1cdc16	False	0.5848418445121951	data	6.6772239710220065	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x2f4c	0x3000	dbdb80a9ef1bb2814d193c1269182bd1	False	0.3439127604166667	data	4.68145293839108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x9688	0x1000	79f3796e52b8ac124d0baf8d9b014f08	False	0.37353515625	data	3.780127677881098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19000	0x1aec	0x1c00	16a9961124d01d4b6cff6543708a9bf5	False	0.19656808035714285	data	3.469357550036869	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1b000	0x1008	0x1200	bd76a76b5ce868c930f4b5357268b0b7	False	0.5251736111111112	data	4.889909811388468	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19370	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152			0.0871951219512195
RT_ICON	0x199d8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.16263440860215053
RT_ICON	0x19cc0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.3614864864864865
RT_ICON	0x19de8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.3614864864864865
RT_ICON	0x19f10	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.35135135135135137
RT_ICON	0x1a038	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.39864864864864863
RT_ICON	0x1a160	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.39864864864864863
RT_ICON	0x1a288	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.3952702702702703
RT_GROUP_ICON	0x1a3b0	0x30	data			0.9166666666666666
RT_GROUP_ICON	0x1a3e0	0x14	data			1.15
RT_GROUP_ICON	0x1a3f4	0x14	data			1.25
RT_GROUP_ICON	0x1a408	0x14	data			1.25
RT_GROUP_ICON	0x1a41c	0x14	data			1.25
RT_GROUP_ICON	0x1a430	0x14	data			1.25
RT_VERSION	0x1a444	0x3cc	data			0.42901234567901236
RT_MANIFEST	0x1a810	0x2d9	ASCII text, with very long lines (729), with no line terminators	English	United States	0.49382716049382713

Imports

DLL	Import
KERNEL32.dll	GetModuleHandleW, GetPrivateProfileIntW, GetPrivateProfileStringW, lstrcatW, lstrcpyW, GetLogicalDrives, CopyFileW, DeleteFileW, lstrlenW, GetModuleFileNameW, GetLastError, CreateMutexW, HeapReAlloc, HeapAlloc, lstrlenA, GetStringTypeW, MultiByteToWideChar, LCMapStringW, WideCharToMultiByte, RtlUnwind, Sleep, HeapFree, LoadLibraryW, EnterCriticalSection, LeaveCriticalSection, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, HeapSize, WritePrivateProfileStringW, UnhandledExceptionFilter, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, RaiseException, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, HeapCreate, InterlockedDecrement, GetCurrentThreadId, SetLastError, InterlockedIncrement, TlsFree, TlsSetValue, GetCommandLineW, HeapSetInformation, GetStartupInfoW, EncodePointer, DecodePointer, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, GetProcAddress, ExitProcess, WriteFile, GetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, TlsAlloc, TlsGetValue
USER32.dll	TrackPopupMenu, DestroyWindow, DestroyIcon, DestroyMenu, MessageBoxW, PostQuitMessage, DefWindowProcW, LoadImageW, wsprintfW, PostMessageW, RegisterClassExW, CreateWindowExW, GetMessageW, TranslateMessage, DispatchMessageW, RegisterWindowMessageW, SetTimer, KillTimer, CreatePopupMenu, InsertMenuItemW, EnableMenuItem, SetForegroundWindow, GetCursorPos
COMDLG32.dll	GetOpenFileNameW
SHELL32.dll	SHQueryRecycleBinW, SHEmptyRecycleBinW, ShellExecuteW, Shell_NotifyIconW
SHLWAPI.dll	StrStrA, StrFormatByteSizeW
WS2_32.dll	recv, send, connect, htons, closesocket, shutdown, gethostbyname, socket, WSACleanup, WSAStartup

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	19:24:11
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Crypt.14125.25529.exe"
Imagebase:	0x9a0000
File size:	71'168 bytes
MD5 hash:	E9D2D1F8D13BFC61B8EBA5899B98CACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.2%
Total number of Nodes:	1305
Total number of Limit Nodes:	6

Executed Functions

Function 009A16DC Relevance: 330.0, APIs: 145, Strings: 43, Instructions: 1027
windowregistrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Shell_NotifyIconW.SHELL32(00000000,009B7110), ref: 009A16FB
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009A1713
SetTimer.USER32(?,00000001,000007D0,00000000), ref: 009A172E
DefWindowProcW.USER32(?,?,?,?), ref: 009A24F8

