Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe
Analysis ID:	1431820
MD5:	0d8bedda7d9b963de975685cf2b2a5eb
SHA1:	cbbffe900a09e8a3bbb1a1bf16e7aeb8ebde72a1
SHA256:	519f0b16537fa4a2bc228cdfce2b85c12225e2071d7789c8cc9bb8f7b85796ca
Tags:	exe
Infos:

Detection

Score:	16
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Yara detected BatToExe compiled binary

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

Potential key logger detected (key state polling based)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe (PID: 6284 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe" MD5: 0D8BEDDA7D9B963DE975685CF2B2A5EB)

SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp (PID: 6548 cmdline: "C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp" /SL5="$20438,4092287,121344,C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe" MD5: 90FC739C83CD19766ACB562C66A7D0E2)

Bat_To_Exe_Converter.exe (PID: 6128 cmdline: "C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe" MD5: E3D6B93E861FEEFA47CCEEAE03E99094)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
Process Memory Space: Bat_To_Exe_Converter.exe PID: 6128	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security

Unpacked PEs

Source	Rule	Description	Author
5.2.Bat_To_Exe_Converter.exe.1402216dd.3.raw.unpack	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
5.2.Bat_To_Exe_Converter.exe.1401e0add.2.raw.unpack	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
5.2.Bat_To_Exe_Converter.exe.140150618.1.raw.unpack	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
5.2.Bat_To_Exe_Converter.exe.140000000.0.unpack	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400A2380 CryptAcquireContextW,GetLastError,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,		5_2_00000001400A2380
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014009AF20 exit,GetTempPathW,GetLastError,_malloc_dbg,_errno,GetTempPathW,??3@YAXPEAX@Z,GetFileAttributesW,GetLastError,GetLastError,_errno,GetFileAttributesW,GetLastError,_errno,CryptAcquireContextW,GetLastError,CryptGenRandom,??3@YAXPEAX@Z,CreateFileW,GetLastError,GetLastError,CryptReleaseContext,??3@YAXPEAX@Z,_open_osfhandle,CloseHandle,_errno,		5_2_000000014009AF20

Source: Bat_To_Exe_Converter.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.License AgreementCopyright (c) 2019 Fatih KodakPermission is hereby granted free of charge to any person obtaining a copyof this software and associated documentation files (the "Software") to dealin the Software without restriction including without limitation the rightsto use copy modify merge publish distribute sublicense and/or sellcopies of the Software and to permit persons to whom the Software isfurnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included inall copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS ORIMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITYFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHERLIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROMOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS INTHE SOFTWARE. I &accept the agreementI &do not accept the agreement&Next >Cancel
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.License AgreementCopyright (c) 2019 Fatih KodakPermission is hereby granted free of charge to any person obtaining a copyof this software and associated documentation files (the "Software") to dealin the Software without restriction including without limitation the rightsto use copy modify merge publish distribute sublicense and/or sellcopies of the Software and to permit persons to whom the Software isfurnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included inall copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS ORIMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITYFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHERLIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROMOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS INTHE SOFTWARE. I &accept the agreementI &do not accept the agreement&Next >Cancel

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter\is-54DM0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter\is-48PVO.tmp	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60C29EC2-33E8-45EE-87E4-31FA3E35C539}_is1

Jump to behavior

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: Z?.PDB source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: d:\dev\All\shared\3rd_Party\Scintilla\1.76\bin\SciLexer.pdb source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Scilexer.dll.5.dr

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004BD20 wcslen,wcslen,RtlAllocateHeap,wcscpy,wcscat,wcscat,FindFirstFileW,GetLastError,HeapFree,	5_2_000000014004BD20
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004C040 wcsncpy,wcslen,wcscat,GetDriveTypeW,FindFirstFileW,FindClose,GetFileAttributesW,GetDriveTypeW,	5_2_000000014004C040
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004C434 wcsncpy,wcslen,wcsncpy,_snwprintf,FindFirstFileW,_snwprintf,wcscmp,wcscmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,	5_2_000000014004C434

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming\Bat To Exe Converter	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoRC.exe	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.2024179186.00000000021FA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.2020443763.000000000235B000.00000004.00001000.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2924789685.0000000002ED6000.00000004.00000020.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi//b2e/downloads/v.zip
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000002.2021745061.000000000018E000.00000004.00000010.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000000.2018248651.00000001403C7000.00000008.00000001.01000000.00000008.sdmp, is-48PVO.tmp.1.dr	String found in binary or memory: http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/D
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/Submit
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.2020443763.000000000235B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/a
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.2020443763.000000000235B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/q
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1669725255.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.1672186745.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/thttp://127.0.0.1:43110/17SWVnHoujG92yYGSZ
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: Bat_To_Exe_Converter.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html#
Source: Bat_To_Exe_Converter.exe	String found in binary or memory: http://www.f2ko.de/de/cmd.php
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.f2ko.de/de/cmd.phpDatei
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.f2ko.de/en/cmd.php
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.f2ko.de/en/cmd.phpVideosJapanese
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.godevtool.com
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.godevtool.com/GolinkFrame.htm
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.godevtool.com/GolinkFrame.htm/display
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.godevtool.com/GorcFrame.htm
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.godevtool.com/GorcFrame.htmPrivateBuildprivatebuildInterner
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.godevtool.comProduktversionCMD
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670603131.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670350947.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000000.1671462023.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp.0.dr, is-54DM0.tmp.1.dr	String found in binary or memory: http://www.innosetup.com/
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670603131.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670350947.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000000.1671462023.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp.0.dr, is-54DM0.tmp.1.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2924024021.000000000065B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2924024021.000000000065B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/99fk
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://github.com/99fkDokumenteLetzte
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://upx.github.io
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://upx.github.io/upx-license.html
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://upx.github.io/upx-license.htmlKonverterAltStyleGPL
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://upx.github.ioEine
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, upx.exe.5.dr	String found in binary or memory: https://upx.github.ioT
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.everaldo.com/
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.scintilla.org/
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.scintilla.org/ArchitekturAM/fileversionCouldn
Source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.scintilla.org/License.txt
Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.scintilla.org/License.txtBat

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_0000000140060084 OpenClipboard,GetClipboardData,GlobalLock,wcslen,CloseClipboard,memcpy,GlobalUnWire,

5_2_0000000140060084

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140397EB4 SetClipboardData,	5_2_0000000140397EB4
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005FFD0 OpenClipboard,wcslen,GlobalAlloc,EmptyClipboard,GlobalLock,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	5_2_000000014005FFD0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1E8224 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalAlloc,GlobalLock,WideCharToMultiByte,GlobalUnlock,SetClipboardData,GlobalUnlock,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,SetClipboardData,SetClipboardData,CloseClipboard,	5_2_00007FFDFF1E8224

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_0000000140060084 OpenClipboard,GetClipboardData,GlobalLock,wcslen,CloseClipboard,memcpy,GlobalUnWire,

5_2_0000000140060084

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005DC08 GetFocus,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetClassNameW,_wcsncoll,IsDlgButtonChecked,GetKeyState,GetKeyState,GetKeyState,GetPropW,GetPropW,GetWindowThreadProcessId,GetCurrentProcessId,		5_2_000000014005DC08
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1E59F8 IsChild,GetDlgCtrlID,SystemParametersInfoA,RegisterDragDrop,GetCursorPos,ScreenToClient,SystemParametersInfoA,ClientToScreen,IsWindowUnicode,WideCharToMultiByte,GetKeyState,GetKeyState,GetKeyState,SendMessageA,GetMessageTime,ImmGetContext,ImmReleaseContext,GetKeyState,GetMessageTime,DefWindowProcA,MsgWaitForMultipleObjects,GetTickCount,PostMessageA,SetFocus,		5_2_00007FFDFF1E59F8

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005D068 GetPropW,DefFrameProcW,SetLastError,NtdllDefWindowProc_W,	5_2_000000014005D068
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140059267 GetClassNameW,_wcsicmp,_wcsicmp,_wcsicmp,NtdllDefWindowProc_W,CallWindowProcW,SetBkMode,DeleteObject,GetParent,GetClientRect,GetWindowRect,ScreenToClient,ScreenToClient,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateWindowExW,DestroyWindow,CreateBrushIndirect,DeleteObject,DeleteDC,GetParent,GetUpdateRect,MapWindowPoints,InvalidateRect,GetParent,CallWindowProcW,	5_2_0000000140059267
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005A27C GetWindowLongPtrW,CallWindowProcW,RemovePropW,RemovePropW,RevokeDragDrop,SetWindowLongPtrW,NtdllDefWindowProc_W,	5_2_000000014005A27C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140057E94 CallWindowProcW,GetWindowLongPtrW,GetClientRect,FillRect,NtdllDefWindowProc_W,	5_2_0000000140057E94
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140054030 NtdllDefWindowProc_W,GetWindowLongPtrW,GetPropW,SetWindowLongPtrW,RemovePropW,GetWindowTextW,GetWindowLongPtrW,SetPropW,SetWindowLongPtrW,	5_2_0000000140054030
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005E0CC HeapFree,NtdllDefWindowProc_W,	5_2_000000014005E0CC
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140055520 GetWindowLongPtrW,GetClientRect,GetClientRect,GetScrollRange,GetScrollRange,GetScrollPos,GetScrollPos,SetScrollPos,CallWindowProcW,GetWindowLongPtrW,GetClientRect,FillRect,NtdllDefWindowProc_W,	5_2_0000000140055520
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400526C8 GetWindowLongPtrW,SetCursor,BeginPaint,GetParent,IsDlgButtonChecked,FillRect,GetWindowTextW,SelectObject,GetClientRect,CreateRectRgnIndirect,SelectClipRgn,DeleteObject,IsWindowEnabled,SetBkMode,SetTextColor,TextOutW,GetTextExtentPoint32W,CreatePen,SelectObject,MoveToEx,LineTo,SelectObject,DeleteObject,DrawStateW,EndPaint,CallWindowProcW,CallWindowProcW,NtdllDefWindowProc_W,SetTimer,GetMessagePos,GetMessagePos,ScreenToClient,GetClientRect,GetParent,IsWindowEnabled,KillTimer,InvalidateRect,	5_2_00000001400526C8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140055744 GetParent,GetWindowLongPtrW,GetScrollPos,IsDlgButtonChecked,SetFocus,GetParent,CallWindowProcW,GetParent,GetWindowLongPtrW,GetClientRect,FillRect,NtdllDefWindowProc_W,	5_2_0000000140055744
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140397D84 NtdllDefWindowProc_W,	5_2_0000000140397D84

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140001000	5_2_0000000140001000
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005D138	5_2_000000014005D138
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400451E8	5_2_00000001400451E8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140042388	5_2_0000000140042388
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140084030	5_2_0000000140084030
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400CC040	5_2_00000001400CC040
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140085050	5_2_0000000140085050
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400570C4	5_2_00000001400570C4
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014006012C	5_2_000000014006012C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014008015E	5_2_000000014008015E
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140064258	5_2_0000000140064258
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400CA2F0	5_2_00000001400CA2F0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400803D5	5_2_00000001400803D5
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005F444	5_2_000000014005F444
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014007D4D0	5_2_000000014007D4D0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400CB5C0	5_2_00000001400CB5C0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400D75F0	5_2_00000001400D75F0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400766A0	5_2_00000001400766A0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400526C8	5_2_00000001400526C8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005B6CC	5_2_000000014005B6CC
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400576E8	5_2_00000001400576E8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400856F0	5_2_00000001400856F0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400447C0	5_2_00000001400447C0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004788C	5_2_000000014004788C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400F9930	5_2_00000001400F9930
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140079950	5_2_0000000140079950
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140084980	5_2_0000000140084980
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140065A20	5_2_0000000140065A20
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140079A30	5_2_0000000140079A30
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014007FACD	5_2_000000014007FACD
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400FBAF0	5_2_00000001400FBAF0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400D6B50	5_2_00000001400D6B50
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400C9C20	5_2_00000001400C9C20
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014007FC65	5_2_000000014007FC65
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140083CA0	5_2_0000000140083CA0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140083CB0	5_2_0000000140083CB0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014006BCB0	5_2_000000014006BCB0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140075E00	5_2_0000000140075E00
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140073E60	5_2_0000000140073E60
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014009AF20	5_2_000000014009AF20
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004EF58	5_2_000000014004EF58
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140047FC8	5_2_0000000140047FC8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014006DFD4	5_2_000000014006DFD4
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1E59F8	5_2_00007FFDFF1E59F8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1CE214	5_2_00007FFDFF1CE214
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21FF9C	5_2_00007FFDFF21FF9C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1D3FBC	5_2_00007FFDFF1D3FBC
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22AFA4	5_2_00007FFDFF22AFA4
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF224020	5_2_00007FFDFF224020
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF20EE70	5_2_00007FFDFF20EE70
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F9EC0	5_2_00007FFDFF1F9EC0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1DCF48	5_2_00007FFDFF1DCF48
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1EADD4	5_2_00007FFDFF1EADD4
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22BDE4	5_2_00007FFDFF22BDE4
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F4E54	5_2_00007FFDFF1F4E54
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF235E38	5_2_00007FFDFF235E38
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21DC84	5_2_00007FFDFF21DC84
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21CC88	5_2_00007FFDFF21CC88
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF215B94	5_2_00007FFDFF215B94
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F1B94	5_2_00007FFDFF1F1B94
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22EB70	5_2_00007FFDFF22EB70
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1CCB70	5_2_00007FFDFF1CCB70
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1FDBB4	5_2_00007FFDFF1FDBB4
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1DFA80	5_2_00007FFDFF1DFA80
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1EDAA0	5_2_00007FFDFF1EDAA0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF20FAEC	5_2_00007FFDFF20FAEC
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF211B58	5_2_00007FFDFF211B58
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF203B54	5_2_00007FFDFF203B54
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF20CB48	5_2_00007FFDFF20CB48
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1C6B24	5_2_00007FFDFF1C6B24
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1FF9C8	5_2_00007FFDFF1FF9C8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF20BA2C	5_2_00007FFDFF20BA2C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1FE87C	5_2_00007FFDFF1FE87C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21B8C0	5_2_00007FFDFF21B8C0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1EE8F0	5_2_00007FFDFF1EE8F0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1DF8F0	5_2_00007FFDFF1DF8F0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F0920	5_2_00007FFDFF1F0920
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21993C	5_2_00007FFDFF21993C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF20979C	5_2_00007FFDFF20979C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F5794	5_2_00007FFDFF1F5794
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22A768	5_2_00007FFDFF22A768
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21D7DC	5_2_00007FFDFF21D7DC
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1EB7F8	5_2_00007FFDFF1EB7F8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22970C	5_2_00007FFDFF22970C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF2026E0	5_2_00007FFDFF2026E0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF2226E8	5_2_00007FFDFF2226E8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F4740	5_2_00007FFDFF1F4740
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1EF720	5_2_00007FFDFF1EF720
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF20D590	5_2_00007FFDFF20D590
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF214598	5_2_00007FFDFF214598
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F2598	5_2_00007FFDFF1F2598
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1FB64C	5_2_00007FFDFF1FB64C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21A644	5_2_00007FFDFF21A644
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22764C	5_2_00007FFDFF22764C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF23163C	5_2_00007FFDFF23163C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1FC49C	5_2_00007FFDFF1FC49C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF210460	5_2_00007FFDFF210460
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1E4504	5_2_00007FFDFF1E4504
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF21E3C0	5_2_00007FFDFF21E3C0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF2323AC	5_2_00007FFDFF2323AC
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF228438	5_2_00007FFDFF228438
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1CB260	5_2_00007FFDFF1CB260
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1FF318	5_2_00007FFDFF1FF318
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22530C	5_2_00007FFDFF22530C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF2152EC	5_2_00007FFDFF2152EC
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1ED1C8	5_2_00007FFDFF1ED1C8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F8200	5_2_00007FFDFF1F8200
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F71F0	5_2_00007FFDFF1F71F0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF235234	5_2_00007FFDFF235234
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF20A234	5_2_00007FFDFF20A234
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1FD098	5_2_00007FFDFF1FD098
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF1F10D0	5_2_00007FFDFF1F10D0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF23111C	5_2_00007FFDFF23111C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF2010E8	5_2_00007FFDFF2010E8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF209144	5_2_00007FFDFF209144

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: String function: 00000001400C7720 appears 52 times
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: String function: 0000000140072F30 appears 412 times
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: String function: 00007FFDFF22F1C0 appears 157 times
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: String function: 0000000140073020 appears 65 times

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-54DM0.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-54DM0.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670350947.00000000024C6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670603131.000000007FE32000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-48PVO.tmp.1.dr	Static PE information: Section: UPX1 ZLIB complexity 0.999680434853633
Source: upx.exe.5.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9970993193069307

Source: classification engine

Classification label: clean16.evad.winEXE@5/33@0/1

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_0000000140014D9A BeginUpdateResourceW,SizeofResource,UpdateResourceW,EndUpdateResourceA,FreeLibrary,

5_2_0000000140014D9A

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

File created: C:\Program Files\Bat To Exe Converter

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

File created: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: Bat_To_Exe_Converter.exe	String found in binary or memory: -help
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	Process created: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp "C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp" /SL5="$20438,4092287,121344,C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe"
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process created: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe "C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	Process created: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp "C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp" /SL5="$20438,4092287,121344,C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process created: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe "C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: ehstorshell.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Bat To Exe Converter.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
Source: Uninstall Bat To Exe Converter.lnk.1.dr	LNK file: ..\..\..\..\..\..\Program Files\Bat To Exe Converter\unins000.exe

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Automated click: I accept the agreement