Strings

C:\Users\user\Desktop\, xrefs: 009A1DDA, 009A1E2A, 009A1E74, 009A1EBE, 009A1F08, 009A1FCF, 009A2099, 009A2163, 009A222D, 009A22F7
75%, xrefs: 009A1AB0, 009A1AB5
\empty.ico, xrefs: 009A1DEE, 009A1FE1
Change Icons, xrefs: 009A19E4, 009A19E9
open, xrefs: 009A2465
Icon Files, xrefs: 009A1FA7, 009A2071, 009A213B, 009A2205, 009A22CF
X, xrefs: 009A22C1
Allow Progress Window, xrefs: 009A19B6, 009A19BB
Allow Sound, xrefs: 009A1982, 009A1987
About, xrefs: 009A1B55, 009A1B5A
::{645FF040-5081-101B-9F08-00AA002F954E}, xrefs: 009A1CA5
50%, xrefs: 009A1A8E, 009A1A93
RecycleConfirm, xrefs: 009A1D11
b, xrefs: 009A1B5B
No update available., xrefs: 009A247D
Empty, xrefs: 009A17FB, 009A1800, 009A18E3, 009A18E8
\full.ico, xrefs: 009A1F16, 009A2309
explorer.exe, xrefs: 009A1CAA
DblClickOpen, xrefs: 009A1CE5
25%, xrefs: 009A1A6C, 009A1A71
Check for updates?, xrefs: 009A2425
RecycleProgress, xrefs: 009A1D63
Reset Icons, xrefs: 009A1B2C, 009A1B31, 009A1DBD
\25.ico, xrefs: 009A1E38, 009A20AB
Open, xrefs: 009A17C2, 009A17D3, 009A18B0, 009A18B5
MiniBin 6.1.1.1, xrefs: 009A1DB8, 009A236D, 009A23A6, 009A23AB, 009A243E, 009A2478
AMF @ , xrefs: 009A23BF
www.e-sushi.net, xrefs: 009A2409
Double-Click Action, xrefs: 009A1873, 009A1878
\50.ico, xrefs: 009A1E82, 009A2175
\75.ico, xrefs: 009A1ECC, 009A223F
IconsTwoStates, xrefs: 009A1D8E
C:\Users\user\Desktop\minibin.ini, xrefs: 009A1CBE, 009A1CD9, 009A1D00, 009A1D29, 009A1D52, 009A1D7C
Confirm Recycling, xrefs: 009A194F, 009A1954
/, xrefs: 009A176D
Only use empty/full icons, xrefs: 009A1A22, 009A1A27
Exit, xrefs: 009A1B7E, 009A1B83, 009A2372
Configure, xrefs: 009A1D93
System Integration, xrefs: 009A1911, 009A1916
TaskbarCreated, xrefs: 009A170E
http://www.e-sushi.net/minibin/, xrefs: 009A2460
RecycleSound, xrefs: 009A1D3A
Full, xrefs: 009A1B0A, 009A1B0F

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: Window$IconMessageNotifyProcRegisterShell_Timer
String ID: AMF @ $www.e-sushi.net$/$25%$50%$75%$::{645FF040-5081-101B-9F08-00AA002F954E}$About$Allow Progress Window$Allow Sound$C:\Users\user\Desktop\$C:\Users\user\Desktop\minibin.ini$Change Icons$Check for updates?$Configure$Confirm Recycling$DblClickOpen$Double-Click Action$Empty$Exit$Full$Icon Files$IconsTwoStates$MiniBin 6.1.1.1$No update available.$Only use empty/full icons$Open$RecycleConfirm$RecycleProgress$RecycleSound$Reset Icons$System Integration$TaskbarCreated$X$\25.ico$\50.ico$\75.ico$\empty.ico$\full.ico$b$explorer.exe$http://www.e-sushi.net/minibin/$open
API String ID: 1455230564-301504438
Opcode ID: 1c8f810a63b363bf5081b38f10ebe8b933588da45e1026d1c7ab516c20710fcb
Instruction ID: 2a36b7d9a9036183b49735cd7ea755152b02cf2d9ae453cf7c41041fae2727da
Opcode Fuzzy Hash: 1c8f810a63b363bf5081b38f10ebe8b933588da45e1026d1c7ab516c20710fcb
Instruction Fuzzy Hash: E0824BB1D18218AFDF209FE4DD49ADEBBB9FF4A314F004526F105AA1A0DBB54A44DF90