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.License AgreementCopyright (c) 2019 Fatih KodakPermission is hereby granted free of charge to any person obtaining a copyof this software and associated documentation files (the "Software") to dealin the Software without restriction including without limitation the rightsto use copy modify merge publish distribute sublicense and/or sellcopies of the Software and to permit persons to whom the Software isfurnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included inall copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS ORIMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITYFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHERLIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROMOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS INTHE SOFTWARE. I &accept the agreementI &do not accept the agreement&Next >Cancel
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.License AgreementCopyright (c) 2019 Fatih KodakPermission is hereby granted free of charge to any person obtaining a copyof this software and associated documentation files (the "Software") to dealin the Software without restriction including without limitation the rightsto use copy modify merge publish distribute sublicense and/or sellcopies of the Software and to permit persons to whom the Software isfurnished to do so subject to the following conditions:The above copyright notice and this permission notice shall be included inall copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EXPRESS ORIMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITYFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHERLIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROMOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS INTHE SOFTWARE. I &accept the agreementI &do not accept the agreement&Next >Cancel

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Window detected: Number of UI elements: 34

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter\is-54DM0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Directory created: C:\Program Files\Bat To Exe Converter\is-48PVO.tmp	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60C29EC2-33E8-45EE-87E4-31FA3E35C539}_is1

Jump to behavior

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Static file information: File size 4482593 > 1048576

Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: Z?.PDB source: Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: d:\dev\All\shared\3rd_Party\Scintilla\1.76\bin\SciLexer.pdb source: Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Scilexer.dll.5.dr

Data Obfuscation

Yara detected BatToExe compiled binary

Source: Yara match	File source: 5.2.Bat_To_Exe_Converter.exe.1402216dd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bat_To_Exe_Converter.exe.1401e0add.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bat_To_Exe_Converter.exe.140150618.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bat_To_Exe_Converter.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bat_To_Exe_Converter.exe PID: 6128, type: MEMORYSTR

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_000000014004C1BC LoadLibraryW,GetProcAddress,wcscpy,wcscat,wcslen,FreeLibrary,wcscat,wcslen,

5_2_000000014004C1BC

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140075191 push rbp; iretd	5_2_0000000140075192
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014007538F push r13; retf	5_2_0000000140075391
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014007538C push rbp; retf	5_2_000000014007538D
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400746EA pushfq ; retf	5_2_00000001400746EB
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400746F1 pushfq ; retf	5_2_00000001400746F8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140074EF9 push rbp; retf	5_2_0000000140074F00
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_0000000140074F02 push r13; retf	5_2_0000000140074F04

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	File created: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Jump to dropped file
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File created: C:\Users\user\AppData\Roaming\Bat To Exe Converter\upx.exe	Jump to dropped file
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File created: C:\Users\user\AppData\Roaming\Bat To Exe Converter\Scilexer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\Program Files\Bat To Exe Converter\is-54DM0.tmp	Jump to dropped file
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File created: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoRC.exe	Jump to dropped file
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File created: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\Program Files\Bat To Exe Converter\is-48PVO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DVABN.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\Program Files\Bat To Exe Converter\unins000.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bat To Exe Converter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bat To Exe Converter\Bat To Exe Converter.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bat To Exe Converter\Uninstall Bat To Exe Converter.lnk	Jump to behavior

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005C6A8 GetWindow,SetActiveWindow,GetWindow,IsZoomed,IsIconic,IsIconic,ShowWindow,	5_2_000000014005C6A8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005C6A8 GetWindow,SetActiveWindow,GetWindow,IsZoomed,IsIconic,IsIconic,ShowWindow,	5_2_000000014005C6A8
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014005CE70 IsZoomed,IsIconic,	5_2_000000014005CE70

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Window / User API: threadDelayed 882

Jump to behavior

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Bat To Exe Converter\upx.exe	Jump to dropped file
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Bat To Exe Converter\Scilexer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Dropped PE file which has not been started: C:\Program Files\Bat To Exe Converter\is-54DM0.tmp	Jump to dropped file
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoRC.exe	Jump to dropped file
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DVABN.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Dropped PE file which has not been started: C:\Program Files\Bat To Exe Converter\unins000.exe (copy)	Jump to dropped file

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_5-103273

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809			Jump to behavior

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004BD20 wcslen,wcslen,RtlAllocateHeap,wcscpy,wcscat,wcscat,FindFirstFileW,GetLastError,HeapFree,	5_2_000000014004BD20
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004C040 wcsncpy,wcslen,wcscat,GetDriveTypeW,FindFirstFileW,FindClose,GetFileAttributesW,GetDriveTypeW,	5_2_000000014004C040
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_000000014004C434 wcsncpy,wcslen,wcsncpy,_snwprintf,FindFirstFileW,_snwprintf,wcscmp,wcscmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,	5_2_000000014004C434

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming\Bat To Exe Converter	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoRC.exe	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe	Jump to behavior
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Bat_To_Exe_Converter.exe, 00000005.00000002.2924024021.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.2021422458.000000000067C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\3

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

API call chain: ExitProcess graph end node

graph_5-103407

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_00007FFDFF22DB70 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

5_2_00007FFDFF22DB70

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_000000014004C1BC LoadLibraryW,GetProcAddress,wcscpy,wcscat,wcslen,FreeLibrary,wcscat,wcslen,

5_2_000000014004C1BC

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00000001400471B0 RtlRemoveVectoredExceptionHandler,RtlAddVectoredExceptionHandler,	5_2_00000001400471B0
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22DB70 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFDFF22DB70
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF22F270 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFDFF22F270
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: 5_2_00007FFDFF23212C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFDFF23212C

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: GetLocaleInfoA,		5_2_00007FFDFF23605C
Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe	Code function: GetKeyboardLayout,GetLocaleInfoA,		5_2_00007FFDFF1E5434

Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_000000014005F8E4 GetLocalTime,

5_2_000000014005F8E4

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_00000001400439C8 memset,memset,GetVersionExW,CreateWindowExW,SetWindowLongPtrW,IsDlgButtonChecked,

5_2_00000001400439C8

Source: C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe

Code function: 5_2_000000014039813C WSACleanup,bind,connect,

5_2_000000014039813C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	3 Masquerading	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	21 Obfuscated Files or Information	NTDS	11 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	3%	ReversingLabs
SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	4%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe (copy)	0%	ReversingLabs
C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe (copy)	1%	Virustotal	Browse
C:\Program Files\Bat To Exe Converter\is-48PVO.tmp	0%	ReversingLabs
C:\Program Files\Bat To Exe Converter\is-48PVO.tmp	1%	Virustotal	Browse
C:\Program Files\Bat To Exe Converter\is-54DM0.tmp	5%	ReversingLabs
C:\Program Files\Bat To Exe Converter\is-54DM0.tmp	0%	Virustotal	Browse
C:\Program Files\Bat To Exe Converter\unins000.exe (copy)	5%	ReversingLabs
C:\Program Files\Bat To Exe Converter\unins000.exe (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\is-DVABN.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DVABN.tmp\_isetup\_setup64.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe	3%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoRC.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Bat To Exe Converter\Scilexer.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Bat To Exe Converter\upx.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/	0%	Avira URL Cloud	safe
https://upx.github.io/upx-license.htmlKonverterAltStyleGPL	0%	Avira URL Cloud	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/thttp://127.0.0.1:43110/17SWVnHoujG92yYGSZ	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/Submit	0%	Avira URL Cloud	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/D	0%	Avira URL Cloud	safe
https://upx.github.io	0%	Avira URL Cloud	safe
https://upx.github.ioEine	0%	Avira URL Cloud	safe
http://www.innosetup.com/	2%	Virustotal		Browse
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/Submit	0%	Virustotal		Browse
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/thttp://127.0.0.1:43110/17SWVnHoujG92yYGSZ	0%	Virustotal		Browse
https://upx.github.io/upx-license.html	0%	Avira URL Cloud	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/	0%	Virustotal		Browse
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/q	0%	Avira URL Cloud	safe
https://upx.github.io/upx-license.htmlKonverterAltStyleGPL	0%	Virustotal		Browse
https://upx.github.io	0%	Virustotal		Browse
https://upx.github.ioT	0%	Avira URL Cloud	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi//b2e/downloads/v.zip	0%	Avira URL Cloud	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/a	0%	Avira URL Cloud	safe
https://www.everaldo.com/	0%	Avira URL Cloud	safe
http://www.godevtool.comProduktversionCMD	0%	Avira URL Cloud	safe
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/q	0%	Virustotal		Browse
https://upx.github.io/upx-license.html	0%	Virustotal		Browse
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/D	0%	Virustotal		Browse
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/a	1%	Virustotal		Browse
https://www.everaldo.com/	0%	Virustotal		Browse
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi//b2e/downloads/v.zip	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670603131.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670350947.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000000.1671462023.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp.0.dr, is-54DM0.tmp.1.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://upx.github.io/upx-license.htmlKonverterAltStyleGPL	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.godevtool.com/GolinkFrame.htm	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/thttp://127.0.0.1:43110/17SWVnHoujG92yYGSZ	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1669725255.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.1672186745.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/Submit	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe	false		high
http://curl.haxx.se/docs/http-cookies.html#	Bat_To_Exe_Converter.exe	false		high
https://github.com/99fkDokumenteLetzte	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
https://www.scintilla.org/	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.scintilla.org/License.txt	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.2024179186.00000000021FA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.2020443763.000000000235B000.00000004.00001000.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/99fk	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.godevtool.com/GorcFrame.htmPrivateBuildprivatebuildInterner	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
http://www.f2ko.de/de/cmd.php	Bat_To_Exe_Converter.exe	false		high
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/D	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000002.2021745061.000000000018E000.00000004.00000010.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000000.2018248651.00000001403C7000.00000008.00000001.01000000.00000008.sdmp, is-48PVO.tmp.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://upx.github.io	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://upx.github.ioEine	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/Vh5j3k	Bat_To_Exe_Converter.exe, 00000005.00000002.2924024021.000000000065B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://upx.github.io/upx-license.html	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://curl.haxx.se/docs/http-cookies.html	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
http://www.godevtool.com/GorcFrame.htm	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/odirm	Bat_To_Exe_Converter.exe, 00000005.00000002.2924024021.000000000065B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.f2ko.de/en/cmd.phpVideosJapanese	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/q	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.2020443763.000000000235B000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.f2ko.de/de/cmd.phpDatei	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
http://www.godevtool.com	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi//b2e/downloads/v.zip	Bat_To_Exe_Converter.exe, 00000005.00000002.2924789685.0000000002ED6000.00000004.00000020.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.scintilla.org/ArchitekturAM/fileversionCouldn	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
https://upx.github.ioT	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, upx.exe.5.dr	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670603131.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe, 00000000.00000003.1670350947.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000000.1671462023.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp.0.dr, is-54DM0.tmp.1.dr	false	URL Reputation: safe	unknown
https://www.scintilla.org/License.txtBat	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
http://www.godevtool.com/GolinkFrame.htm/display	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false		high
http://www.f2ko.de/en/cmd.php	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/a	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp, 00000001.00000003.2020443763.000000000235B000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.godevtool.comProduktversionCMD	Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://www.everaldo.com/	Bat_To_Exe_Converter.exe, Bat_To_Exe_Converter.exe, 00000005.00000002.2924550088.00000000022A9000.00000004.00000020.00020000.00000000.sdmp, Bat_To_Exe_Converter.exe, 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431820
Start date and time:	2024-04-25 20:39:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe
Detection:	CLEAN
Classification:	clean16.evad.winEXE@5/33@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 124 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp	expat-win32bin-2.6.2.exe	Get hash	malicious	Unknown	Browse
	Ps1_To_Exe_(Installer).exe	Get hash	malicious	Unknown	Browse
	CHT1044.Compact.Analyzer.v2.34.10.0.exe	Get hash	malicious	Unknown	Browse
	window driver-Receipt.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	5CdYzOKRTr.exe	Get hash	malicious	Unknown	Browse
	GoogleTranslateDesktop.exe	Get hash	malicious	Unknown	Browse
	483595855.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	WinCash_Backoffice.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2105856
Entropy (8bit):	7.972220715342655
Encrypted:	false
SSDEEP:	49152:NOPSa4ZImzdAxZmKLEb+T+VY07d7AidLAbbtwSjugk:NraitzdAfBEa0AiLAbbO0ugk
MD5:	E3D6B93E861FEEFA47CCEEAE03E99094
SHA1:	94AC369EA396C6A4C23DDCFB41CFDFE81CE0B3DA
SHA-256:	55DF60E09826469E543C090198AC6A12E1269047A88ED698E25E6E62D83FF4C7
SHA-512:	2C00287925DCB22B4BABD7C49E9035CCB92B895F123791EF361FF495B08D74FE1E9ADD54C1FCABD4DE3CD396FAAFECCBAE0C750913D911DBA6531F51AB126402
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....@]........../....2.....@...p...X<........@..............................>...............................................................>.$....p<..7..........................................................................................................UPX0.....p..............................UPX1................................@....rsrc....@...p<..<..................@...3.94.UPX!.$..~.J.....E<<.......;.I......$ ..].e..M....L....3...JY.h.. .I...(.J.....^.s..Y........ On..f&.4.J.S.):.O.R(7s._.U,X...t..1H\|...X<...J^1m../.&.......].>..[D.#....u...vqT...k..m...N.<.......D>...\|.@/.&..&Q..4..W...!q.m..e0...C?..M..k..7..79.....5...'..l]..!........A,$7If.<.4S.....w&z.......]n......;........Q...............n.-...K.+v9.....b.<J....?FXD..3.........t.h8..K.Q*..?.7.ia.\<....-t..}..b..6$f'....h{l...X.g..S1$..f.....a(.7=.......6Y%..'/./....u

C:\Program Files\Bat To Exe Converter\is-48PVO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2105856
Entropy (8bit):	7.972220715342655
Encrypted:	false
SSDEEP:	49152:NOPSa4ZImzdAxZmKLEb+T+VY07d7AidLAbbtwSjugk:NraitzdAfBEa0AiLAbbO0ugk
MD5:	E3D6B93E861FEEFA47CCEEAE03E99094
SHA1:	94AC369EA396C6A4C23DDCFB41CFDFE81CE0B3DA
SHA-256:	55DF60E09826469E543C090198AC6A12E1269047A88ED698E25E6E62D83FF4C7
SHA-512:	2C00287925DCB22B4BABD7C49E9035CCB92B895F123791EF361FF495B08D74FE1E9ADD54C1FCABD4DE3CD396FAAFECCBAE0C750913D911DBA6531F51AB126402
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....@]........../....2.....@...p...X<........@..............................>...............................................................>.$....p<..7..........................................................................................................UPX0.....p..............................UPX1................................@....rsrc....@...p<..<..................@...3.94.UPX!.$..~.J.....E<<.......;.I......$ ..].e..M....L....3...JY.h.. .I...(.J.....^.s..Y........ On..f&.4.J.S.):.O.R(7s._.U,X...t..1H\|...X<...J^1m../.&.......].>..[D.#....u...vqT...k..m...N.<.......D>...\|.@/.&..&Q..4..W...!q.m..e0...C?..M..k..7..79.....5...'..l]..!........A,$7If.<.4S.....w&z.......]n......;........Q...............n.-...K.+v9.....b.<J....?FXD..3.........t.h8..K.Q*..?.7.ia.\<....-t..}..b..6$f'....h{l...X.g..S1$..f.....a(.7=.......6Y%..'/./....u

C:\Program Files\Bat To Exe Converter\is-54DM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1202385
Entropy (8bit):	6.3676423528784865
Encrypted:	false
SSDEEP:	24576:JtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt1:3qTytRFk6ek1L2
MD5:	628B00C12FAC5A7E788FDFD8A02244D1
SHA1:	7C318E92F2AE8E77FBF3669C65D56E4691648CE3
SHA-256:	BBD0534581D5EF17243748536FD95C31031600017C97F1645E83E44F1A7B2E62
SHA-512:	3061987D15DAF427824771DBEAA56692C51817EB814B52309EF061606892CB1A71DE7A4895CE33C6D38A313DC990ACEDED237F90D2202802BD02472E25A5EE49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Program Files\Bat To Exe Converter\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	InnoSetup Log 64-bit Bat To Exe Converter {60C29EC2-33E8-45EE-87E4-31FA3E35C539}, version 0x418, 4039 bytes, 258555\37\user\376, C:\Program Files\Bat To Exe Converter\376\
Category:	dropped
Size (bytes):	4039
Entropy (8bit):	3.5882877667893496
Encrypted:	false
SSDEEP:	96:3fCpbcuJlEDA4MZAe2L2ICDcCJC6lCDUCph7Cph4HHhqe:3WbP4DSmpckHp
MD5:	80AEC56BA3D0709D35D42B8B38D9BF3F
SHA1:	8CB6A748FCDED66A2B0EB1F2253CB131214E031F
SHA-256:	D273D2462493CFB5DAF9145E53B8D3321964946E42DC02041DA537281B77C4F9
SHA-512:	BCDC2B857C1ABC2639C80E89D77EC27ED62B75927648392EFA0FC267E8A4937B26577EE359C92B5C7ED02B95F389F899A528E40B5CD0B2E83177F6743208893F
Malicious:	false
Reputation:	low
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................{60C29EC2-33E8-45EE-87E4-31FA3E35C539}..........................................................................................Bat To Exe Converter........................................................................................................................%...............................................................................................................@..+.........+GQ...............2.5.8.5.5.5......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r................(...F.. ..............IFPS....................................................................................................................................................................BOOLEAN......................!MAIN....-1..IS64BITINSTALLMODE................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r..n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o