Uniqueness

Uniqueness Score: -1.00%

Function 009A11A5 Relevance: 156.0, APIs: 26, Strings: 63, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileStringW.KERNEL32(Translate,Open,Open,Open,00000080,009B5008), ref: 009A11CD
GetPrivateProfileStringW.KERNEL32(Translate,Empty,Empty,Empty,00000080,009B5008), ref: 009A11DE
GetPrivateProfileStringW.KERNEL32(Translate,Configure,Configure,009B4E08,00000080,009B5008), ref: 009A11EF
GetPrivateProfileStringW.KERNEL32(Translate,Configure_About,About,About,00000080,009B5008), ref: 009A1203
GetPrivateProfileStringW.KERNEL32(Translate,Configure_DoubleClick,Double-Click Action,Double-Click Action,00000080,009B5008), ref: 009A1217
GetPrivateProfileStringW.KERNEL32(Translate,Configure_System,System Integration,System Integration,00000080,009B5008), ref: 009A122B
GetPrivateProfileStringW.KERNEL32(Translate,Configure_System_Confirm,Confirm Recycling,Confirm Recycling,00000080,009B5008), ref: 009A123F
GetPrivateProfileStringW.KERNEL32(Translate,Configure_System_Sound,Allow Sound,Allow Sound,00000080,009B5008), ref: 009A1253
GetPrivateProfileStringW.KERNEL32(Translate,Configure_System_Progress,Allow Progress Window,Allow Progress Window,00000080,009B5008), ref: 009A1267
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Icons,Change Icons,Change Icons,00000080,009B5008), ref: 009A127B
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Icons_TwoState,Only use empty/full icons,Only use empty/full icons,00000080,009B5008), ref: 009A128F
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Icons_Empty,Empty,009B4F08,00000080,009B5008), ref: 009A12A3
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Icons_25,25%,25%,00000080,009B5008), ref: 009A12B7
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Icons_50,50%,50%,00000080,009B5008), ref: 009A12CB
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Icons_75,75%,75%,00000080,009B5008), ref: 009A12DF
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Icons_Full,Full,Full,00000080,009B5008), ref: 009A12F3
GetPrivateProfileStringW.KERNEL32(Translate,Configure_Reset_Icons,Reset Icons,Reset Icons,00000080,009B5008), ref: 009A1307
GetPrivateProfileStringW.KERNEL32(Translate,Exit,Exit,Exit,00000080,009B5008), ref: 009A1318
GetPrivateProfileStringW.KERNEL32(Translate,About_CheckForUpdates,Check for updates?,Check for updates?,00000080,009B5008), ref: 009A132C
GetPrivateProfileStringW.KERNEL32(Translate,About_NoUpdateAvailable,No update available.,No update available.,00000080,009B5008), ref: 009A1340
GetPrivateProfileIntW.KERNEL32(Configure,DblClickOpen,00000001,C:\Users\user\Desktop\minibin.ini), ref: 009A135D
GetPrivateProfileIntW.KERNEL32(Configure,RecycleConfirm,00000001,C:\Users\user\Desktop\minibin.ini), ref: 009A1376
GetPrivateProfileIntW.KERNEL32(Configure,RecycleSound,00000001,C:\Users\user\Desktop\minibin.ini), ref: 009A138F
GetPrivateProfileIntW.KERNEL32(Configure,IconsTwoStates,00000001,C:\Users\user\Desktop\minibin.ini), ref: 009A13A8
GetPrivateProfileIntW.KERNEL32(Configure,RecycleProgress,00000001,C:\Users\user\Desktop\minibin.ini), ref: 009A13C1
GetPrivateProfileIntW.KERNEL32(History,MaxFillSizeMB,00000005,C:\Users\user\Desktop\minibin.ini), ref: 009A13DF

Strings

Configure_System_Confirm, xrefs: 009A1239
No update available., xrefs: 009A1335
Open, xrefs: 009A11C0, 009A11C5, 009A11C6
Change Icons, xrefs: 009A126B
Configure_Icons_Empty, xrefs: 009A129D
Allow Sound, xrefs: 009A1243
Confirm Recycling, xrefs: 009A1234
About, xrefs: 009A11F3
Configure_DoubleClick, xrefs: 009A1211
No update available., xrefs: 009A1330
DblClickOpen, xrefs: 009A1352
25%, xrefs: 009A12A7
Check for updates?, xrefs: 009A131C
75%, xrefs: 009A12D4
Reset Icons, xrefs: 009A12F7
Open, xrefs: 009A11BB
Configure_Icons_TwoState, xrefs: 009A1289
25%, xrefs: 009A12AC
Configure_Reset_Icons, xrefs: 009A1301
Reset Icons, xrefs: 009A12FC
Confirm Recycling, xrefs: 009A122F
Only use empty/full icons, xrefs: 009A127F
Configure_Icons, xrefs: 009A1275
Only use empty/full icons, xrefs: 009A1284
Exit, xrefs: 009A130B
System Integration, xrefs: 009A121B
C:\Users\user\Desktop\, xrefs: 009A11A5
75%, xrefs: 009A12CF
Configure_About, xrefs: 009A11FD
About, xrefs: 009A11F8
History, xrefs: 009A13DA
About_NoUpdateAvailable, xrefs: 009A133A
Empty, xrefs: 009A11D6, 009A11DB, 009A11DC, 009A1298
Allow Sound, xrefs: 009A1248
Allow Progress Window, xrefs: 009A1257
Full, xrefs: 009A12E8
Change Icons, xrefs: 009A1270
50%, xrefs: 009A12BB
RecycleConfirm, xrefs: 009A1370
Configure_Icons_25, xrefs: 009A12B1
Empty, xrefs: 009A11D1
Double-Click Action, xrefs: 009A120C
Configure_Icons_Full, xrefs: 009A12ED
Configure_System_Sound, xrefs: 009A124D
Configure_Icons_50, xrefs: 009A12C5
RecycleProgress, xrefs: 009A13BB
Configure_System, xrefs: 009A1225
50%, xrefs: 009A12C0
Exit, xrefs: 009A1310, 009A1315, 009A1316
Translate, xrefs: 009A11C7, 009A11CC, 009A11DD, 009A11EE, 009A1202, 009A1216, 009A122A, 009A123E, 009A1252, 009A1266, 009A127A, 009A128E, 009A12A2, 009A12B6, 009A12CA, 009A12DE, 009A12F2, 009A1306, 009A1317, 009A132B, 009A133F
System Integration, xrefs: 009A1220
Double-Click Action, xrefs: 009A1207
Check for updates?, xrefs: 009A1321
IconsTwoStates, xrefs: 009A13A2
Configure_System_Progress, xrefs: 009A1261
C:\Users\user\Desktop\minibin.ini, xrefs: 009A134A, 009A134F, 009A136E, 009A1387, 009A13A0, 009A13B9, 009A13D2
Allow Progress Window, xrefs: 009A125C
About_CheckForUpdates, xrefs: 009A1326
Configure, xrefs: 009A11E7, 009A11EC, 009A11ED, 009A1357, 009A135C, 009A1375, 009A138E, 009A13A7, 009A13C0
MaxFillSizeMB, xrefs: 009A13D5
Configure_Icons_75, xrefs: 009A12D9
RecycleSound, xrefs: 009A1389
Full, xrefs: 009A12E3