C:\Program Files\Bat To Exe Converter\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1202385
Entropy (8bit):	6.3676423528784865
Encrypted:	false
SSDEEP:	24576:JtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt1:3qTytRFk6ek1L2
MD5:	628B00C12FAC5A7E788FDFD8A02244D1
SHA1:	7C318E92F2AE8E77FBF3669C65D56E4691648CE3
SHA-256:	BBD0534581D5EF17243748536FD95C31031600017C97F1645E83E44F1A7B2E62
SHA-512:	3061987D15DAF427824771DBEAA56692C51817EB814B52309EF061606892CB1A71DE7A4895CE33C6D38A313DC990ACEDED237F90D2202802BD02472E25A5EE49
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bat To Exe Converter\Bat To Exe Converter.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 17:40:25 2024, mtime=Thu Apr 25 17:40:26 2024, atime=Tue Jul 30 08:54:40 2019, length=2105856, window=hide
Category:	dropped
Size (bytes):	1015
Entropy (8bit):	4.534697656204505
Encrypted:	false
SSDEEP:	24:8mnRldygJ/IWjVrUADhhMdFWQxdFWtr/Bm:8mndhRjDhhMddd2F
MD5:	F42E62654AEAE9ABAC3C82E5B18D3119
SHA1:	B528E3F69F7B4E0B24B4F050EBCB67831665FA4C
SHA-256:	C899E33D85FACA785819143235C0EAF3297BA07267CA2B3D7ABF9621B95C9007
SHA-512:	31A9822B6A9D5E50BC5AC21A57AEB57EA4A6EF0DACD104EEE8BAE7FEBA941047E3E4A9CE8B53C2DB5E43439D5DEC071A47D90FEFCBD23BA59DD01B8679D0A25D
Malicious:	false
Reputation:	low
Preview:	L..................F.... ...L..@....l..@.......F..." ..........................P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDWQ`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....r.1......X....BATTOE~1..Z......X...X............................&.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r.....~.2.." ..N.N .BAT_TO~1.EXE..b......X...X...............................B.a.t._.T.o._.E.x.e._.C.o.n.v.e.r.t.e.r...e.x.e.......m...............-.......l...........?$d......C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe..M.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r.\.B.a.t._.T.o._.E.x.e._.C.o.n.v.e.r.t.e.r...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r.`.......X.......258555...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bat To Exe Converter\Uninstall Bat To Exe Converter.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 17:40:25 2024, mtime=Thu Apr 25 17:40:25 2024, atime=Thu Apr 25 17:39:56 2024, length=1202385, window=hide
Category:	dropped
Size (bytes):	955
Entropy (8bit):	4.5891660457182555
Encrypted:	false
SSDEEP:	24:8mmAbdygJ/IWkDhIQA/h4dFWNgdFWtrTBm:8mm0dhQDh4/h4dOgd2Z
MD5:	991F6FE2A628D3996237065EE5FA004D
SHA1:	76E30774608496332AA507ED634E6A95BB50C3CE
SHA-256:	FA6E32B7F0DDE54847C6BAD806960E2B410E17BC5B8F57B95DEAB2FA2AD8B767
SHA-512:	FFAB602FFF593244C2AF667761D1456DF4E5B6DA2A6C5B056D54AAF09A35C17ACA449C3133BFFBE333811B5A916100BE70574D8691E62FC56FD95F28260BC010
Malicious:	false
Reputation:	low
Preview:	L..................F.... ......@......@.....k.?....X...........................P.O. .:i.....+00.../C:\.....................1......X....PROGRA~1..t......O.I.X......B...............J.......:.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....r.1......X....BATTOE~1..Z......X...X............................&.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r.....f.2..X...X.. .unins000.exe..J......X...X............................:..u.n.i.n.s.0.0.0...e.x.e.......a...............-.......`...........?$d......C:\Program Files\Bat To Exe Converter\unins000.exe..A.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r.\.u.n.i.n.s.0.0.0...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.a.t. .T.o. .E.x.e. .C.o.n.v.e.r.t.e.r.`.......X.......258555...........hT..CrF.f4... .".T..b...,.......hT..CrF.f4... .".T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.395287124443116
Encrypted:	false
SSDEEP:	24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
MD5:	90FC739C83CD19766ACB562C66A7D0E2
SHA1:	451F385A53D5FED15E7649E7891E05F231EF549A
SHA-256:	821BD11693BF4B4B2B9F3C196036E1F4902ABD95FB26873EA6C43E123B8C9431
SHA-512:	4CB11AD48B7585EF1B70FAC9E3C25610B2F64A16358CD51E32ADCB0B17A6AB1C934AEB10ADAA8E9DDF69B2E2F1D18FE2E87B49B39F89B05EA13AA3205E41296C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: expat-win32bin-2.6.2.exe, Detection: malicious, Browse Filename: Ps1_To_Exe_(Installer).exe, Detection: malicious, Browse Filename: CHT1044.Compact.Analyzer.v2.34.10.0.exe, Detection: malicious, Browse Filename: window driver-Receipt.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: 5CdYzOKRTr.exe, Detection: malicious, Browse Filename: GoogleTranslateDesktop.exe, Detection: malicious, Browse Filename: 483595855.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: WinCash_Backoffice.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DVABN.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Bat To Exe Converter\662566134.cmd

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Roaming\Bat To Exe Converter\867292396.bat

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.38249525851103
Encrypted:	false
SSDEEP:	768:kWyGCFzNhPlIpVnwuDbU0xy576WK73T3aFfVbBiRchq/rgIQs1GAXw1WInr7llh0:kDFpgpBd80OK7D0VbBiyADg9s1JXw4Iz
MD5:	CAFC4EEC8A4F05B8DFEE4067FB5B9076
SHA1:	38F4C66246636E187FE4BF2AA8CB1D9B2502A14C
SHA-256:	1FA554D18490CB5E56D624CD97069F42E63800688136C6CF3C521E4EF6E83E28
SHA-512:	3C3E7C874E6B182AEF812A1B593C3B1A3EA6EFD5AE99792B88009CB6E6E0CEE13C46FC26A1DBB7D73899A2ED01F73779C06D85246FD23EDC6BF04FE41E0E133B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZl.....................@.......Win32 Program!..$......!.L.!`...GoLink, GoAsm www.GoDevTool.com.PE..L.....\I.................x...<.......\|............@..................................U........... ..............................(.......................................3...........................................$...............................code.....w.......x.................. ..`data.....D.......*...\|..............@....rsrc...............................@..@.rdata..3...........................@..@.idata..h........................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoRC.exe

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	6.505164558362332
Encrypted:	false
SSDEEP:	1536:ob9eNDMeUu2rpfT+Rpog93zAecGMWEPwv+iRS6:oENDILpg7nYpiV
MD5:	F69B0E5F35B5DAE1B11B950CFF157FB3
SHA1:	F582F77D036C362F1EC5A0AB11707143CB0C9220
SHA-256:	ED010C50A7CEB43B9666E7FBCA13D8377D30B79203207BAD77004A890ADEEA17
SHA-512:	F0AC0B51A80D20148D069A231D50A581E6580EA45ADC2D15C15182C9551363E204E119DAAC544C37AC6D9E93B75AB73E90E9947E7BF3CF86707A5C5645E2750C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZl.....................@.......Win32 Program!..$......!.L.!`...GoLink, GoAsm www.GoDevTool.com.PE..L...t.\I...............&.v...\......0*............@..........................@..............................................0..(.......p............................ ..1............................................0..............................code.....v.......v.................. ..`data.....z.......J...z..............@....rsrc...p...........................@..@.rdata..1.... ......................@..@.idata.......0...................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Bat To Exe Converter\Scilexer.dll

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	568320
Entropy (8bit):	6.362114578604268
Encrypted:	false
SSDEEP:	6144:FuyRri/YTtF1LbOtbvMMhLxodmpjSIZ/KfmGE178z0srIW4w23Y8D9xbDUV7R0Kq:FucNtFJCxvBLxodojSIZKmX5sr/h4Ik
MD5:	0239B5B3A757CE3367335E873B9D9DDA
SHA1:	11A2EA37F1AAA80C547B07DEE5B7D1B727809376
SHA-256:	2B04DB2CAA0064A89DCB8137077F12DE5D2B72389CEEED1227CE7C80C5C7023A
SHA-512:	859013A987E49991E55EE826EF1CE3593163AB37ED19F0DB1587D729CBAD1897EA09401556AE0DF2B840972DC4909BF479047A42B1DB387136CD68659BD515BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............le..le..le.....le..>...le..>..le..>...le.....le..ld.%le..>..le..>...le..>...le..>...le.Rich.le.................PE..d......G.........." .....z...R............................................................@..........................................=..X...4(..x.......x.......0-..................................................................................................text....x.......z.................. ..`.rdata...............~..............@..@.data...`\...@...:...,..............@....pdata..0-...........f..............@..@.rsrc...x...........................@..@.reloc..f...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Bat To Exe Converter\extd.chm

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	20381
Entropy (8bit):	5.87618803287666
Encrypted:	false
SSDEEP:	192:3cVkQ/kDkglpmDHrjhxqIUexuvMc7PwiloGn2NgjaJ+poKuHTrUDuoOHLO5Fpib0:3c6Qc3mDfUDvMcv/nA8akoKukDwZPs
MD5:	D4FC8C71A167383B2CEA62137B12F63D
SHA1:	A065B7A9479C0FCE752DFB1120C58310661EB4AB
SHA-256:	2786F9B9CDF8A73396405CE59CB6D00FAD9D51E5136183999D14A5CB9F5D80FB
SHA-512:	D60F2841DC6C873D6B26A0A2D019878AFDEBB52426C05F57C40C54181352A98FA4E628202313D718274C96767D5D3095FEFEFBEBD307DE61EE3B7F0A08666989
Malicious:	false
Preview:	ITSF....`.......YE.........\|.{.......".....\|.{......."..`...............x.......T........................O..............ITSP....T...........................................j..].!......."..T...............PMGL-................/..../#IDXHDR......./#ITBITS..../#STRINGS...n.x./#SYSTEM..F.../#TOPICS.....`./#URLSTR...:.4./#URLTBL...r.H./$FIftiMain..../$OBJINST...S.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...O../$WWKeywordLinks/..../$WWKeywordLinks/Property...K../ext.html..5..../help.hhc...5.::DataSpace/NameList..<(::DataSpace/Storage/MSCompressed/Content..K..,::DataSpace/Storage/MSCompressed/ControlData.j.)::DataSpace/Storage/MSCompressed/SpanInfo.b./::DataSpace/Storage/MSCompressed/Transform/List.<&_::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0C91E9C7C}/InstanceData/...i::DataSpace/Storage/MSCompressed/Transform/{7FC28940-9D31-11D0-9B27-00A0C91E9C7C}/InstanceData/ResetTable...@.........................................................................

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\??? (Japanese).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6427
Entropy (8bit):	5.413103855303524
Encrypted:	false
SSDEEP:	192:QVvN9zpYcnuWDOCarYMDX3XmAlROa4xjbz:U9zQCKYgX3XMxjbz
MD5:	2125B2D9BFDA91CECA3ED41F4C861B4C
SHA1:	B0D6F35D8A60659FF40F1759B6207C81D99AC0F9
SHA-256:	876D4162596D4EFA962D5E214A3A801EAE4C8BFD36439D20880D5098F602321B
SHA-512:	2A009AA887643FE268D9130347A5940B7EEF134BF3DE16E2D43337CA41F5B71E5BECAC02BFD96BC0A36AFB202BF51D6CD70477F0CC77E5D6DC8E02A6290BF415
Malicious:	false
Preview:	...0 = 32.....1 = 64.....2 = ......................3 = .....................4 = ....5 = .......6 = ....7 = ................................8 = .........9 = .........10 = ............11 = .........12 = Alt..13 = ................14 = AppData..15 = .........16 = .....17 = ...=.....................18 = Bat To Exe Converter......... - .....................19 = .......20 = Captcha..21 = Captcha.........22 = ...........23 = .........................................24 = .............

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\??? (Korean).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5502
Entropy (8bit):	5.481178089670343
Encrypted:	false
SSDEEP:	96:e3g+6RnucNWIoSrE7eC5irlf8d4QscFKY+cdT5sHKoNNYps6O0Xq5Y+LbaE9QfJF:8g+knPw0os0KYtsqoNNU3XqY+3l9mJI8
MD5:	CFC7FC230EA20DC8E11BB17389FA57B2
SHA1:	23431C831BCC90F5678C9F9987359C69C57CD269
SHA-256:	63D5C6772D8998FBD0331092E96151CA31662A6A7AC7B11AF4F5E2FD30ED77F4
SHA-512:	5A10F9995AD54506E21D8E084B91C95417F9DC1BF55AD00F9B127803385E9A727DEFB38B22A89CF5AFDA9AED6932EC912FC56B82BB884AA318C4C606F627C682
Malicious:	false
Preview:	...0 = 32 ....1 = 64 ....2 = ... ... ... .. .........3 = ... ... .... .......4 = ....5 = .. .....6 = ....7 = ..... ... ... ... ... ........8 = ... ....9 = ... ....10 = .. .. ....11 = .. .. ....12 = Alt..13 = .. ..... .........14 = AppData..15 = ......16 = .....17 = ... = ... ... ..... .... .....18 = Bat To Exe Converter . ....... - ... .... .. ......!..19 = ....20 = Captcha..21 = Captcha .. .....22 = .... ....23 = . . .... ... ... . ... ... ... ........24 = . . .... .. .... ... .......25 = .....26 = ....27 = .. ....28 = CMD ... ....29 = ...

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\???? (Chinese Simplified).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4512
Entropy (8bit):	5.888205681855047
Encrypted:	false
SSDEEP:	96:4bkF2b86BVTbzxtcM/jFnGHAhf7Y/H1paCNexJs375lyEc8EV1Zw6:CkF2b86Bh1TCA9Y/VrNck/yEEVzw6
MD5:	8AB06A4B804350D0A232E65B82E992E1
SHA1:	B1C11CF302C18A2334EAA09DDA4C0EBAA54C2D77
SHA-256:	5A5FBE8998D1AA2C6CB7E16FA50861910C806AC3DF99E2026E8B577175B36133
SHA-512:	4B9F8324F5DA953AE18B8BB073CC8414BCBB9584E1AA5B6D80214EB00AC8BB8AA8B86EA94F901098AB03A924B0EEB49A3451D09408B563E2259892478468BB06
Malicious:	false
Preview:	...0 = 32 ...1 = 64 ...2 = ................3 = ............4 = ....5 = .. .....6 = ....7 = ........................8 = ......9 = ......10 = ........11 = .........12 = Alt..13 = .................14 = AppData..15 = ....16 = ....17 = .. = ..............18 = Bat To Exe Converter ..... . .........19 = ....20 = .....21 = ........22 = ......23 = ........................24 = ..............25 = ....26 = ....27 = ......28 = CMD-....29 = ....30 = ....31 = ....32 = .........33 = ....34 = ....35 = ....36 = ......37 = ........38 = ......39 = ........40 = .....

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\???? (Chinese Traditional).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4515
Entropy (8bit):	5.895445604698382
Encrypted:	false
SSDEEP:	96:aK7D0+JkfAcpBka45aGJz1XLLXQOYR1h7mKSFOZVfAfNX8EiVCc6:aK7D0+ydV34LXQOYPWOjfAVMEnc6
MD5:	4CCFE9DC8CDFE91117D59B8599419D26
SHA1:	AED9EFB0FE4715F3E0D7C72B996A1D148FA8D447
SHA-256:	B59693AB5279FEB735B9A10943BDBAE71C9CB363B1AA83E40F422142B39FF360
SHA-512:	E62FE04027297C3DD99F854211E2966D2E206B39CC9F37AB221F1C13591343795D73AA4883EA9F42F542878DACDB965815B92ED234D20E126FC323C411EEA6FE
Malicious:	false
Preview:	...0 = 32 ...1 = 64 ...2 = ................3 = ............4 = ....5 = .. .....6 = ....7 = ........................8 = ......9 = ......10 = ........11 = .........12 = Alt..13 = .................14 = AppData..15 = ....16 = ....17 = .. = ..............18 = Bat To Exe Converter ..... . .........19 = ....20 = .....21 = ........22 = ......23 = ........................24 = ..............25 = ....26 = ....27 = ......28 = CMD-....29 = ....30 = ....31 = ....32 = .........33 = ....34 = ....35 = ....36 = ......37 = ........38 = ......39 = ........40 = .....

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\????? (Hebrew).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6387
Entropy (8bit):	4.150753889633663
Encrypted:	false
SSDEEP:	192:X0w8lfNd5Zm/PzBNOTS4/J2gK/kycQfhuc:x8l1x+z2TS4/Jy/kgEc
MD5:	ACEF3CF2CD28076E5313A02F6984F754
SHA1:	E24231ADA7DD357F7C1CA78A7A88700782B50E37
SHA-256:	4564DAC8FD1DE4C66D9506C516198A079CF6C98B9EC4F8A7527C27F44800CC22
SHA-512:	901CE97986BC2476433D8F6CABCE99ABCBA16CBA41F68F5CC1645133D43E6AB67D20E3F1C7DB08BDC18EC1A957CA371AAACB5468970C7A34574444D61E6F04EA
Malicious:	false
Preview:	...0 = .... 32 ........1 = .... 64 ........2 = .... ..... .. ... ......3 = .... .... ..... ........4 = .......5 = ..........6 = ......7 = .... ..... ....... ..... ..... ..... ...... ... ......8 = ..... .......9 = ..... ........10 = ..... .... ......11 = .... .... ... ......12 = Alt..13 = .... .. ..... ... ... ......14 = ..... AppData..15 = ............16 = ...........17 = ......... - .. ..... .. ........ ....... .........18 = ..... ... ..... ..... . .... ... ...... ...... .. ........19 = .......20 = ... .......21 = ... ..... ......22 = .... .........23 = ..... .".." .... .. ...... ........ ...... ..... ........24 =

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\??????? (Arabic).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	4.4351898698934304
Encrypted:	false
SSDEEP:	96:IEWliR8xl/tuuAvoyUNH0q+tzXiLFSzfwqiowiXUbVlNH7ZUEY4Uf2hqoC5SFbyo:PWU4cuAINH0tSLgHiIUH9ZUJ/f2M2bF
MD5:	101A8B4AE341C9D9ACD37626BA3909F5
SHA1:	8716D647EA6AA120E6B00975DDBDF076570264AD
SHA-256:	F12BF0E1FF2327107B92DE4D69234D0364B530B34761E01CCB021805C3ABE562
SHA-512:	CF10C1956FBA214F85EA621EBCC3C334A90AB93D38F4641DB7B1735687CD70A57DD406F81B2B36E6461E62A06A2A490F5AE5C6418140010CEBE78AD9413A8F5A
Malicious:	false
Preview:	...0 = 32 Bit..1 = 64 Bit..2 = ... .... ..... ..... ........3 = ..... ..... .... .........4 = .....5 = ........6 = .......7 = ..... ....... ......... .... .... ....... .. ..... ...... ....... .....8 = ..... ........9 = ..... .........10 = ..... ....... .........11 = ...... ..... ..... .....12 = Alt..13 = ... ....... ... ....... ........14 = AppData..15 = ........16 = ... ........17 = ... ...... = .. ..... ... ... ..... ....... .........18 = !...... .... ..........19 = .......20 = ........21 = ... ...... ... ......22 = ...... .. .... .........23 = ..... ...... ... ... ... ....... ......... ......... ... ...... ...