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: PrivateProfile$String
String ID: 25%$25%$50%$50%$75%$75%$About$About$About_CheckForUpdates$About_NoUpdateAvailable$Allow Progress Window$Allow Progress Window$Allow Sound$Allow Sound$C:\Users\user\Desktop\$C:\Users\user\Desktop\minibin.ini$Change Icons$Change Icons$Check for updates?$Check for updates?$Configure$Configure_About$Configure_DoubleClick$Configure_Icons$Configure_Icons_25$Configure_Icons_50$Configure_Icons_75$Configure_Icons_Empty$Configure_Icons_Full$Configure_Icons_TwoState$Configure_Reset_Icons$Configure_System$Configure_System_Confirm$Configure_System_Progress$Configure_System_Sound$Confirm Recycling$Confirm Recycling$DblClickOpen$Double-Click Action$Double-Click Action$Empty$Empty$Exit$Exit$Full$Full$History$IconsTwoStates$MaxFillSizeMB$No update available.$No update available.$Only use empty/full icons$Only use empty/full icons$Open$Open$RecycleConfirm$RecycleProgress$RecycleSound$Reset Icons$Reset Icons$System Integration$System Integration$Translate
API String ID: 83056003-2529001922
Opcode ID: d6b145b24e3110ce4545c0327697968dab7363f5f7b511d7cd838736e486fdad
Instruction ID: a638aaba9175c7ddd572b858723d7b0b10120857782e2e284d0bc452c79bf4ce
Opcode Fuzzy Hash: d6b145b24e3110ce4545c0327697968dab7363f5f7b511d7cd838736e486fdad
Instruction Fuzzy Hash: DC51BFE0BCC35C3E9121626A5D97E7B2DDCC9E7FEDB01411AB0447A1D18AC52C01AAF9

Uniqueness

Uniqueness Score: -1.00%

Function 009A2502 Relevance: 79.0, APIs: 31, Strings: 14, Instructions: 212
stringwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(00000000,00000000,MiniBin), ref: 009A2518
GetLastError.KERNEL32 ref: 009A251E
GetModuleFileNameW.KERNEL32(?,C:\Users\user\Desktop\,00001000), ref: 009A253F
lstrcpyW.KERNEL32(C:\Users\user\Desktop\minibin.ini,C:\Users\user\Desktop\), ref: 009A256B
lstrcatW.KERNEL32(C:\Users\user\Desktop\minibin.ini,minibin.ini), ref: 009A2579
lstrcpyW.KERNEL32(009B5008,C:\Users\user\Desktop\), ref: 009A2581
lstrcatW.KERNEL32(009B5008,minibin-language.ini), ref: 009A258D
lstrcpyW.KERNEL32(?,C:\Users\user\Desktop\), ref: 009A259C
lstrcatW.KERNEL32(?,\empty.ico), ref: 009A25AA
lstrcpyW.KERNEL32(?,C:\Users\user\Desktop\), ref: 009A25C9
lstrcatW.KERNEL32(?,\25.ico), ref: 009A25D7
lstrcpyW.KERNEL32(?,C:\Users\user\Desktop\), ref: 009A25F6
lstrcatW.KERNEL32(?,\50.ico), ref: 009A2604
lstrcpyW.KERNEL32(?,C:\Users\user\Desktop\), ref: 009A2623
lstrcatW.KERNEL32(?,\75.ico), ref: 009A2631
lstrcpyW.KERNEL32(?,C:\Users\user\Desktop\), ref: 009A2650
lstrcatW.KERNEL32(?,\full.ico), ref: 009A265E
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 009A2693
RegisterClassExW.USER32(00000030), ref: 009A26B6
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 009A26BE
CreateWindowExW.USER32(00000000,MiniBin_TrayIconClass,MiniBin,80000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009A26DB
_memset.LIBCMT ref: 009A26EF
lstrcpyW.KERNEL32(MiniBin 6.1.1.10 bytes,MiniBin 6.1.1.1), ref: 009A273B
lstrcatW.KERNEL32(MiniBin 6.1.1.10 bytes,009AC820), ref: 009A2748
StrFormatByteSizeW.SHLWAPI(00000000,00000000,?,00000080), ref: 009A2758
lstrcatW.KERNEL32(MiniBin 6.1.1.10 bytes,?), ref: 009A2766
Shell_NotifyIconW.SHELL32(00000000,009B7110), ref: 009A276E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 009A2781
TranslateMessage.USER32(?), ref: 009A278A
DispatchMessageW.USER32(?), ref: 009A2794
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 009A27A1

Strings

MiniBin 6.1.1.10 bytes, xrefs: 009A2709, 009A2742, 009A2747, 009A2765
C:\Users\user\Desktop\, xrefs: 009A2536, 009A253B, 009A2545, 009A2564, 009A257B, 009A2594, 009A25C1, 009A25EE, 009A261B, 009A2648
MiniBin, xrefs: 009A250F, 009A26D0
\empty.ico, xrefs: 009A259E
\25.ico, xrefs: 009A25CB
MiniBin 6.1.1.1, xrefs: 009A2704
\50.ico, xrefs: 009A25F8
\75.ico, xrefs: 009A2625
C:\Users\user\Desktop\minibin.ini, xrefs: 009A2565, 009A256A, 009A2572
MiniBin_TrayIconClass, xrefs: 009A26AC, 009A26D5
minibin.ini, xrefs: 009A256D
0, xrefs: 009A2678
\full.ico, xrefs: 009A2652
minibin-language.ini, xrefs: 009A2583

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: lstrcat$lstrcpy$Message$Module$CreateHandle$ByteClassDispatchErrorFileFormatIconLastMutexNameNotifyRegisterShell_SizeTranslateWindow_memset
String ID: 0$C:\Users\user\Desktop\$C:\Users\user\Desktop\minibin.ini$MiniBin$MiniBin 6.1.1.1$MiniBin 6.1.1.10 bytes$MiniBin_TrayIconClass$\25.ico$\50.ico$\75.ico$\empty.ico$\full.ico$minibin-language.ini$minibin.ini
API String ID: 3281556649-3453328190
Opcode ID: 9a9bb64c9309d62ebe6a6e9612eea24ca5bfe76b5859f447ace027e887c00b43
Instruction ID: 840e5280129fee237d6d0e943129c8ee9a16eb4a071a35360ee0a5cd4bb5bd07
Opcode Fuzzy Hash: 9a9bb64c9309d62ebe6a6e9612eea24ca5bfe76b5859f447ace027e887c00b43
Instruction Fuzzy Hash: 85615FB1D1821CABDB10EFA4DC89E9F7BBCEF86714F004566F208A6150D7749A449FE4

Uniqueness

Uniqueness Score: -1.00%

Function 009A1410 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 009A1431
wsprintfW.USER32 ref: 009A1452
SHQueryRecycleBinW.SHELL32(?,00000014), ref: 009A1466
lstrcpyW.KERNEL32(MiniBin 6.1.1.10 bytes,MiniBin 6.1.1.1), ref: 009A14AA
lstrcatW.KERNEL32(MiniBin 6.1.1.10 bytes,009AC820), ref: 009A14BC
StrFormatByteSizeW.SHLWAPI(00000000,00000000,?,00000080), ref: 009A14CE
lstrcatW.KERNEL32(MiniBin 6.1.1.10 bytes,?), ref: 009A14DC
lstrcpyW.KERNEL32(MiniBin 6.1.1.10 bytes,MiniBin 6.1.1.1), ref: 009A14E8
lstrcatW.KERNEL32(MiniBin 6.1.1.10 bytes,009AC820), ref: 009A14FA
StrFormatByteSizeW.SHLWAPI(00000000,?,?,00000080), ref: 009A150C
lstrcatW.KERNEL32(MiniBin 6.1.1.10 bytes,?), ref: 009A151A
__aulldiv.LIBCMT ref: 009A1550
Shell_NotifyIconW.SHELL32(00000001,009B7110), ref: 009A15F7

Strings

MiniBin 6.1.1.10 bytes, xrefs: 009A14A2, 009A14A7, 009A14BB, 009A14DB, 009A14F9, 009A1519
%c:\, xrefs: 009A144C
MiniBin 6.1.1.1, xrefs: 009A149D

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: lstrcat$ByteFormatSizelstrcpy$DrivesIconLogicalNotifyQueryRecycleShell___aulldivwsprintf
String ID: %c:\$MiniBin 6.1.1.1$MiniBin 6.1.1.10 bytes
API String ID: 3139760847-272349090
Opcode ID: 1e06013a950964253bfe1267f68283b398eb52ccd5f2cf2d3984d9f5fadb95d8
Instruction ID: 9cdc8c34239de28d2af70abc9ea18bb16375b817fc97b12a507eed127ed3b2d6
Opcode Fuzzy Hash: 1e06013a950964253bfe1267f68283b398eb52ccd5f2cf2d3984d9f5fadb95d8
Instruction Fuzzy Hash: 425105B1E18218EBDB019FD8DE08BDA77F8FF8B355F104651E141A61A0D7349A40AFE0

Uniqueness

Uniqueness Score: -1.00%

Function 009A1173 Relevance: 4.5, APIs: 3, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 009A1188
GetModuleHandleW.KERNEL32(00000000,?,00000001,00000010,00000010,00000000), ref: 009A119A
LoadImageW.USER32(00000000), ref: 009A11A1