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\??????? (Russian).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8389
Entropy (8bit):	4.556656309616615
Encrypted:	false
SSDEEP:	192:5INqmux7tQeD1XDot3rbFCKnBifxAltB3AESl:4qnZ0t75LBKW7vSl
MD5:	E85F3E236272739458070F2AD0FD8AEA
SHA1:	45C44551DA97FCCB2DA948DF4BE51EF4DE472348
SHA-256:	EFA8B1029530AA46FF21F704F6EFE59A69FE59D6B96E2370EDC32FAB62A2FD29
SHA-512:	FCE0B86A5EB75C8286A755A928ED6529934438BD0BB53EC3BED2173CFB5F0BD263FEC649BA93C687C68017063ED207B0AA0530421183F7AD5C29F115E38E5BD6
Malicious:	false
Preview:	.0 = 32 ......1 = 64 ......2 = .... . ... .. ...... ... .........3 = ..... ...... ........ ... .............4 = . ...........5 = . .....6 = ..........7 = ........ ..... . ....., ....... .. ...... ........ . .... ........... .... ........8 = ........ ........9 = ........ .........10 = .......... .......... . ........11 = ......... ...... .... ......... ............12 = Alt..13 = ......... ..... .......... ... .........14 = AppData..15 = .............16 = ............17 = .......... = .. ....., .... ..... ....... ............ ...........18 = Bat To Exe Converter - .......... .. - ..........., ..... .......

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\???????? (Greek).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9499
Entropy (8bit):	4.5624224565941
Encrypted:	false
SSDEEP:	192:PGGg/NtyFIKAwDKQCHFoVuYMaqz5Gy70sdLHG18REYcYnyVm2PQJv3XhnTe2Xmpb:eV//E9DVCHFokYMaq8y708HG189Oozzm
MD5:	CE7919F5607F6852962AFEE414CF143C
SHA1:	1CD289D7C4FA9E8951F48F4338546067E7652B95
SHA-256:	CDA6F61CB33194B48B9764BC9E1D704197454DA7967BB7B6F0F87122D033E767
SHA-512:	1255BB23A24E77D9F66FD7B2BBDDA0ADA8FD8825F16ECC128174E89C671180B87E497583137CB59CD7D6D7981A9A982D8D584A67E4B72E532BF4E4033FBCFAF9
Malicious:	false
Preview:	...0 = 32 Bit..1 = 64 Bit..2 = ... ...... .. .. .... ..... ..... ... ..........3 = ... ... ...... ..... ......... ... .......4 = ......5 = .........6 = ..........7 = ......... ... .. ...... ... .... ........ ... ...... .. ............. ... .......... ...... ......8 = ........ ............9 = ........ .......10 = ........ ........... .........11 = .. ........... .... ... ..........12 = Alt..13 = ... ........ ..... ... ......... .......... .....14 = AppData..15 = ...............16 = ...........17 = .........: ..... ....... ..... .. .......... ... ........... ... ............18 = .. Bat To Exe Converter .....

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Ce tina (Czech).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5389
Entropy (8bit):	5.3452303894979805
Encrypted:	false
SSDEEP:	96:IE8xfLofbXyG/soMrKcpfsbziUR9G7hPGeHHlgKh5YkTNzLnBBNp:P8uNsacpfsizh7HlgaYONz7BBT
MD5:	126DC042974C8979DB72CCC7F253E6AA
SHA1:	B78663D76A0E26919249C502ED10D5E66C90B81B
SHA-256:	515607FF950FCB9729E2DEBB947F6C869BBB58189BB73CC7EFCCB9308D6936ED
SHA-512:	80F49EAC959F36066BAC27B24A2DA706F79CE6D311E1365E30EB7B3D58D8DB249C83F3C8A82A094F327C6329D281410454DD60CB0DAF6A4F0239FE8B4D82A1DF
Malicious:	false
Preview:	...0 = 32 Bit..1 = 64 Bit..2 = Soubor se stejn.m n.zvem je ji. otev.en...3 = Nov.j.. verze je k dispozici ke sta.en...4 = O..5 = O .....6 = P.idat..7 = Sem p.idejte soubory a slo.ky kter. chcete zahrnout do va.eho exe souboru...8 = P.idat ikonu..9 = P.idat zdroje..10 = P.idat informace o verzi..11 = Povolit pouze jednu instanci..12 = Alt..13 = Jenda instance aplikace ji. b.....14 = AppData..15 = Architektura..16 = Asynchronn...17 = Asynchron. = Ne.ekat dokud nejsou vytvo.eny vlo.en. elementy...18 = Bat To Exe Converter je freeware - P.isp.jte na podporu v.voje!..19 = Zru.it..20 = Captcha..21 = K.d captche je .patn...22 = Zkontrolovat aktualizace..23 = Vybr.n.m ANO budou po ukon.en. programu smaz.ny extrahovan. soubory a slo.ky..24 = Vybr.n.m ANO p.ep..e existuj.c. soubory..25 = Vy.istit..26 = Zav..t..27 = Zav..t v.e..28 = CMD-prost.ed...29 = Koment..e..30 = Spole.nost..31 = Komprimuji..32 = Konzole (Viditeln.)..33 = Zkonvert

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Espa ol (Spanish).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5571
Entropy (8bit):	4.915928421056274
Encrypted:	false
SSDEEP:	96:IE0Yraa656WKAeNoIdgNhQA+BgTdA4UK+/14/BDFiLJSjLxGFvU0XJ4M:P0aaRkWOrgPH+qdAd2/aJwdGiqJ4M
MD5:	0B1FBD5CE0A704C773B535E9F7F954F6
SHA1:	309EB1BD7EF5CB72439CBE4D10E387F86C4017BF
SHA-256:	AE6EDA1EFC2F611498B9B94FD297FAE3CD46E85D38891D598A78E7D844DBFF6A
SHA-512:	BD383E6201241C5AFEE8FABF1DE60D2617F0288CFE79CB871BB49F691CD9935571D183E3D95286F034FD9D5D5F7F352E0D7B93DF87B3293E2A06B82EF95B5B06
Malicious:	false
Preview:	...0 = 32 Bit..1 = 64 Bit..2 = Un archivo con el mismo nombre ya se abre...3 = Una nueva versi.n esta disponible para descargar...4 = Acerca..5 = Acerca.....6 = A.adir..7 = A.adir archivos y carpetas que usted desee incluir en su ejecutable...8 = A.adir icono..9 = Agregar recursos..10 = A.adir informaci.n de la versi.n..11 = Permitir solo una instancia..12 = Alt..13 = Una instancia de esta aplicaci.n ya se ejecuta..14 = AppData..15 = Arquitectura..16 = Asincronismo..17 = Asincronismo=No espera hasta que se creen los elementos incluidos...18 = Bat To Exe Converter is freeware . Donar para cotinuar su desarrollo...19 = Cancelar..20 = Captcha..21 = C.digo captcha incorrecto..22 = Revisar si hay actualizaciones..23 = Escogiendo S. borrar. los archivos extra.dos y carpetas cuando los acababe la ejecuci.n..24 = Escogiendo S. borrar. los archivos existentes...25 = Limpiar..26 = Cerrar..27 = Cerrar todo..28 = Interface CMD..29 = Comentarios..30 = Compa.ia..31 = Comprimiendo

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Fran ais (French).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5771
Entropy (8bit):	5.013595303578687
Encrypted:	false
SSDEEP:	96:oE9xcPtw2yK82RyFKDXWie0S4CvUqXFM+KChY+Xu0uNlboguRLAu0AcHClE7RJn5:oE9xItw2v82RCKDr5NCZFM+9hY+Xu0kt
MD5:	BEF8EC23F8162F30BCDB19B9E63BEF90
SHA1:	10D47362FD769EC15B783735CA1BCA4BC93E668A
SHA-256:	85407106B34A3C4451CEA55786DF36D2408BC579A4211C02D12AB3650C96A86E
SHA-512:	07F76EA30827CCEEE2C5E75483E00194C1C1F9EE968CE2D709D8AC32B4C9750164951C77342B517C6367965F21380DFB9760A8842BBA64064CD5E2D04D798A8E
Malicious:	false
Preview:	...0 = 32 bit..1 = 64 bit..2 = Fichier du m.me nom est d.j. ouvert...3 = Version plus r.cente disponible en t.l.chargement...4 = A propos de..5 = A propos de .....6 = Ajouter..7 = Ajouter des fichiers et dossiers que vous souhaitez inclure dans votre ex.cutable ici...8 = Ajouter une ic.ne..9 = Ajouter des ressources..10 = Ajout d'informations sur la version..11 = Autoriser une seule instance..12 = Alt..13 = Une instance de l'application est d.j. en cours d'ex.cution..14 = AppData..15 = Architecture..16 = Asynchrone..17 = Asynchrone = N'attendez pas que les .l.ments incorpor.s soient cr..s...18 = Bat To Exe Converter est un logiciel gratuit - Faire un don pour soutenir le d.veloppement!..19 = Annuler..20 = Captcha..21 = Code Captcha incorrect..22 = V.rifier les mises . jour..23 = Choisir OUI supprimera les fichiers et dossiers extraits lorsque l'ex.cution sera termin.e...24 = Choisir OUI .crasera les fichiers existants...25 = Effacer..26 = Fermer..27 = Fermer Tou

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Italiano (Italian).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5446
Entropy (8bit):	4.848999465904957
Encrypted:	false
SSDEEP:	96:oEQRR1C6cEuOOr5rTSrkMmvBYuZE+4NbZlqQm0jefR7Sb3tlZ+Llch5yy//P:oEqR1C6TudnSbsBYuZItlqQDPDYLlchH
MD5:	6B078E7A6849C8954A5001A044BC90FD
SHA1:	57C318CFB473A8E3A4675CAC70732A2FE6AB7B76
SHA-256:	9F93BE553F9256EC0D71BD44CAA1990B82D7EEFEB6AC5075A96E8C4BC9D41C06
SHA-512:	A07A8E705AE8A43D1756F39839CC22C5A481A0871388277B73A72EC914CFAD6638B88F02492459F7DC9FB8BB8CCF62A8D4184D6482894DFA400AB0F259E998E4
Malicious:	false
Preview:	...0 = 32 bit..1 = 64 bit..2 = Un file con lo stesso nome . gi. aperto...3 = Una versione pi. recente . disponibile per il download...4 = Info..5 = Info.....6 = Inserisci..7 = Aggiungi qui file e cartelle che vuoi includere nel tuo eseguibile...8 = Aggiunta di icone..9 = Aggiungere risorse..10 = Aggiunta di informazioni sulla versione..11 = Consenti solo un'istanza..12 = Alt..13 = Un'istanza di questa applicazione . gi. in esecuzione..14 = AppData..15 = Architettura..16 = Asincrono..17 = Asincrono = Non aspettare che vengano creati elementi incorporati...18 = Bat To Exe Converter . freeware - Dona per supportare lo sviluppo!..19 = Annulla..20 = Captcha..21 = Codice captcha errato..22 = Controlla gli aggiornamenti..23 = Scegliendo SI eliminerai i file e le cartelle estratti al termine dell'esecuzione...24 = Scegliendo SI si sovrascriveranno i file esistenti...25 = Pulisci..26 = Chiudi..27 = Chiudi tutto..28 = Interfaccia CMD..29 = Commenti..30 = Azienda..31 = Compressione..32 =

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Magyar (Hungarian).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5731
Entropy (8bit):	5.235127210855445
Encrypted:	false
SSDEEP:	96:ybIE7gYC2n60xiJaJJzVaAbPtqUpjujJEPLnie7eFUFhxjflsZJL8ueSuJvc3VIZ:ybrPHoJaJp82wUpj2weFSGZJwRSuJvce
MD5:	0427E675DAE96193FBBD2575B25E4ADD
SHA1:	7FC54DD5AEC429F431CAA39A8A7132AA7B2ADEA3
SHA-256:	A9EC95138C89144FAD7304CCDFA22E30F4552F42EC5F87EFBEC17E6B45227886
SHA-512:	82AA697BE9D38BC64F43A872238D738D7559891D42EE548053FF20FF456F72F1F6A2DCCEC85423CA527E98801E35F3ABC358F3F80A19BB03A091B2F2147A5E2D
Malicious:	false
Preview:	...0 = 32-bit..1 = 64-bit..2 = Egy azonos n.vvel rendelkez. f.jl m.r meg lett nyitva...3 = Egy .jabb verzi. .rhet. el let.lt.sre...4 = N.vjegy..5 = N.vjegy .....6 = Hozz.ad.s..7 = Adjon hozz. f.jlokat .s mapp.kat, amelyeket el szeretne helyezni a futtathat. f.jlban...8 = Ikon hozz.ad.sa..9 = Forr.sok hozz.ad.sa..10 = Verzi.inform.ci.k hozz.ad.sa..11 = Csak egy p.ld.ny enged.lyez.se..12 = Alt..13 = Az alkalmaz.s egy p.ld.nya m.r fut..14 = AppData..15 = Architekt.ra..16 = Aszinkron..17 = Aszinkron = Ne v.rja meg a be.gyazott elemek l.trehoz.s.t...18 = A Bat To Exe Converter ingyenes . Adom.nyozzon a fejleszt.s t.mogat.s.hoz!..19 = M.gse..20 = K.pk.d..21 = A k.pk.d .rv.nytelen..22 = Friss.t.sek ellen.rz.se..23 = Az IGEN kiv.laszt.s.val t.rli a kibontott f.jlokat .s mapp.kat a v.grehajt.s befejez.sekor...24 = Az IGEN kiv.laszt.sa fel.l.rja a megl.v. f.jlokat...25 = .r.t.s..26 = Bez.r.s..27 = .sszes bez.

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Nederlands (Dutch).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5136
Entropy (8bit):	4.907104375023733
Encrypted:	false
SSDEEP:	96:IERQmH0jdNW2QzGyub7sNCC1xvtOCxk5ul9bKEHimSpyusIvLwAp+eGHXdl:PRQmUBNW1Gb77C1bOCxk5y9bK2i0u7U/
MD5:	30E8FFB0E32E27F754610A3CB6B2E932
SHA1:	189656584C97E3149D7BA2EB1B86D774BFC682A2
SHA-256:	3C0405BD3D1AF87EF1675E067020C07A754C2C62662D8F32009A6265C3F48D55
SHA-512:	4C859CB74CDF473946B4436DBB93972FDBE1E764947F5BA09893D013DA1253E36D5FD27E50B81ACB13B849525F84FE21B7BF5BCF53195BB3FEFB315D53903B70
Malicious:	false
Preview:	...0 = 32 Bit..1 = 64 Bit..2 = Een bestand met dezelfde naam is al geopend...3 = Een nieuwere versie kan gedownload worden...4 = Over..5 = Over.....6 = Toevoegen..7 = Voeg bestanden en mappen toe die u in uw exe-bestand wil insluiten...8 = Icon toevoegen..9 = Bronnen toevoegen..10 = Versie informatie toevoegen..11 = Slechts ..n uitvoering toestaan..12 = Alt..13 = Deze toepassing is reeds actief..14 = AppData..15 = Architectuur..16 = Asynchroon..17 = Asynchroon = Wacht niet tot ingesloten elementen gemaakt zijn...18 = Bat To Exe Converter is freeware - Doe een gift om de ontwikkeling te steunen...19 = Annuleren..20 = Captcha..21 = Captcha code onjuist..22 = Controleer voor updates..23 = JA wist de bestanden en mappen...24 = JA overschrijft de bestanden...25 = Leegmaken..26 = Sluiten..27 = Alles sluiten..28 = CMD-interface..29 = Commentaren..30 = Firma..31 = Aan het comprimeren..32 = Console (Zichtbaar)..33 = Converteer..34 = Converteerder..35 = Kopieer..36 = Kopieer log..37 = Kopiee

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Portugu s Brasileiro (Portuguese Brazilian).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5639
Entropy (8bit):	5.014841388257068
Encrypted:	false
SSDEEP:	96:o/7/tlDAyNWMiJolH81z04S+yomJnt/tfLFriPfqw7wI0ABtD6UwNl:oj/7DAyNXiqlCz0hzPJNyPlMIZD6/Nl
MD5:	71F0183E192E34D375F0735210E97C4A
SHA1:	B60E72378FEF5227D9B3EA8F30DD29D4C9BE097B
SHA-256:	130764E3A2E43B78EE632C0372BC5630BD62ABF74AA825865FE5B4C14F4D7A27
SHA-512:	19914BFEA9F4EE3ECD46835F0C276A477A6F1B440FB9F33F9B8DF0E063B1CF0703495C27336FED1F101315690C43110B9E47DAC0F688D41EEA59F3415468D756
Malicious:	false
Preview:	...0 = 32 bits..1 = 64 Bits..2 = Um arquivo com o mesmo nome j. est. aberto..3 = Uma nova vers.o est. dispon.vel para download..4 = Sobre..5 = Sobre .....6 = Adicionar..7 = Adicione arquivos e pastas que voc. deseja incluir no seu execut.vel aqui...8 = Adicionando .cone..9 = Adicionando recursos..10 = Adicionando informa..es de vers.o..11 = Permitir apenas uma inst.ncia..12 = Alt..13 = Uma inst.ncia desse aplicativo j. est. sendo executada..14 = AppData..15 = Arquitetura..16 = Ass.ncrono..17 = N.o espera at. que os elementos incorporados sejam criados...18 = Bat To Exe Converter . gratuito - Fa.a uma doa..o para apoiar o desenvolvimento!..19 = Cancelar..20 = Captcha..21 = C.digo captcha est. incorreto..22 = Buscar por atualiza..es..23 = Escolher SIM apagar. os arquivos e pastas extra.dos quando a execu..o terminar...24 = Escolhendo SIM substituir. os arquivos existentes...25 = Limpar..26 = Fechar..27 = Fechar todos..28 = Interface-CMD..29 = Coment.rios

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\Slovensk (Slovak).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5431
Entropy (8bit):	5.3468775375546045
Encrypted:	false
SSDEEP:	96:IEL64APn65uLf7qs40IJS9n9utccdB/OOhfJnvLdB08GhiAD3mPtj+hNC1hbq364:PL6R65yfer1S99utccdB2OhfJnvLP0xJ
MD5:	F19CD4F6CCE52F99B6C62802E0D690C4
SHA1:	6D719B72AC137021B9F8809575161B878BC6359A
SHA-256:	9442A4ED768B0F65D4A8DD5C1E91C9E7EDBEA4235C8C8E5C6AB44A54F93297A1
SHA-512:	50A95D4017737A9DA59414048308D10BBD892789DCAB7D56C75547E216A730847337B476F1B01DECEA1BE64E90C82343C2FA82BD653C73BAD9BAE645D826E802
Malicious:	false
Preview:	...0 = 32 Bit..1 = 64 Bit..2 = S.bor s rovnak.m n.zvom je u. otvoren....3 = Je dostupn. nov. verzia programu...4 = O aplik.cii..5 = O aplik.cii.....6 = Prida...7 = Pridajte s.bory a zlo.ky ktor. chcete zahrn.. do v..ho spustite.n.ho s.boru...8 = Prid.vanie ikony.....9 = Prid.vanie zdrojov.....10 = Prid.vanie inform.cii o verzii.....11 = Povoli. naraz iba jednu spusten. in.tanciu..12 = Alt..13 = Jedna in.tancia tejto aplik.cie u. be....14 = AppData..15 = Architekt.ra..16 = Asynchr.nny..17 = Asynchr.nny = Ne.aka. k.m sa vytvoria embeddovan. elementy...18 = Bat To Exe Converter je freeware - Podporte developera finan.n.m pr.spevkom!..19 = Zru.i...20 = Captcha..21 = Zle op.san. Captcha..22 = Kontrolova. aktualiz.cie..23 = V.berom .NO sa po ukon.en. programu vyma.. extrahovan. s.bory...24 = V.berom .NO prep..ete existuj.ce nastavenia...25 = Zmazat..26 = Zavrie...27 = Zavrie. v.etko..28 = CMD-Rozhranie..29 = Koment.re..30 = S

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\T rk e (Turkish).lng

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5270
Entropy (8bit):	5.202682622645692
Encrypted:	false
SSDEEP:	96:oEy4jacW4p0ots/3xQf9PdwSzP9b1SwLAp6hmKe/MLP9boFKOgxAVEGoA:oEy4Rpvsx49Pdxf0p9K8GPVigxx9A
MD5:	6D8188689F086C305793941E56B51EF9
SHA1:	2E4A5E74B0B9D61C4FF6E25B21A659BE1CADD9F3
SHA-256:	51F36AA59CBE22FD5A470D75DC77B1831D88643F3687A7C8717C46A105567354
SHA-512:	BCAC0CE5722972AAFB7323017196770995AF0FE623BB6CD4D78122046310648E0D65D45B3E6411504621BD140EBE368086A0A246EF19433B1DEC6C239D4474E9
Malicious:	false
Preview:	...0 = 32 bit..1 = 64 bit..2 = Ayn. ada sahip bir dosya zaten a..ld....3 = Daha yeni bir s.r.m. indirmek i.in kullan.labilir...4 = Hakk.nda..5 = Hakk.nda .....6 = Ekle..7 = Uygulaman.za dahil etmek istedi.iniz dosya ve klas.rleri buraya ekleyin...8 = Simge ekleniyor..9 = Kaynak ekleme..10 = S.r.m bilgisi ekleme..11 = Sadece bir .rne.e izin ver..12 = Alt..13 = Bu uygulaman.n bir .rne.i zaten .al...yor..14 = Uygulama verisi..15 = Mimari..16 = E.zamanl. olmayan..17 = E.zamans.z = G.m.l. elemanlar olu.turuluncaya kadar beklemeyin...18 = Bat To Exe Converter .cretsizdir - Geli.imini desteklemek i.in sizde ba... yap.n!..19 = .ptal..20 = Do.rulama kodu..21 = Do.rulama kodu yanl....22 = G.ncellemeleri kontrol et..23 = Y.r.tme bitti.inde, YES se.imi ..kart.lan dosyalar. ve klas.rleri siler...24 = EVET se.imi mevcut dosyalar.n .zerine yazacakt.r...25 = A...26 = Kapat..27 = Hepsini kapat..28 = CMD-Aray.z...29 = Yorum..30 = .irket..3

C:\Users\user\AppData\Roaming\Bat To Exe Converter\upx.exe

Download File

Process:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	7.995709475150595
Encrypted:	true
SSDEEP:	6144:PhoGv9lnheLRaK5KOdHW/Znp2BPCx/5yR9fXG785NrtjKWvn0MGHJKZkHDoS:Jr9lnheLtk6Hy1gPCpi9fWOhKqJoJKZu
MD5:	0A493C3B30C4F095B68171621CA94FDE
SHA1:	747159A347C12D394E9576167C234D7DB3D9AB0A
SHA-256:	CE0CDAA2E2D12763C7C7B0DECC483020786EB28F25904ED63C06512A83938B69
SHA-512:	9C67511BDE3EEDFA0482BF28CDD5564E12CB3C770982AD26EAAA39F2C1F07E90D0F017C7155881F6AF9394C75B3C8A9B9D625124CEAA64EDC52F44A1A1955BFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................8.....................0....@..........................@................ ..............................5.......0..............................................................................................................UPX0....................................UPX1................................@....rsrc........0......................@...3.94.UPX!.....g.Q.#C......y...^..F.......X.b...x{...S..H.....b..>....:cJ....Vf.u.k...C..........R...by..~..;8../..........Z...v..X.LP4.Y......f...D.WU..h..5.3......._......H..b. ..NP.......f.-../%.a.fZ.[....J.V.....'p....Cw.C...$y......A...".s....S......u^.:./_gnmP\|...0f...1.....W.!.".w#.......3.....3.N..{'P....T\.r._.z..^.B....q..y..8*d\..52.....^.2.._.[..-[...iN..S.kVF(.D..f.3<..M-.....P.1...$5.....rH.Jr...%z.RX.5.f..;..%....G.,...}.X..,$.P..\&.B.MK..J....^$q.....py...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.991378162587342
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe
File size:	4'482'593 bytes
MD5:	0d8bedda7d9b963de975685cf2b2a5eb
SHA1:	cbbffe900a09e8a3bbb1a1bf16e7aeb8ebde72a1
SHA256:	519f0b16537fa4a2bc228cdfce2b85c12225e2071d7789c8cc9bb8f7b85796ca
SHA512:	9d8eb3433e88fb47b15d624b493af69a9697eeeee7ccfef71daf04181bcc5ba45b2f9cc801679c0234399fdf80f4a85f20858038c41c11132b515fb76cf22612
SSDEEP:	98304:/xQvu6zDf/mV8jYMG2eHlLrTvIpfCnIpMpCEORglqLxjX:/Gv9AMGnHlLrTvIquMiWqLxj
TLSH:	0A263303B3CB0836F036BE35CDA949646DA3356815F5B06E4EB3DA4F4A3D6C49877292
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x4117dc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x57051F88 [Wed Apr 6 14:39:04 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	20dd26497880c05caed9305b3c8b9109

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 00410144h
call 00007F7B9924EBBDh
xor eax, eax
push ebp
push 00411EBEh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 00411E7Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [00415B48h]
call 00007F7B99257303h
call 00007F7B99256E52h
cmp byte ptr [00412ADCh], 00000000h
je 00007F7B99259DFEh
call 00007F7B99257418h
xor eax, eax
call 00007F7B9924CC55h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F7B99253E9Bh
mov edx, dword ptr [ebp-14h]
mov eax, 00418658h
call 00007F7B9924D22Ah
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [00418658h]
mov dl, 01h
mov eax, dword ptr [0040C04Ch]
call 00007F7B992547B2h
mov dword ptr [0041865Ch], eax
xor edx, edx
push ebp
push 00411E26h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F7B99257376h
mov dword ptr [00418664h], eax
mov eax, dword ptr [00418664h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F7B99259E3Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19000	0xe04	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0xb200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1b000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19304	0x214	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf244	0xf400	a33e9ff7181115027d121cd377c28c8f	False	0.5481717469262295	data	6.3752135040515485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x11000	0xf64	0x1000	caec456c18277b579a94c9508daf36ec	False	0.55859375	data	5.732200666157372	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0xc88	0xe00	746954890499546d73dce0e994642192	False	0.2533482142857143	data	2.2967209087898324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x13000	0x56bc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x19000	0xe04	0x1000	e9b9c0328fd9628ad4d6ab8283dcb20e	False	0.321533203125	data	4.597812557707959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1a000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1b000	0x18	0x200	3dffc444ccc131c9dcee18db49ee6403	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0xb200	0xb200	77556010789c981e280edab6f31467ef	False	0.17841467696629212	data	4.142803017471795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1c41c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1c544	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x1caac	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x1cd94	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x1d63c	0x68	data			0.6538461538461539
RT_STRING	0x1d6a4	0xd4	data			0.5283018867924528
RT_STRING	0x1d778	0xa4	data			0.6524390243902439
RT_STRING	0x1d81c	0x2ac	data			0.45614035087719296
RT_STRING	0x1dac8	0x34c	data			0.4218009478672986
RT_STRING	0x1de14	0x294	data			0.4106060606060606
RT_RCDATA	0x1e0a8	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x26390	0x10	data			1.5
RT_RCDATA	0x263a0	0x150	data			0.8392857142857143
RT_RCDATA	0x264f0	0x2c	data			1.1590909090909092
RT_GROUP_ICON	0x2651c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x2655c	0x4f4	data	English	United States	0.2823343848580442
RT_MANIFEST	0x26a50	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, DeleteFileW, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Target ID:	0
Start time:	20:39:56
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe"
Imagebase:	0x400000
File size:	4'482'593 bytes
MD5 hash:	0D8BEDDA7D9B963DE975685CF2B2A5EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:39:56
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp" /SL5="$20438,4092287,121344,C:\Users\user\Desktop\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe"
Imagebase:	0x400000
File size:	1'179'648 bytes
MD5 hash:	90FC739C83CD19766ACB562C66A7D0E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:40:31
Start date:	25/04/2024
Path:	C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe"
Imagebase:	0x140000000
File size:	2'105'856 bytes
MD5 hash:	E3D6B93E861FEEFA47CCEEAE03E99094
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	1602
Total number of Limit Nodes:	76

Executed Functions

Function 0000000140001000 Relevance: 247.3, APIs: 13, Strings: 127, Instructions: 2274
commemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140072D90: HeapCreate.KERNEL32 ref: 0000000140072D9E
Part of subcall function 0000000140072D90: TlsAlloc.KERNEL32 ref: 0000000140072DAB

Part of subcall function 0000000140071640: HeapCreate.KERNEL32 ref: 000000014007164E

Part of subcall function 000000014006BA0C: LoadLibraryW.KERNEL32 ref: 000000014006BA17
Part of subcall function 000000014006BA0C: GetProcAddress.KERNEL32 ref: 000000014006BA33

Part of subcall function 00000001400674A4: TlsAlloc.KERNEL32 ref: 00000001400674A8

Part of subcall function 000000014005F3CC: GetDC.USER32 ref: 000000014005F3DD
Part of subcall function 000000014005F3CC: GetDeviceCaps.GDI32 ref: 000000014005F3EE
Part of subcall function 000000014005F3CC: GetDeviceCaps.GDI32 ref: 000000014005F414
Part of subcall function 000000014005F3CC: ReleaseDC.USER32 ref: 000000014005F437

Part of subcall function 000000014005DF94: memset.MSVCRT ref: 000000014005DFA8
Part of subcall function 000000014005DF94: RegisterClassW.USER32 ref: 000000014005DFFE
Part of subcall function 000000014005DF94: CreateWindowExW.USER32 ref: 000000014005E047
Part of subcall function 000000014005DF94: RegisterClipboardFormatW.USER32 ref: 000000014005E05B
Part of subcall function 000000014005DF94: RtlInitializeCriticalSection.NTDLL ref: 000000014005E0BB

Part of subcall function 000000014005BE44: LoadIconW.USER32 ref: 000000014005BE97
Part of subcall function 000000014005BE44: LoadCursorW.USER32 ref: 000000014005BEAB

Part of subcall function 000000014004F3E4: RtlInitializeCriticalSection.NTDLL ref: 000000014004F3EF
Part of subcall function 000000014004F3E4: MulDiv.KERNEL32 ref: 000000014004F43F
Part of subcall function 000000014004F3E4: CreateFontW.GDI32 ref: 000000014004F490
Part of subcall function 000000014004F3E4: memset.MSVCRT ref: 000000014004F4F2

OleInitializeWOW.OLE32 ref: 00000001400010AB

Part of subcall function 000000014004B91C: LoadLibraryW.KERNEL32 ref: 000000014004B927
Part of subcall function 000000014004B91C: GetProcAddress.KERNEL32 ref: 000000014004B943

Part of subcall function 0000000140043C34: memset.MSVCRT ref: 0000000140043C43
Part of subcall function 0000000140043C34: CoInitialize.OLE32 ref: 0000000140043C65

Part of subcall function 0000000140049888: LoadLibraryW.KERNEL32 ref: 00000001400498C3

Part of subcall function 0000000140072E00: GetLastError.KERNEL32 ref: 0000000140072E04
Part of subcall function 0000000140072E00: TlsGetValue.KERNEL32 ref: 0000000140072E14
Part of subcall function 0000000140072E00: SetLastError.KERNEL32 ref: 0000000140072E31

Part of subcall function 0000000140072E50: TlsGetValue.KERNEL32 ref: 0000000140072E63
Part of subcall function 0000000140072E50: RtlAllocateHeap.NTDLL ref: 0000000140072EA6

Part of subcall function 0000000140049910: WideCharToMultiByte.KERNEL32 ref: 000000014004996A
Part of subcall function 0000000140049910: GetProcAddress.KERNEL32 ref: 0000000140049978

Part of subcall function 0000000140072F30: RtlAllocateHeap.NTDLL ref: 0000000140072F83

Part of subcall function 0000000140072F30: RtlReAllocateHeap.NTDLL ref: 0000000140072FB1
Part of subcall function 0000000140072F30: HeapFree.KERNEL32 ref: 0000000140072FF4

GetDesktopWindow.USER32 ref: 000000014000162B
GetDC.USER32 ref: 000000014000163B
GetDeviceCaps.GDI32 ref: 0000000140001648

Part of subcall function 000000014006FE60: WideCharToMultiByte.KERNEL32 ref: 000000014006FEA1
Part of subcall function 000000014006FE60: WideCharToMultiByte.KERNEL32 ref: 000000014006FEDB

Part of subcall function 0000000140073020: wcslen.MSVCRT ref: 000000014007303E

Part of subcall function 0000000140072E50: RtlReAllocateHeap.NTDLL ref: 0000000140072ED3

Part of subcall function 000000014006A220: HeapFree.KERNEL32 ref: 000000014006A26A
Part of subcall function 000000014006A220: HeapFree.KERNEL32 ref: 000000014006A28B
Part of subcall function 000000014006A220: HeapFree.KERNEL32 ref: 000000014006A29D

Part of subcall function 000000014006A140: RtlAllocateHeap.NTDLL ref: 000000014006A172
Part of subcall function 000000014006A140: RtlAllocateHeap.NTDLL ref: 000000014006A18D

Part of subcall function 000000014005E9D8: RtlAllocateHeap.NTDLL ref: 000000014005EA11
Part of subcall function 000000014005E9D8: RtlAllocateHeap.NTDLL ref: 000000014005EA42
Part of subcall function 000000014005E9D8: RtlAllocateHeap.NTDLL ref: 000000014005EAB2

Part of subcall function 000000014005E9D8: HeapFree.KERNEL32 ref: 000000014005EAD8

Part of subcall function 0000000140067108: RtlAllocateHeap.NTDLL ref: 000000014006715A
Part of subcall function 0000000140067108: memset.MSVCRT ref: 000000014006718E

Part of subcall function 000000014004B5EC: WSAStartup.WS2_32 ref: 000000014004B63E
Part of subcall function 000000014004B5EC: LoadLibraryW.KERNEL32 ref: 000000014004B65D
Part of subcall function 000000014004B5EC: GetProcAddress.KERNEL32 ref: 000000014004B67D
Part of subcall function 000000014004B5EC: GetProcAddress.KERNEL32 ref: 000000014004B698
Part of subcall function 000000014004B5EC: GetProcAddress.KERNEL32 ref: 000000014004B6B3
Part of subcall function 000000014004B5EC: GetProcAddress.KERNEL32 ref: 000000014004B6CE

GetDesktopWindow.USER32 ref: 0000000140002AD0
GetDC.USER32 ref: 0000000140002AE0
GetDeviceCaps.GDI32 ref: 0000000140002AED
PathAddBackslashW.SHLWAPI ref: 0000000140002D39

Part of subcall function 000000014004BA80: GetTempPathW.KERNEL32 ref: 000000014004BAAF
Part of subcall function 000000014004BA80: LoadLibraryW.KERNEL32 ref: 000000014004BABE
Part of subcall function 000000014004BA80: GetProcAddress.KERNEL32 ref: 000000014004BAD9
Part of subcall function 000000014004BA80: GetLongPathNameW.KERNEL32(?,?,?,0000000140002D6D), ref: 000000014004BAED
Part of subcall function 000000014004BA80: FreeLibrary.KERNEL32 ref: 000000014004BAF4