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: ImageLoad$HandleModule
String ID:
API String ID: 2156275154-0
Opcode ID: 9ebfe686e086abbd03636d40213da808fe1c0167960cb011594dd8765b8e7835
Instruction ID: 3d486dacca087141eb2225c5d2522bf8a7e8e2fd5f57de9cc0d9e63b69825555
Opcode Fuzzy Hash: 9ebfe686e086abbd03636d40213da808fe1c0167960cb011594dd8765b8e7835
Instruction Fuzzy Hash: 7EE0127179831979FD2016D06C06FD62A5D5B0DB40F000801B780BD0D2C1E264E167D4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009A1034 Relevance: 38.6, APIs: 18, Strings: 4, Instructions: 107
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 009A1049
WSACleanup.WS2_32 ref: 009A1053
socket.WS2_32(00000002,00000001,00000006), ref: 009A1066
WSACleanup.WS2_32 ref: 009A1075

Strings

GET /minibin/version.php HTTP/1.1Host: www.e-sushi.netUser-Agent: MiniBin 6.1.1.1, xrefs: 009A10DD, 009A10E2, 009A10EA
www.e-sushi.net, xrefs: 009A1081
MiniBin 6.1.1.1, xrefs: 009A1123
200 OK, xrefs: 009A1135

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: Cleanup$Startupsocket
String ID: 200 OK$GET /minibin/version.php HTTP/1.1Host: www.e-sushi.netUser-Agent: MiniBin 6.1.1.1$MiniBin 6.1.1.1$www.e-sushi.net
API String ID: 3412503511-2011565168
Opcode ID: db42378d922e8757c831f5840568eaca1b9cf9c50a797bda1b304f7fbc5fc577
Instruction ID: b5a4dd87ca4dffeef30b13db9a4b7b3d0c03c20fe09e83e1f4157824803ee547
Opcode Fuzzy Hash: db42378d922e8757c831f5840568eaca1b9cf9c50a797bda1b304f7fbc5fc577
Instruction Fuzzy Hash: A43184B175C214AFEB205BA49C8DFBE367CEF07B51F004425F615DA191DB648C41ABE1

Uniqueness

Uniqueness Score: -1.00%

Function 009A1602 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 009A162B
__floor_pentium4.LIBCMT ref: 009A1660
GetPrivateProfileIntW.KERNEL32(History,MaxFillSizeMB,00000005,C:\Users\user\Desktop\minibin.ini), ref: 009A1697
SHEmptyRecycleBinW.SHELL32(00000000,00000000,00000000), ref: 009A16D4

Strings

History, xrefs: 009A1684, 009A1689, 009A1696
MaxFillSizeMB, xrefs: 009A167E, 009A1683, 009A1695
C:\Users\user\Desktop\minibin.ini, xrefs: 009A1677, 009A167C, 009A1692

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: EmptyPrivateProfileRecycle__aulldiv__floor_pentium4
String ID: C:\Users\user\Desktop\minibin.ini$History$MaxFillSizeMB
API String ID: 3006636384-3709813415
Opcode ID: ad8c7330f2578c0f380699392b11410ba0a50f431fb1035eb6b40846b39a4122
Instruction ID: 2d00261e04ff1018e11635a51d2260788af9a0d3c59548007fab26a5a7f79511
Opcode Fuzzy Hash: ad8c7330f2578c0f380699392b11410ba0a50f431fb1035eb6b40846b39a4122
Instruction Fuzzy Hash: 422138F2D1C6046FF714AB68EC06B6B7BECD783320F154619E001E2192D67499008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009A6FEE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 009AA710
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009AA725
UnhandledExceptionFilter.KERNEL32(009AE3D0), ref: 009AA730
GetCurrentProcess.KERNEL32(C0000409), ref: 009AA74C
TerminateProcess.KERNEL32(00000000), ref: 009AA753

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 37ac46f61561be34f6cb91608771cf21c3290c92d55fb963f27b038036810a8b
Instruction ID: c7c74e98fecca47ea07f54d3754a0e6137b94f06d524d27b45e32cf4a51098c5
Opcode Fuzzy Hash: 37ac46f61561be34f6cb91608771cf21c3290c92d55fb963f27b038036810a8b
Instruction Fuzzy Hash: EB21BFB4929304DFCB40DFA5FE496563BE8BB0DB68F50421AE40987261EBB05981EF85

Uniqueness

Uniqueness Score: -1.00%

Function 009A3D5A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00003D18), ref: 009A3D5F

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4adaa5dbf7b659df051e5b4905598e25bd6452034aed738ff1d8ec09446a050d
Instruction ID: 12ea2f39e525f3ab234331426498d451e6a78e2c8533074c36dde548daf4aa72
Opcode Fuzzy Hash: 4adaa5dbf7b659df051e5b4905598e25bd6452034aed738ff1d8ec09446a050d
Instruction Fuzzy Hash: 989002A02A5150DB8E1157745C09405A6919ECA60675284607005D8094DE604100A5E1

Uniqueness

Uniqueness Score: -1.00%

Function 009AB060 Relevance: 1.4, Strings: 1, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

Strings

N@, xrefs: 009AB070

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction ID: f7c7e1a0404f5e34aa44e2e66bb52196ff69a5026af025a982184b7f0eda901a
Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction Fuzzy Hash: 126158729043168FCB18CF48C4946AEBBF2FF85314F1AC5AED8195B262C7B19955CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 009A4CB3 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,009A2C0E), ref: 009A4CBB
__mtterm.LIBCMT ref: 009A4CC7

Part of subcall function 009A4A00: DecodePointer.KERNEL32(00000005,009A4E29,?,009A2C0E), ref: 009A4A11
Part of subcall function 009A4A00: TlsFree.KERNEL32(00000013,009A4E29,?,009A2C0E), ref: 009A4A2B
Part of subcall function 009A4A00: DeleteCriticalSection.KERNEL32(00000000,00000000,77755810,?,009A4E29,?,009A2C0E), ref: 009A7218
Part of subcall function 009A4A00: _free.LIBCMT ref: 009A721B
Part of subcall function 009A4A00: DeleteCriticalSection.KERNEL32(00000013,77755810,?,009A4E29,?,009A2C0E), ref: 009A7242

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 009A4CDD
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 009A4CEA
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 009A4CF7
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 009A4D04
TlsAlloc.KERNEL32(?,009A2C0E), ref: 009A4D54
TlsSetValue.KERNEL32(00000000,?,009A2C0E), ref: 009A4D6F
__init_pointers.LIBCMT ref: 009A4D79
EncodePointer.KERNEL32(?,009A2C0E), ref: 009A4D8A
EncodePointer.KERNEL32(?,009A2C0E), ref: 009A4D97
EncodePointer.KERNEL32(?,009A2C0E), ref: 009A4DA4
EncodePointer.KERNEL32(?,009A2C0E), ref: 009A4DB1
DecodePointer.KERNEL32(009A4B84,?,009A2C0E), ref: 009A4DD2
__calloc_crt.LIBCMT ref: 009A4DE7
DecodePointer.KERNEL32(00000000,?,009A2C0E), ref: 009A4E01
GetCurrentThreadId.KERNEL32 ref: 009A4E13

Strings

KERNEL32.DLL, xrefs: 009A4CB6
FlsFree, xrefs: 009A4CF9
FlsAlloc, xrefs: 009A4CD7
FlsSetValue, xrefs: 009A4CEC
FlsGetValue, xrefs: 009A4CDF

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 134b5ce92cddfadf78fd0e92e77b7c625c94e0eae359549f2e20037e525c63a1
Instruction ID: 5163fb761e9bd039a8e018fd0b6678b14abf8ae0306ab6b069459996dc918510
Opcode Fuzzy Hash: 134b5ce92cddfadf78fd0e92e77b7c625c94e0eae359549f2e20037e525c63a1
Instruction Fuzzy Hash: E331557196D350DACB217F74BD496DB3BA8FB8A3B47150A1AE404961B0DF749408EFE0

Uniqueness

Uniqueness Score: -1.00%

Function 009A4A3D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,009AE480,00000008,009A4B45,00000000,00000000,?,?,009A5121,009A2F84), ref: 009A4A4E
__lock.LIBCMT ref: 009A4A82

Part of subcall function 009A732B: __mtinitlocknum.LIBCMT ref: 009A7341
Part of subcall function 009A732B: __amsg_exit.LIBCMT ref: 009A734D
Part of subcall function 009A732B: EnterCriticalSection.KERNEL32(?,?,?,009A4A87,0000000D), ref: 009A7355

InterlockedIncrement.KERNEL32(009AF340), ref: 009A4A8F
__lock.LIBCMT ref: 009A4AA3
___addlocaleref.LIBCMT ref: 009A4AC1

Strings

KERNEL32.DLL, xrefs: 009A4A49

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: fba0d7fa6b7e30474a4b9cef71db690ebe33f23b1997d6d32efc3bfc8bf1a56d
Instruction ID: a95f88eee3e611f2505a980bf712e5cc990fe5ee0b3a984f70aae96cb5522337
Opcode Fuzzy Hash: fba0d7fa6b7e30474a4b9cef71db690ebe33f23b1997d6d32efc3bfc8bf1a56d
Instruction Fuzzy Hash: 1F0180B1544700DFDB20AFA5D80A74AFBE0EF92324F10490EE49A977A1CBB0A944DB95

Uniqueness

Uniqueness Score: -1.00%

Function 009A5CF0 Relevance: 9.0, APIs: 6, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 009A5CFC

Part of subcall function 009A4B6A: __getptd_noexit.LIBCMT ref: 009A4B6D
Part of subcall function 009A4B6A: __amsg_exit.LIBCMT ref: 009A4B7A

__amsg_exit.LIBCMT ref: 009A5D1C
__lock.LIBCMT ref: 009A5D2C
InterlockedDecrement.KERNEL32(?), ref: 009A5D49
_free.LIBCMT ref: 009A5D5C
InterlockedIncrement.KERNEL32(02382D68), ref: 009A5D74

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 2e6b3b16e826097276f3a233ba18890b56b528dfee8eecaf00eb4339078f5342
Instruction ID: 1b8bba4d0c7183b2466592b9e3af664d84e6dda625d96b4f674f49ded105a6e0
Opcode Fuzzy Hash: 2e6b3b16e826097276f3a233ba18890b56b528dfee8eecaf00eb4339078f5342
Instruction Fuzzy Hash: C0018031A14F219BDF60ABA4980A75DB7A4FF87B20F164015F800AB2D0CB74AD42EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 009AAD17 Relevance: 7.6, APIs: 5, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 009AAD25