GetTempFileNameW.KERNEL32 ref: 0000000140002DB3

Part of subcall function 00000001400716B0: memcpy.MSVCRT ref: 00000001400716F7

Part of subcall function 000000014004BB28: SetFileAttributesW.KERNEL32 ref: 000000014004BB48
Part of subcall function 000000014004BB28: DeleteFileW.KERNEL32 ref: 000000014004BB51

PathAddBackslashW.SHLWAPI ref: 0000000140002E1E

Part of subcall function 000000014004BB64: wcsncpy.MSVCRT ref: 000000014004BB82
Part of subcall function 000000014004BB64: wcslen.MSVCRT ref: 000000014004BB94
Part of subcall function 000000014004BB64: CreateDirectoryW.KERNEL32 ref: 000000014004BBE4

Part of subcall function 00000001400692B0: GetIconInfo.USER32 ref: 000000014006930D
Part of subcall function 00000001400692B0: GetObjectW.GDI32 ref: 0000000140069328
Part of subcall function 00000001400692B0: DeleteObject.GDI32 ref: 0000000140069361
Part of subcall function 00000001400692B0: DeleteObject.GDI32 ref: 000000014006936C

Part of subcall function 00000001400730C0: TlsGetValue.KERNEL32 ref: 00000001400730CA

Part of subcall function 00000001400040B5: OleUninitialize.OLE32 ref: 00000001400040E6

Part of subcall function 0000000140072DD0: HeapDestroy.KERNEL32 ref: 0000000140072DDB
Part of subcall function 0000000140072DD0: TlsFree.KERNEL32 ref: 0000000140072DE7

HeapDestroy.KERNEL32 ref: 00000001400040A4
ExitProcess.KERNEL32 ref: 00000001400040B0

Strings

Session (*.session)|*.session, xrefs: 000000014000181E
wdir, xrefs: 0000000140001952
fontsize, xrefs: 00000001400014A8
cmd, xrefs: 00000001400028FF
http://www.godevtool.com/GorcFrame.htm, xrefs: 0000000140001DBA
originalfilename, xrefs: 0000000140001A86
internalfilename, xrefs: 0000000140001A9C
trademark, xrefs: 0000000140001ADE
Directory * does not exist, xrefs: 0000000140001C96
count, xrefs: 000000014000188C
overwrite, xrefs: 00000001400019EC
Verdana, xrefs: 00000001400014D4
resource.exe, xrefs: 0000000140001C3E
Bat To Exe Converter, xrefs: 0000000140001235
Traditional Chinese Big5, xrefs: 0000000140002894
bat, xrefs: 00000001400028E9
Courier, xrefs: 00000001400020A0
attributes, xrefs: 0000000140001A02
Italiano (Italian), xrefs: 00000001400029AF
Korean Unified Hangul Code, xrefs: 0000000140002864
packer, xrefs: 0000000140001994
Korean Johab, xrefs: 00000001400028C4
fileversion, xrefs: 0000000140001A44
Deutsch (German), xrefs: 0000000140002113
_wfullpath, xrefs: 0000000140001203
productversion, xrefs: 0000000140001A5A
English, xrefs: 00000001400020FD
delonexit, xrefs: 00000001400019D6
b2etempfile, xrefs: 000000014000143A
http://www.godevtool.com/GolinkFrame.htm, xrefs: 0000000140001DD0
1 VERSIONINFO , xrefs: 0000000140001045, 0000000140003A1F, 0000000140003A3C
icon, xrefs: 0000000140001910
\\VarFileInfo\\Translation, xrefs: 0000000140002B8B
lng, xrefs: 0000000140001860
b80605434f3c0bb515408f6f0edcdd13, xrefs: 000000014000110A, 0000000140001114
https://upx.github.io/upx-license.html, xrefs: 0000000140001D8E
settings.ini, xrefs: 0000000140002BF4
Magyar (Hungarian), xrefs: 0000000140002A1D
--lzma --best , xrefs: 0000000140001C54
Franais (French), xrefs: 000000014000296D
format, xrefs: 0000000140001968
Incorrect command line, xrefs: 0000000140001C6A
GoRC.exe, xrefs: 0000000140001700
https://www.scintilla.org/, xrefs: 0000000140001DA4
font, xrefs: 0000000140001492
donate, xrefs: 0000000140001692
comments, xrefs: 0000000140001B36
2019-07-30, xrefs: 00000001400012C0
0 = 32 Bit1 = 64 Bit2 = Een bestand met dezelfde naam is al geopend.3 = Een nieuwere versie kan gedownload worden.4 = Over5 = Over...6 = Toevoegen7 = Voeg bestanden en mappen toe die u in uw exe-bestand wil insluiten.8 = Icon toevoegen, xrefs: 00000001400038AF, 00000001400038CC, 0000000140003974, 0000000140003985
display, xrefs: 0000000140001A18
b2e, xrefs: 000000014000292B
Simplified Chinese GBK, xrefs: 0000000140002834
save, xrefs: 0000000140001B4C
upx.exe, xrefs: 000000014000172C
/b2e/downloads/v.zip, xrefs: 0000000140001D3E
Password prompt*Please enter the correct password to continue:*Wrong password, xrefs: 00000001400015F2
editorfontsize, xrefs: 0000000140001516
productname, xrefs: 0000000140001A70
Image To Icon Converter, xrefs: 0000000140001E12
company, xrefs: 0000000140001AC8
editorfont, xrefs: 0000000140001500
uac, xrefs: 000000014000197E
ZeroNet, xrefs: 0000000140001CD8
copyright, xrefs: 0000000140001AF4
Portugus Brasileiro (Portuguese Brazilian), xrefs: 00000001400029C5
http://www.godevtool.com, xrefs: 0000000140001DE6
https://www.everaldo.com/, xrefs: 0000000140001D62
BAT (*.bat)|*.bat;*.bat|CMD (*.cmd)|*.cmd;*.cmd, xrefs: 00000001400017DC
0 = 32 1 = 64 2 = 3 = 4 = 5 = , xrefs: 0000000140002E9F, 0000000140002EBC, 00000001400035DC, 00000001400035ED
@set , xrefs: 00000001400013E2
CMD Tools, xrefs: 0000000140002039
File * not found, xrefs: 0000000140001C80
(n.n.n.n), xrefs: 00000001400016A8
\\StringFileInfo\\040904E4\\, xrefs: 0000000140002BA1
GoLink.exe, xrefs: 00000001400016EA
ICO (*.ico)|*.ico, xrefs: 00000001400017F2
fontstyle, xrefs: 00000001400014BE
&x=1, xrefs: 0000000140002B49
Japanese Shift-JIS, xrefs: 0000000140002804
lastfiles, xrefs: 00000001400018B8
Codepage, xrefs: 000000014000276A
specialbuild, xrefs: 0000000140001B20
BAT (*.bat)|*.bat;*.bat|CMD (*.cmd)|*.cmd;*.cmd|Session (*.session)|*.session;*.session, xrefs: 00000001400017C6
files.ini, xrefs: 0000000140002C84
EXE (*.exe)|*.exe, xrefs: 0000000140001808
*.*, xrefs: 0000000140001348
msvcrt.dll, xrefs: 0000000140001198
\\StringFileInfo\\, xrefs: 0000000140002B75
Exe To Bat, xrefs: 0000000140002023
session, xrefs: 0000000140001834, 00000001400018A2
*.* (*.*)|*.*, xrefs: 0000000140001876
usepassword, xrefs: 0000000140001926
resource.rc, xrefs: 0000000140001C12
password, xrefs: 000000014000193C
exe, xrefs: 000000014000184A
..., xrefs: 0000000140001BDB
resource.res, xrefs: 0000000140001C28
= , xrefs: 00000001400018CE
privatebuild, xrefs: 0000000140001B0A
%b2eprogramfilename%, xrefs: 00000001400016BE
lang, xrefs: 0000000140001450
Nederlands (Dutch), xrefs: 0000000140002A8B
0 = 32 1 = 64 2 = .3 = , xrefs: 00000001400032EF, 000000014000330C, 00000001400033B4, 00000001400033C5
vinfo, xrefs: 0000000140001A2E
_9999, xrefs: 000000014000174D
method, xrefs: 00000001400019AA
https://github.com/99fk, xrefs: 0000000140001D04
Github, xrefs: 0000000140001CEE
description, xrefs: 0000000140001AB2
http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/, xrefs: 0000000140001CAC, 0000000140001CC2
@call:extd, xrefs: 000000014000140E
https://upx.github.io, xrefs: 0000000140001D78
edir, xrefs: 00000001400019C0
3.2, xrefs: 00000001400012AA
0 = 32 1 = 64 2 = 3 = 4 = 5 = , xrefs: 0000000140002EAC, 0000000140002EBD
useicon, xrefs: 00000001400018FA
Bat To Exe Online Converter, xrefs: 0000000140001E28
b2e.tmp, xrefs: 0000000140002915
include, xrefs: 00000001400018E4
UTF-8, xrefs: 00000001400027D8
Consolas, xrefs: 00000001400020B6
https://www.scintilla.org/License.txt, xrefs: 0000000140001DFC
session.ini, xrefs: 0000000140002C3C
extd, xrefs: 00000001400013F8
b2eextd, xrefs: 0000000140001424
Scilexer.dll, xrefs: 000000014000165B
extd.chm, xrefs: 0000000140001716

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$AddressProc$FreeLoad$Library$Create$CapsDeviceInitializePathmemset$ByteCharDeleteFileMultiObjectValueWideWindow$AllocBackslashCriticalDesktopDestroyErrorIconLastNameRegisterSectionTempwcslen$AttributesClassClipboardCursorDirectoryExitFontFormatInfoLongProcessReleaseStartupUninitializememcpywcsncpy
String ID: = $%b2eprogramfilename%$&x=1$(n.n.n.n)$*.*$*.* (*.*)|*.*$--lzma --best $...$/b2e/downloads/v.zip$1 VERSIONINFO $2019-07-30$3.2$@call:extd$@set $BAT (*.bat)|*.bat;*.bat|CMD (*.cmd)|*.cmd;*.cmd$BAT (*.bat)|*.bat;*.bat|CMD (*.cmd)|*.cmd;*.cmd|Session (*.session)|*.session;*.session$Bat To Exe Converter$Bat To Exe Online Converter$CMD Tools$Codepage$Consolas$Courier$Deutsch (German)$Directory * does not exist$EXE (*.exe)|*.exe$English$Exe To Bat$File * not found$Franais (French)$Github$GoLink.exe$GoRC.exe$ICO (*.ico)|*.ico$Image To Icon Converter$Incorrect command line$Italiano (Italian)$Japanese Shift-JIS$Korean Johab$Korean Unified Hangul Code$Magyar (Hungarian)$Nederlands (Dutch)$Password prompt*Please enter the correct password to continue:*Wrong password$Portugus Brasileiro (Portuguese Brazilian)$Scilexer.dll$Session (*.session)|*.session$Simplified Chinese GBK$Traditional Chinese Big5$UTF-8$Verdana$ZeroNet$\\StringFileInfo\\$\\StringFileInfo\\040904E4\\$\\VarFileInfo\\Translation$_9999$_wfullpath$attributes$b2e$b2e.tmp$b2eextd$b2etempfile$b80605434f3c0bb515408f6f0edcdd13$bat$cmd$comments$company$copyright$count$delonexit$description$display$donate$edir$editorfont$editorfontsize$exe$extd$extd.chm$files.ini$fileversion$font$fontsize$fontstyle$format$http://127.0.0.1:43110/17SWVnHoujG92yYGSZvCzPgZEpGVfRF8wi/$http://www.godevtool.com$http://www.godevtool.com/GolinkFrame.htm$http://www.godevtool.com/GorcFrame.htm$https://github.com/99fk$https://upx.github.io$https://upx.github.io/upx-license.html$https://www.everaldo.com/$https://www.scintilla.org/$https://www.scintilla.org/License.txt$icon$include$internalfilename$lang$lastfiles$lng$method$msvcrt.dll$originalfilename$overwrite$packer$password$privatebuild$productname$productversion$resource.exe$resource.rc$resource.res$save$session$session.ini$settings.ini$specialbuild$trademark$uac$upx.exe$useicon$usepassword$vinfo$wdir$0 = 32 Bit1 = 64 Bit2 = Een bestand met dezelfde naam is al geopend.3 = Een nieuwere versie kan gedownload worden.4 = Over5 = Over...6 = Toevoegen7 = Voeg bestanden en mappen toe die u in uw exe-bestand wil insluiten.8 = Icon toevoegen$0 = 32 1 = 64 2 = 3 = 4 = 5 = $0 = 32 1 = 64 2 = 3 = 4 = 5 = $0 = 32 1 = 64 2 = .3 =
API String ID: 3914532251-510742641
Opcode ID: abe88015203d56ed36c4a046761f0f5474ef6f78783db1ab7499cbd515e2dff1
Instruction ID: a1a737bb9e7fde856bcd06934ef0d572b52eb744c8e9f57cbaaacb1175981cec
Opcode Fuzzy Hash: abe88015203d56ed36c4a046761f0f5474ef6f78783db1ab7499cbd515e2dff1
Instruction Fuzzy Hash: FE2309B1B2190098FA03BB67ED963EA1621A79CBC4F904535BB0D4B7B7DE3CC1568781

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140059267 Relevance: 54.4, APIs: 27, Strings: 4, Instructions: 186
nativewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 0000000140059312
_wcsicmp.MSVCRT ref: 0000000140059323
_wcsicmp.MSVCRT ref: 0000000140059337
_wcsicmp.MSVCRT ref: 000000014005934B
NtdllDefWindowProc_W.NTDLL ref: 0000000140059364
CallWindowProcW.USER32 ref: 0000000140059382
SetBkMode.GDI32 ref: 0000000140059399
DeleteObject.GDI32 ref: 00000001400593B7
GetParent.USER32 ref: 00000001400593C0
GetClientRect.USER32 ref: 00000001400593D0
GetWindowRect.USER32 ref: 00000001400593DD
ScreenToClient.USER32 ref: 00000001400593EA
ScreenToClient.USER32 ref: 00000001400593F7
CreateCompatibleDC.GDI32 ref: 0000000140059400
CreateCompatibleBitmap.GDI32 ref: 000000014005941C
SelectObject.GDI32 ref: 0000000140059434
CreateWindowExW.USER32 ref: 0000000140059485
DestroyWindow.USER32 ref: 00000001400594A0
CreateBrushIndirect.GDI32 ref: 00000001400594B5
DeleteObject.GDI32 ref: 00000001400594C2
DeleteDC.GDI32 ref: 00000001400594CB
GetParent.USER32 ref: 00000001400594EA
GetUpdateRect.USER32 ref: 00000001400594FD
MapWindowPoints.USER32 ref: 0000000140059513
InvalidateRect.USER32 ref: 0000000140059526
GetParent.USER32 ref: 000000014005952E
CallWindowProcW.USER32 ref: 0000000140059556

Strings

static, xrefs: 000000014005932C
STATIC, xrefs: 000000014005945D
msctls_trackbar32, xrefs: 0000000140059318
button, xrefs: 0000000140059340

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$CreateRect$ClientDeleteObjectParent_wcsicmp$CallCompatibleProcScreen$BitmapBrushClassDestroyIndirectInvalidateModeNameNtdllPointsProc_SelectUpdate
String ID: STATIC$button$msctls_trackbar32$static
API String ID: 1446471921-3385832338
Opcode ID: caf1627c4eec0285cad871bf6b9a161c2e5edae6a8d33164866596f98c95c671
Instruction ID: 658ba7a2724baf115e960d496c5c2b151a09405456175dc92f309caa3d01d9a0
Opcode Fuzzy Hash: caf1627c4eec0285cad871bf6b9a161c2e5edae6a8d33164866596f98c95c671
Instruction Fuzzy Hash: 66812775310A418AFB16DF27E958BE867A1B74DBC8F444025EE0A57BB8DF39C949CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D138 Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 445memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

GetPropW.USER32 ref: 000000014005D195
GetParent.USER32 ref: 000000014005D1A6
GetPropW.USER32 ref: 000000014005D28A
RemovePropW.USER32 ref: 000000014005D2C5
RemovePropW.USER32 ref: 000000014005D2D5
RemovePropW.USER32 ref: 000000014005D2E5
RevokeDragDrop.OLE32 ref: 000000014005D2F3
HeapFree.KERNEL32 ref: 000000014005D30B
DestroyAcceleratorTable.USER32 ref: 000000014005D315
DeleteObject.GDI32 ref: 000000014005D324
UnregisterClassW.USER32 ref: 000000014005D350
SetRect.USER32 ref: 000000014005D3C2
GetWindowLongPtrW.USER32 ref: 000000014005D3D2
GetWindowLongPtrW.USER32 ref: 000000014005D3E1
AdjustWindowRectEx.USER32 ref: 000000014005D3F5
GetWindowLongPtrW.USER32 ref: 000000014005D41B
EnumChildWindows.USER32 ref: 000000014005D49B

Strings

PB_WindowID, xrefs: 000000014005D18B, 000000014005D280, 000000014005D2CB
PB_DropAccept, xrefs: 000000014005D2DB
PB_Focus, xrefs: 000000014005D2BB, 000000014005D531, 000000014005D55C
WindowClass_%I64d, xrefs: 000000014005D330

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Prop$Window$LongRemove$HeapRectValue$AcceleratorAdjustAllocateChildClassDeleteDestroyDragDropEnumFreeObjectParentRevokeTableUnregisterWindows
String ID: PB_DropAccept$PB_Focus$PB_WindowID$WindowClass_%I64d
API String ID: 165210820-3545793471
Opcode ID: 08f565460399752b6f029ff1de711b9bb46fbb3b2db891c088fcb8ad64e78e01
Instruction ID: 8d0fb6a0b4315c38fe2879c529041f097c5000b754124243fd5d7eecf97aa347
Opcode Fuzzy Hash: 08f565460399752b6f029ff1de711b9bb46fbb3b2db891c088fcb8ad64e78e01
Instruction Fuzzy Hash: C4028B3520564486FB7ADB67A954BE977A1FB8DBC4F444027AF0A07BF4EA3AC6448301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E59F8 Relevance: 37.0, APIs: 24, Instructions: 1011keyboardwindowtimeCOMMON

Download Yara Rule

APIs

IsChild.USER32 ref: 00007FFDFF1E5C72
GetDlgCtrlID.USER32 ref: 00007FFDFF1E5D3E
SystemParametersInfoA.USER32 ref: 00007FFDFF1E5D59
RegisterDragDrop.OLE32 ref: 00007FFDFF1E5D6A
GetCursorPos.USER32 ref: 00007FFDFF1E5DE2
ScreenToClient.USER32 ref: 00007FFDFF1E5DF1
SystemParametersInfoA.USER32 ref: 00007FFDFF1E5EBB
ClientToScreen.USER32 ref: 00007FFDFF1E600F
IsWindowUnicode.USER32 ref: 00007FFDFF1E619A
WideCharToMultiByte.KERNEL32 ref: 00007FFDFF1E6249

Part of subcall function 00007FFDFF1E80F8: MultiByteToWideChar.KERNEL32 ref: 00007FFDFF1E8184

GetKeyState.USER32 ref: 00007FFDFF1E62D7
GetKeyState.USER32 ref: 00007FFDFF1E62EB
GetKeyState.USER32 ref: 00007FFDFF1E62FF
GetMessageTime.USER32 ref: 00007FFDFF1E665D
ImmGetContext.IMM32 ref: 00007FFDFF1E667C
ImmReleaseContext.IMM32 ref: 00007FFDFF1E669D
GetKeyState.USER32 ref: 00007FFDFF1E66A7
GetMessageTime.USER32 ref: 00007FFDFF1E66DE
DefWindowProcA.USER32 ref: 00007FFDFF1E67E9
MsgWaitForMultipleObjects.USER32 ref: 00007FFDFF1E68A7
GetTickCount.KERNEL32 ref: 00007FFDFF1E68E5
PostMessageA.USER32 ref: 00007FFDFF1E6923
SetFocus.USER32 ref: 00007FFDFF1E69BE

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: State$Message$ByteCharClientContextInfoMultiParametersScreenSystemTimeWideWindow$ChildCountCtrlCursorDragDropFocusMultipleObjectsPostProcRegisterReleaseTickUnicodeWait
String ID:
API String ID: 498337836-0
Opcode ID: 62c81bc4dd386dcafd3e2b56fbedac2edf3f562c4a80de3ff49f12db06bf8903
Instruction ID: b0b0aca75606f33c621fa605cf29010ba9e09b7af07a01f2f76a28fe89970dd2
Opcode Fuzzy Hash: 62c81bc4dd386dcafd3e2b56fbedac2edf3f562c4a80de3ff49f12db06bf8903
Instruction Fuzzy Hash: F792BF23F1C18286EB689B298574ABD63A1BB85B44F944331D97E976DDCF3CF8418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400451E8 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 301
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

CreateFileW.KERNEL32 ref: 0000000140045262
CreateFileW.KERNEL32 ref: 0000000140045294
CreateFileW.KERNEL32 ref: 00000001400452C2
wcslen.MSVCRT ref: 00000001400452E6
RtlAllocateHeap.NTDLL ref: 00000001400452FC
wcscpy.MSVCRT ref: 0000000140045315
GetFileSize.KERNEL32 ref: 0000000140045324
ReadFile.KERNEL32 ref: 0000000140045354
SetFilePointer.KERNEL32 ref: 0000000140045395
RtlAllocateHeap.NTDLL ref: 00000001400453BF
RtlAllocateHeap.NTDLL ref: 00000001400453E2
ReadFile.KERNEL32 ref: 0000000140045404
HeapFree.KERNEL32 ref: 0000000140045445
RtlAllocateHeap.NTDLL ref: 000000014004548F
ReadFile.KERNEL32 ref: 00000001400454B1

Strings

1 VERSIONINFO , xrefs: 00000001400451FE

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: File$Heap$Allocate$CreateRead$Value$FreePointerSizewcscpywcslen
String ID: 1 VERSIONINFO
API String ID: 3925826109-1896404603
Opcode ID: 4bfc43e50e2c1553a3323a8df169fbb2b7b992d8c8d2c43e8cee915d4ead33e3
Instruction ID: 323a95fbaabbf88ee1aed4e977743c01f4a21cc0717a2b55bfe3a20a1e08ceb9
Opcode Fuzzy Hash: 4bfc43e50e2c1553a3323a8df169fbb2b7b992d8c8d2c43e8cee915d4ead33e3
Instruction Fuzzy Hash: 76D1C672601B808AFB22AF23E9543E97BA2F74DBD9F494525EB4D077A6CB38C055C304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140042388 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 155
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

IsDlgButtonChecked.USER32 ref: 0000000140042456
CreateWindowExW.USER32 ref: 000000014004249E
SetWindowPos.USER32 ref: 00000001400424CE
IsDlgButtonChecked.USER32 ref: 00000001400424E2
LoadIconW.USER32 ref: 0000000140042510
IsDlgButtonChecked.USER32 ref: 0000000140042533
IsDlgButtonChecked.USER32 ref: 0000000140042560
GetPropW.USER32 ref: 0000000140042570
SetWindowLongPtrW.USER32 ref: 0000000140042588
SetPropW.USER32 ref: 000000014004259B
SetPropW.USER32 ref: 00000001400425AE

Strings

pb_toolbar_id, xrefs: 00000001400425A1
tooltips_class32, xrefs: 0000000140042468
pb_toolbar_callback, xrefs: 0000000140042566, 000000014004258E
, xrefs: 00000001400423D6

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ButtonChecked$PropWindow$AcquireCreateCriticalIconLeaveLoadLockLongSection
String ID: $pb_toolbar_callback$pb_toolbar_id$tooltips_class32
API String ID: 1722330429-1814761405
Opcode ID: 942f98de3ede40f0b571863ba787d693c317c502c17d3e6ef69ff86931313903
Instruction ID: 75d574d1209dc3edef0b441d2a779c6ec036a4a3ca95a3e041f5a3cdefd3d71a
Opcode Fuzzy Hash: 942f98de3ede40f0b571863ba787d693c317c502c17d3e6ef69ff86931313903
Instruction Fuzzy Hash: 09615E71310B918AEB118F16E854B8A7BA4F78CBA0F554629EFA907BB4DF3CC515CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004C1BC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 107
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140073360: TlsGetValue.KERNEL32 ref: 0000000140073372
Part of subcall function 0000000140073360: RtlReAllocateHeap.NTDLL ref: 00000001400733F2

LoadLibraryW.KERNEL32 ref: 000000014004C1F5
GetProcAddress.KERNEL32 ref: 000000014004C20D
wcscpy.MSVCRT ref: 000000014004C23E
wcscat.MSVCRT ref: 000000014004C24D
wcslen.MSVCRT ref: 000000014004C255
FreeLibrary.KERNEL32 ref: 000000014004C26B
wcscat.MSVCRT ref: 000000014004C290
wcslen.MSVCRT ref: 000000014004C298

Strings

SHGetKnownFolderPath, xrefs: 000000014004C203
Shell32.DLL, xrefs: 000000014004C1EE
Downloads\, xrefs: 000000014004C286

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Librarywcscatwcslen$AddressAllocateFreeHeapLoadProcValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1264281023-287042676
Opcode ID: a63b801b5fdd5e4726106f3a32050b51207b42f0109926440ea8784a8a5929ed
Instruction ID: 8c02ef76267d68b6ccf2442072aca322582b9f51f9fb56f3b38c27db039d0bd1
Opcode Fuzzy Hash: a63b801b5fdd5e4726106f3a32050b51207b42f0109926440ea8784a8a5929ed
Instruction Fuzzy Hash: 2E41A63132464582FAA79FD7E554BE952A1E78DBC0F460239FB0A177F5DEF8C8059208

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BD20 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100memoryfileCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 000000014004BDAC
wcslen.MSVCRT ref: 000000014004BDB7
RtlAllocateHeap.NTDLL ref: 000000014004BDD1
wcscpy.MSVCRT ref: 000000014004BDE5
wcscat.MSVCRT ref: 000000014004BE04
wcscat.MSVCRT ref: 000000014004BE0F
FindFirstFileW.KERNEL32 ref: 000000014004BE1B
HeapFree.KERNEL32 ref: 000000014004BE51

Part of subcall function 0000000140072318: RtlAllocateHeap.NTDLL ref: 0000000140072345
Part of subcall function 0000000140072318: RtlAllocateHeap.NTDLL ref: 0000000140072373
Part of subcall function 0000000140072318: RtlInitializeCriticalSection.NTDLL ref: 0000000140072381

GetLastError.KERNEL32 ref: 000000014004BE30

Strings

*.*, xrefs: 000000014004BDA2

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$wcscatwcslen$CriticalErrorFileFindFirstFreeInitializeLastSectionwcscpy
String ID: *.*
API String ID: 3300757111-438819550
Opcode ID: 5736d66417ce6c243f3b3a5bc0d2d1ea22073a2a6189a526501c791dcfec24f5
Instruction ID: 1be9772cc1c903d97576badce6299f15b96f4e7be925bbeda0cb7c239c86d568
Opcode Fuzzy Hash: 5736d66417ce6c243f3b3a5bc0d2d1ea22073a2a6189a526501c791dcfec24f5
Instruction Fuzzy Hash: 81418B31300B4085EA56EF63AD453E967A1BB8CBE4F898625AF29073F5DE3CC4468344

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005A27C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76nativeCOMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 000000014005A2A9
NtdllDefWindowProc_W.NTDLL ref: 000000014005A377

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

CallWindowProcW.USER32 ref: 000000014005A2E3
RemovePropW.USER32 ref: 000000014005A310
RemovePropW.USER32 ref: 000000014005A320
RevokeDragDrop.OLE32 ref: 000000014005A32E
SetWindowLongPtrW.USER32 ref: 000000014005A33F

Strings

PB_DropAccept, xrefs: 000000014005A316
PB_ID, xrefs: 000000014005A306

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$LongPropRemove$AcquireCallCriticalDragDropLeaveLockNtdllProcProc_RevokeSection
String ID: PB_DropAccept$PB_ID
API String ID: 2869421363-3688647018
Opcode ID: ddf95e830567a1a3ff46b0a7b6b64d9a2c72c01e06cad03798cd952e3f533678
Instruction ID: 8d6d055c06ec53bb66c5a4d4b3ffd782926bf2b2ba21a79e116fadad93140a5e
Opcode Fuzzy Hash: ddf95e830567a1a3ff46b0a7b6b64d9a2c72c01e06cad03798cd952e3f533678
Instruction Fuzzy Hash: 06215C75301B8082EA15DF57E8447A9BBA1B789FE4F448625AF6A077F8CE3CC102C304

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400439C8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 0000000140043A18
memset.MSVCRT ref: 0000000140043A4A
GetVersionExW.KERNEL32 ref: 0000000140043A58
CreateWindowExW.USER32 ref: 0000000140043AE7
SetWindowLongPtrW.USER32 ref: 0000000140043B04
IsDlgButtonChecked.USER32 ref: 0000000140043B22

Strings

Scintilla, xrefs: 0000000140043AC4

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ValueWindowmemset$AllocateButtonCheckedCreateHeapLongVersion
String ID: Scintilla
API String ID: 932971817-657330430
Opcode ID: 027ea70b2156778a3ca974a5032721b1c153c0757e1c1bf4f80ca5030ce8eee4
Instruction ID: 361b5bb1b0f5858c3006a8782bcbad1945b171b3278f5a7701eabe37d690238e
Opcode Fuzzy Hash: 027ea70b2156778a3ca974a5032721b1c153c0757e1c1bf4f80ca5030ce8eee4
Instruction Fuzzy Hash: AC414A31204B8589EA12DF17F9547DABBA1F78CBE4F444626EB69477B4DB3CC1058B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C6A8 Relevance: 10.6, APIs: 7, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

GetWindow.USER32 ref: 000000014005C6EB
SetActiveWindow.USER32 ref: 000000014005C700
GetWindow.USER32 ref: 000000014005C718
IsZoomed.USER32 ref: 000000014005C72E
IsIconic.USER32 ref: 000000014005C748
IsIconic.USER32 ref: 000000014005C768
ShowWindow.USER32 ref: 000000014005C779

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$Iconic$AcquireActiveCriticalLeaveLockSectionShowZoomed
String ID:
API String ID: 1935891359-0
Opcode ID: e168c34a740619cd620a19c87c13f75022538ae979ab2c4ff71f1ae7602d2b50
Instruction ID: fefe5df98ba9cbf6f3b3df8c2d886920af55957ff77efe9c8d2cbc8430ac7adf
Opcode Fuzzy Hash: e168c34a740619cd620a19c87c13f75022538ae979ab2c4ff71f1ae7602d2b50
Instruction Fuzzy Hash: A2216035628A088AFB66DB27D554BA962D1FBCDBC0F14C121EB0A47BB8DF39C8458705

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D068 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014005D138: GetPropW.USER32 ref: 000000014005D195
Part of subcall function 000000014005D138: GetParent.USER32 ref: 000000014005D1A6
Part of subcall function 000000014005D138: GetPropW.USER32 ref: 000000014005D28A
Part of subcall function 000000014005D138: RemovePropW.USER32 ref: 000000014005D2C5

GetPropW.USER32 ref: 000000014005D0A3
DefFrameProcW.USER32 ref: 000000014005D0EC
SetLastError.KERNEL32 ref: 000000014005D0F6
NtdllDefWindowProc_W.NTDLL ref: 000000014005D110

Strings

PB_MDI_Gadget, xrefs: 000000014005D099

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Prop$ErrorFrameLastNtdllParentProcProc_RemoveWindow
String ID: PB_MDI_Gadget
API String ID: 3534055887-983833826
Opcode ID: 73ed6c27279a81bcb74f4072f52a5ff1b40b514d95983472f437c2e7eadeb7c8
Instruction ID: 4794eff79031289fd958da7dc70ce1f03a54d1bb29baae4f62bc3f913dab499d
Opcode Fuzzy Hash: 73ed6c27279a81bcb74f4072f52a5ff1b40b514d95983472f437c2e7eadeb7c8
Instruction Fuzzy Hash: EB11AC30600B0086EA769B57A9803ADB6A1B34EFC0F584217EF1903BF4DF7AC5428349

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140057E94 Relevance: 7.6, APIs: 5, Instructions: 53nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

CallWindowProcW.USER32 ref: 0000000140057EEE
GetWindowLongPtrW.USER32 ref: 0000000140057F13
GetClientRect.USER32 ref: 0000000140057F29
FillRect.USER32 ref: 0000000140057F3A

Part of subcall function 000000014005A4A4: GetWindowLongPtrW.USER32 ref: 000000014005A4BE
Part of subcall function 000000014005A4A4: GetPropW.USER32 ref: 000000014005A4DF

NtdllDefWindowProc_W.NTDLL ref: 0000000140057F4F

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$LongRectValue$AllocateCallClientFillHeapNtdllProcProc_Prop
String ID:
API String ID: 2238256497-0
Opcode ID: 18cab80f140554fc767359f2bb6d71375fe89ca78f85a7049b6bc299c0ce170d
Instruction ID: a63723faf5f90f6f98c812b8803360b0bff4a2f725e821f47f1e462c91d44cfd
Opcode Fuzzy Hash: 18cab80f140554fc767359f2bb6d71375fe89ca78f85a7049b6bc299c0ce170d
Instruction Fuzzy Hash: FA111631614B8186EA16DF17F844BDAA762BB8DBD0F488065EF4A03BA9DE3CC5158604

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400471B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

RtlRemoveVectoredExceptionHandler.NTDLL ref: 0000000140047585
RtlAddVectoredExceptionHandler.NTDLL ref: 00000001400475A0

Strings

P%_, xrefs: 0000000140047579

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ExceptionHandlerVectored$Remove
String ID: P%_
API String ID: 3670940754-2161797920
Opcode ID: 562bd430401dd225abc9ce45866009821a6949765fc5e4bcefe9fea4a951548d
Instruction ID: 7cca246f69d76dfe07f3a072409c1ae4f2e560ad1152d573ec622672e67efdc5
Opcode Fuzzy Hash: 562bd430401dd225abc9ce45866009821a6949765fc5e4bcefe9fea4a951548d
Instruction Fuzzy Hash: 43F01270201E44C9FE2B4F93B9047E566A1BB4CB80F4505759B0E0B6B09B7C8454C218

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1CE214 Relevance: 2.6, Strings: 1, Instructions: 1375COMMON

Download Yara Rule

Strings

%2X, xrefs: 00007FFDFF1CF0E7

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: %2X
API String ID: 0-1225248942
Opcode ID: 6b5b5ae962265b27804f2945618446264a62fc4cd0759498a95de1d67e8e6c13
Instruction ID: bb21cadd7134c5ae9e6693dafc10cf4c99eaab35638c5c6c6fa468a7874aaf37
Opcode Fuzzy Hash: 6b5b5ae962265b27804f2945618446264a62fc4cd0759498a95de1d67e8e6c13
Instruction Fuzzy Hash: BCE26C37A086C18AD771CF19E094BEEB7A6F788B44F144225DAA953B98DB3CE545CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005AA9C Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 000000014005AAC5
RtlAllocateHeap.NTDLL ref: 000000014005AAEB
CreateDCW.GDI32 ref: 000000014005AB12
CreateCompatibleDC.GDI32 ref: 000000014005AB26
GetSystemMetrics.USER32 ref: 000000014005AB39
GetSystemMetrics.USER32 ref: 000000014005AB46

Part of subcall function 000000014005A6EC: CreateCompatibleBitmap.GDI32 ref: 000000014005A70C
Part of subcall function 000000014005A6EC: SelectObject.GDI32 ref: 000000014005A732
Part of subcall function 000000014005A6EC: GetStockObject.GDI32 ref: 000000014005A73D
Part of subcall function 000000014005A6EC: FillRect.USER32 ref: 000000014005A74E