Part of subcall function 009AAC01: __FF_MSGBANNER.LIBCMT ref: 009AAC1A
Part of subcall function 009AAC01: __NMSG_WRITE.LIBCMT ref: 009AAC21
Part of subcall function 009AAC01: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,009A7C02,00000000,00000001,00000000,?,009A72B6,00000018,009AE570,0000000C,009A7346), ref: 009AAC46

_free.LIBCMT ref: 009AAD38

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: b2b75b8f5e32834f5d787d6a99f884d87316efaa360239cd92f98a6a712a386a
Instruction ID: 12e6f4ff5f3fa13db21903b8e674d0aa13eca63511e6d96b34312249dae83e67
Opcode Fuzzy Hash: b2b75b8f5e32834f5d787d6a99f884d87316efaa360239cd92f98a6a712a386a
Instruction Fuzzy Hash: 10112732508615ABCB212B70AC0576A3798AF873B2F250929F8889B5D0DF34CC40D2D1

Uniqueness

Uniqueness Score: -1.00%

Function 009A6471 Relevance: 7.5, APIs: 5, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 009A647D

Part of subcall function 009A4B6A: __getptd_noexit.LIBCMT ref: 009A4B6D
Part of subcall function 009A4B6A: __amsg_exit.LIBCMT ref: 009A4B7A

__getptd.LIBCMT ref: 009A6494
__amsg_exit.LIBCMT ref: 009A64A2
__lock.LIBCMT ref: 009A64B2
__updatetlocinfoEx_nolock.LIBCMT ref: 009A64C6

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: acaa45c88e217a63c85da718a4633d366b264130a81ce1e036bc422f18a54c72
Instruction ID: 052aba56ba1b5e4284656d82856beb4bc99042a49cd324c193a02d7d78348bf7
Opcode Fuzzy Hash: acaa45c88e217a63c85da718a4633d366b264130a81ce1e036bc422f18a54c72
Instruction Fuzzy Hash: F4F0BB329447109BDB217B74980774D77D0EFC7B25F158109F4106B1E2DBB45801ABD5

Uniqueness

Uniqueness Score: -1.00%

Function 009A3B58 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 009A3B7E

Part of subcall function 009A39AA: __fltout2.LIBCMT ref: 009A39D5

__cftog_l.LIBCMT ref: 009A3BA4
__cftoe_l.LIBCMT ref: 009A3BD6

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 82ca8fdb8de31ddecf7060a87fe2ce7848a206713c4399c422aee10c31d2935d
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 8E114B3240014AFBCF165E98CC52CEE3F67BB5A350B598915FE2859031C336CAB1AB91

Uniqueness

Uniqueness Score: -1.00%

Function 009A46D1 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,009A2C43), ref: 009A46D4
__malloc_crt.LIBCMT ref: 009A4703
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009A4710

Memory Dump Source

Source File: 00000000.00000002.2594465865.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2594452696.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594481260.00000000009AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594495017.00000000009B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594542975.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 161ea5a119a753a9bfbc775467c858eb0a93027658d4e6bf669cf10c6e1df101
Instruction ID: 6ba134b9a5c907351a1b27a96f7f4e17a0567a1eeb6ed8f3376bba39fc747cc3
Opcode Fuzzy Hash: 161ea5a119a753a9bfbc775467c858eb0a93027658d4e6bf669cf10c6e1df101
Instruction Fuzzy Hash: 4AF0A77B508121AA8F31B778BC4B897676CDFD376531A4825F441C3255FAA08D8182E1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.Crypt.14125.25529.exePID: 2936, Parent PID: 4056

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Trojan.Crypt.14125.25529.exePID: 2936, Parent PID: 4056COMMON

Execution Graph

Graph

Executed Functions

Function 009A16DC Relevance: 330.0, APIs: 145, Strings: 43, Instructions: 1027windowregistrytimeCOMMON

Windows Analysis Report
SecuriteInfo.com.Trojan.Crypt.14125.25529.exe

Function 009A16DC Relevance: 330.0, APIs: 145, Strings: 43, Instructions: 1027
windowregistrytimeCOMMON

Function 009A11A5 Relevance: 156.0, APIs: 26, Strings: 63, Instructions: 223
COMMON

Function 009A2502 Relevance: 79.0, APIs: 31, Strings: 14, Instructions: 212
stringwindowregistryCOMMON

Function 009A1410 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155
stringwindowCOMMON

Function 009A1173 Relevance: 4.5, APIs: 3, Instructions: 22
COMMON

Function 009A1034 Relevance: 38.6, APIs: 18, Strings: 4, Instructions: 107
networkCOMMON

Function 009A1602 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
COMMON

Function 009A6FEE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Function 009A4CB3 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Function 009A4A3D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
COMMONLIBRARYCODE

Function 009A5CF0 Relevance: 9.0, APIs: 6, Instructions: 47
COMMONLIBRARYCODE

Function 009AAD17 Relevance: 7.6, APIs: 5, Instructions: 68
COMMONLIBRARYCODE

Function 009A6471 Relevance: 7.5, APIs: 5, Instructions: 34
COMMONLIBRARYCODE