GetSystemMetrics.USER32 ref: 000000014005AB69
GetSystemMetrics.USER32 ref: 000000014005AB76
DeleteDC.GDI32 ref: 000000014005AB97
DeleteDC.GDI32 ref: 000000014005ABA0
GetSystemMetrics.USER32 ref: 000000014005ABAB
GetSystemMetrics.USER32 ref: 000000014005ABB8
GetSystemMetrics.USER32 ref: 000000014005ABF8
GetSystemMetrics.USER32 ref: 000000014005AC03

Strings

DISPLAY, xrefs: 000000014005AB03

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Create$AllocateCompatibleDeleteHeapObject$BitmapFillRectSelectStock
String ID: DISPLAY
API String ID: 945146972-865373369
Opcode ID: b4c46c7983044e4ae41496883975320106f061bdf85e6da9a99c5717251bc317
Instruction ID: eb27f52c0ccd5446c3c3e634acd2294e8d99a21491a9c033efc2871a762fb7d6
Opcode Fuzzy Hash: b4c46c7983044e4ae41496883975320106f061bdf85e6da9a99c5717251bc317
Instruction Fuzzy Hash: 89413935711A118AEB269F23E858B99BBA5F78CF81F4480299F4A43BB0DF7DD405CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140042CA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 116
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

Part of subcall function 000000014005A17C: LoadLibraryW.KERNEL32 ref: 000000014005A19B
Part of subcall function 000000014005A17C: GetProcAddress.KERNEL32 ref: 000000014005A1B3
Part of subcall function 000000014005A17C: memset.MSVCRT ref: 000000014005A1CC
Part of subcall function 000000014005A17C: FreeLibrary.KERNEL32 ref: 000000014005A208
Part of subcall function 000000014005A17C: LoadLibraryW.KERNEL32 ref: 000000014005A215
Part of subcall function 000000014005A17C: GetProcAddress.KERNEL32 ref: 000000014005A231

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

RtlAllocateHeap.NTDLL ref: 0000000140042D07
GetPropW.USER32 ref: 0000000140042D62
SetWindowLongPtrW.USER32 ref: 0000000140042D7A
SetPropW.USER32 ref: 0000000140042D89
SetPropW.USER32 ref: 0000000140042D9D
SetWindowLongPtrW.USER32 ref: 0000000140042DB2
SetPropW.USER32 ref: 0000000140042DC1
IsDlgButtonChecked.USER32 ref: 0000000140042DD6
IsDlgButtonChecked.USER32 ref: 0000000140042DEC
GetClientRect.USER32 ref: 0000000140042DFD
IsDlgButtonChecked.USER32 ref: 0000000140042E23
HeapFree.KERNEL32 ref: 0000000140042E44

Strings

pb_statusbar_id, xrefs: 0000000140042D93
pb_statusbar_callback, xrefs: 0000000140042D4B

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Prop$ButtonCheckedHeapLibrary$AddressAllocateFreeLoadLongProcValueWindow$AcquireClientCriticalLeaveLockRectSectionmemset
String ID: pb_statusbar_callback$pb_statusbar_id
API String ID: 191362439-3395164763
Opcode ID: 823bd31dd6397a4683aa67939e3887ce7ad1bb8791906cac6ae5108e03393625
Instruction ID: 11f8e8a6b54701c08dc54cb03ae52074999b8a3f4b420dad9b31fd5536de160f
Opcode Fuzzy Hash: 823bd31dd6397a4683aa67939e3887ce7ad1bb8791906cac6ae5108e03393625
Instruction Fuzzy Hash: 9C415B72300A418AEB16AF63E9187DA6BA1B78DFD5F448524DF1917BB8DE3CC5068740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400500A4 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDlgButtonChecked.USER32 ref: 00000001400500E4
GetWindowLongPtrW.USER32 ref: 0000000140050100
IsDlgButtonChecked.USER32 ref: 0000000140050119
SetPropW.USER32 ref: 0000000140050135
SetCapture.USER32 ref: 000000014005013E
GetWindowLongPtrW.USER32 ref: 000000014005014C
GetPropW.USER32 ref: 0000000140050173
ReleaseCapture.USER32 ref: 00000001400501C1
RemovePropW.USER32 ref: 00000001400501D1
GetPropW.USER32 ref: 00000001400501F0
ReleaseCapture.USER32 ref: 00000001400501FB
RemovePropW.USER32 ref: 000000014005020B
CallWindowProcW.USER32 ref: 000000014005023C

Strings

PB_MouseDown, xrefs: 0000000140050128, 000000014005016C, 00000001400501C7, 00000001400501E9, 0000000140050201

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Prop$CaptureWindow$ButtonCheckedLongReleaseRemove$CallProc
String ID: PB_MouseDown
API String ID: 3342513413-1480470280
Opcode ID: ba44510f76d55d8c4331bad268e00d244994606d40a2f2ae7efebf52f0be5efc
Instruction ID: 155dd207d7193abad236b30b39cb59d21343c42e98b4ab13da1170a505124cfd
Opcode Fuzzy Hash: ba44510f76d55d8c4331bad268e00d244994606d40a2f2ae7efebf52f0be5efc
Instruction Fuzzy Hash: 9E416D34310A968AFA16DF67E948BED27A1B78DBC0F585424EF0A477F9DE79C4058600

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005BFC8 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 237
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

memset.MSVCRT ref: 000000014005C05F
RegisterClassW.USER32 ref: 000000014005C0B2
AdjustWindowRectEx.USER32 ref: 000000014005C147
CreateWindowExW.USER32 ref: 000000014005C218
SetPropW.USER32 ref: 000000014005C23D
ShowWindow.USER32 ref: 000000014005C277
RtlAllocateHeap.NTDLL ref: 000000014005C2A5
CreateAcceleratorTableW.USER32 ref: 000000014005C2F0

Part of subcall function 00000001401097A0: GetPropW.USER32 ref: 0000000140109804
Part of subcall function 00000001401097A0: GetPropW.USER32 ref: 0000000140109832
Part of subcall function 00000001401097A0: HeapFree.KERNEL32 ref: 0000000140109852

ShowWindow.USER32 ref: 000000014005C347
UnregisterClassW.USER32 ref: 000000014005C362

Strings

PB_WindowID, xrefs: 000000014005C230
WindowClass_%I64d, xrefs: 000000014005C022

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$Prop$ClassCreateHeapShow$AcceleratorAcquireAdjustAllocateCriticalFreeLeaveLockRectRegisterSectionTableUnregistermemset
String ID: PB_WindowID$WindowClass_%I64d
API String ID: 676206387-780217238
Opcode ID: e2f75005e19bfe89b76a6393ed77f64917fb27f59e3f1e452ee5042d8ff111c5
Instruction ID: 35df488138f021de680914c759e51184770106a4a2a8c40daebb526356380349
Opcode Fuzzy Hash: e2f75005e19bfe89b76a6393ed77f64917fb27f59e3f1e452ee5042d8ff111c5
Instruction Fuzzy Hash: 08B16D33610B848EEB21CF66E8847D977E1F78C798F108229EB5A47BA4DB39C544CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140059660 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 157
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 00000001400596B3
RegisterClassExW.USER32 ref: 00000001400596E8
LoadCursorW.USER32 ref: 00000001400596F5
LoadCursorW.USER32 ref: 0000000140059709
memset.MSVCRT ref: 0000000140059727
CreateWindowExW.USER32 ref: 00000001400597EB
RtlAllocateHeap.NTDLL ref: 000000014005981F
SetParent.USER32 ref: 00000001400598B3
SetParent.USER32 ref: 00000001400598C3
SetWindowLongPtrW.USER32 ref: 00000001400598D2
InvalidateRect.USER32 ref: 00000001400598F6

Strings

PureSplitter, xrefs: 0000000140059695

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateCursorHeapLoadParentValueWindowmemset$ClassCreateInvalidateLongRectRegister
String ID: PureSplitter
API String ID: 814377489-3781326138
Opcode ID: 49fe0d503b67e54adf8d7cc63483ec5abdf4ca0b06acef512a735b2d4e076d7a
Instruction ID: a927639da4846324ff2a4cc4cf4688c7537fd99f41acdfbaa194b16e75f33a1f
Opcode Fuzzy Hash: 49fe0d503b67e54adf8d7cc63483ec5abdf4ca0b06acef512a735b2d4e076d7a
Instruction Fuzzy Hash: 2B810776610A008AEB12DF26E8547D97BA5F78CB98F504226EF5E477B8DF39C405C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400DF7E0 Relevance: 19.6, APIs: 13, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF852
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF85F
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF87A
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF88E
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF8AA
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF8BE
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF8DA
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF8F7
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF922
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF944
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF96D
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF981
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DF9DC

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 61263546a891eb812b6a26d0e714812a3d778fbdc5cade975e1c443c94daf1dc
Instruction ID: 181c8228ccc516e777d6a3a58bd83488c814d1b7392a1f05392304153b2a1b47
Opcode Fuzzy Hash: 61263546a891eb812b6a26d0e714812a3d778fbdc5cade975e1c443c94daf1dc
Instruction Fuzzy Hash: 8551E936206A8095E755DF32D8903ED37A1FB89FC8F489035EF8A4B769CF3984558361

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140109050 Relevance: 19.6, APIs: 13, Instructions: 81
memoryregistrythreadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsAlloc.KERNEL32 ref: 000000014010907E
RtlInitializeCriticalSection.NTDLL ref: 000000014010908D
TlsGetValue.KERNEL32 ref: 00000001401090A3
RtlAllocateHeap.NTDLL ref: 00000001401090C3
RtlAcquirePebLock.NTDLL ref: 00000001401090D8
RtlLeaveCriticalSection.NTDLL ref: 00000001401090FB
GetCurrentProcess.KERNEL32 ref: 0000000140109101
GetCurrentThread.KERNEL32 ref: 000000014010910A
GetCurrentProcess.KERNEL32 ref: 0000000140109113
DuplicateHandle.KERNEL32 ref: 0000000140109138
RegisterWaitForSingleObject.KERNEL32 ref: 000000014010915D
TlsSetValue.KERNEL32 ref: 000000014010916C
RtlAllocateHeap.NTDLL ref: 000000014010917F

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Current$AllocateCriticalHeapProcessSectionValue$AcquireAllocDuplicateHandleInitializeLeaveLockObjectRegisterSingleThreadWait
String ID:
API String ID: 4033017058-0
Opcode ID: 9428ee6f4bbde05629422076c9a105266dee3d648fdafaeb44e6f58e3978a438
Instruction ID: 140b43686b5a253201a77e60fd68929639ab6021d67050e4009ccc20a6755d4a
Opcode Fuzzy Hash: 9428ee6f4bbde05629422076c9a105266dee3d648fdafaeb44e6f58e3978a438
Instruction Fuzzy Hash: 9E41F276204B41CAEB128F23EC587997BA0F78CB99F084525AB9D03BB4DF78C559C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EB70 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 179
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPropW.USER32 ref: 000000014004EBA2
HeapFree.KERNEL32 ref: 000000014004EC46
RemovePropW.USER32 ref: 000000014004EC6C
RevokeDragDrop.OLE32 ref: 000000014004EC75
RtlAllocateHeap.NTDLL ref: 000000014004EC96
RegisterDragDrop.OLE32 ref: 000000014004ECD8
RevokeDragDrop.OLE32 ref: 000000014004ECE8
RegisterDragDrop.OLE32 ref: 000000014004ECF4
SetPropW.USER32 ref: 000000014004ED0B
RtlAllocateHeap.NTDLL ref: 000000014004ED5D

Strings

PB_DropAccept, xrefs: 000000014004EB92, 000000014004EC62, 000000014004ECFE

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: DragDrop$HeapProp$AllocateRegisterRevoke$FreeRemove
String ID: PB_DropAccept
API String ID: 588632010-2550732394
Opcode ID: e6bfa1a3efc291ca0f0142d14dc48d1db63e13b70bba36630f4c5ec7b24087fb
Instruction ID: 5e0e5b29fffe5bd054d3dc22a33a9390846405c128d21c3a6fb726b9e6ff5ece
Opcode Fuzzy Hash: e6bfa1a3efc291ca0f0142d14dc48d1db63e13b70bba36630f4c5ec7b24087fb
Instruction Fuzzy Hash: 9F811672605B8486EF668F16EA943A877A4F74CFC4F26852AEF09073B4DB38C845C345

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140051B00 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 0000000140051B60
CreateWindowExW.USER32 ref: 0000000140051CF2
GetWindow.USER32 ref: 0000000140051D23
GetWindow.USER32 ref: 0000000140051D35
GetWindowLongPtrW.USER32 ref: 0000000140051D46
SetWindowLongPtrW.USER32 ref: 0000000140051D5C
IsDlgButtonChecked.USER32 ref: 0000000140051DA1
GetWindowRect.USER32 ref: 0000000140051DAE
IsDlgButtonChecked.USER32 ref: 0000000140051DD4

Part of subcall function 000000014005A17C: LoadLibraryW.KERNEL32 ref: 000000014005A19B
Part of subcall function 000000014005A17C: GetProcAddress.KERNEL32 ref: 000000014005A1B3
Part of subcall function 000000014005A17C: memset.MSVCRT ref: 000000014005A1CC
Part of subcall function 000000014005A17C: FreeLibrary.KERNEL32 ref: 000000014005A208
Part of subcall function 000000014005A17C: LoadLibraryW.KERNEL32 ref: 000000014005A215
Part of subcall function 000000014005A17C: GetProcAddress.KERNEL32 ref: 000000014005A231

Strings

ComboBoxEx32, xrefs: 0000000140051C93
ComboBox, xrefs: 0000000140051DF3

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$Library$AddressButtonCheckedLoadLongProcValuememset$AllocateCreateFreeHeapRect
String ID: ComboBox$ComboBoxEx32
API String ID: 1123204175-1907415764
Opcode ID: 53cfcb25ca43c8e24804be34910d93b575a823d27fc4a9e2955256f5e001c160
Instruction ID: e334482a374c4d62dfb3b64f5212f7795842bcfaa1e0c8b25b6060b12cc45cda
Opcode Fuzzy Hash: 53cfcb25ca43c8e24804be34910d93b575a823d27fc4a9e2955256f5e001c160
Instruction Fuzzy Hash: 42912971221B008AEB12DF66E8807DA3BA4F78DBA4F50462AEB5D077B4DF39C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004B5EC Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 58libraryloadernetworkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 000000014004B63E
LoadLibraryW.KERNEL32 ref: 000000014004B65D
GetProcAddress.KERNEL32 ref: 000000014004B67D
GetProcAddress.KERNEL32 ref: 000000014004B698
GetProcAddress.KERNEL32 ref: 000000014004B6B3
GetProcAddress.KERNEL32 ref: 000000014004B6CE

Part of subcall function 0000000140072318: RtlAllocateHeap.NTDLL ref: 0000000140072345
Part of subcall function 0000000140072318: RtlAllocateHeap.NTDLL ref: 0000000140072373
Part of subcall function 0000000140072318: RtlInitializeCriticalSection.NTDLL ref: 0000000140072381

Strings

getaddrinfo, xrefs: 000000014004B673
freeaddrinfo, xrefs: 000000014004B68A
getnameinfo, xrefs: 000000014004B6A5
ws2_32.dll, xrefs: 000000014004B656
WSAStringToAddressA, xrefs: 000000014004B6C0

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AddressProc$AllocateHeap$CriticalInitializeLibraryLoadSectionStartup
String ID: WSAStringToAddressA$freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll
API String ID: 2601949007-3312996600
Opcode ID: 5ba5cfb9711941f1d54b8b0693867105c55f0bb43ba028a2bbaf9c7ea9d29b8c
Instruction ID: 099806b76bf9bae8c32851a6e416f5f235b397a828727b93cba6a1c37db9afb9
Opcode Fuzzy Hash: 5ba5cfb9711941f1d54b8b0693867105c55f0bb43ba028a2bbaf9c7ea9d29b8c
Instruction Fuzzy Hash: B331C674202B458AFA129F12FE947E43BE5F78CB84F84016ADB49432B8EB7C8455C714

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006AF58 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000000014006AF78
GetProcAddress.KERNEL32 ref: 000000014006AF90
memset.MSVCRT ref: 000000014006AFA9
FreeLibrary.KERNEL32 ref: 000000014006AFD3
LoadLibraryW.KERNEL32 ref: 000000014006AFE0
GetProcAddress.KERNEL32 ref: 000000014006AFF8
FreeLibrary.KERNEL32 ref: 000000014006B019

Strings

COMCTL32.DLL, xrefs: 000000014006AF6E
uxtheme.dll, xrefs: 000000014006AFD9
DllGetVersion, xrefs: 000000014006AF86
IsAppThemed, xrefs: 000000014006AFEE

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc$memset
String ID: COMCTL32.DLL$DllGetVersion$IsAppThemed$uxtheme.dll
API String ID: 4277437538-2634860346
Opcode ID: 86d897256496a63417ceb7d3867a75213c74a56ce373c79eace759b15224e07f
Instruction ID: c21bf3b63801ef545a544740c19475e3919847166ec579082611992a7a775ee8
Opcode Fuzzy Hash: 86d897256496a63417ceb7d3867a75213c74a56ce373c79eace759b15224e07f
Instruction Fuzzy Hash: A9213771205B4186FB269B6BE8443AA67E1FB8CBC4F484425AB4D437A8EF3CC545DB21

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140042EF0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

GetPropW.USER32 ref: 0000000140042F1F
GetParent.USER32 ref: 0000000140042F3D
GetPropW.USER32 ref: 0000000140042F4D

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

RemovePropW.USER32 ref: 0000000140042F78
GetParent.USER32 ref: 0000000140042F81
RemovePropW.USER32 ref: 0000000140042F91
HeapFree.KERNEL32 ref: 0000000140042FD0

Part of subcall function 000000014006B6C8: DeleteObject.GDI32 ref: 000000014006B6D6

CallWindowProcW.USER32 ref: 0000000140042FF7

Strings

pb_statusbar_id, xrefs: 0000000140042F43, 0000000140042F87
pb_statusbar_callback, xrefs: 0000000140042F0F, 0000000140042F6E

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Prop$ParentRemove$AcquireCallCriticalDeleteFreeHeapLeaveLockObjectProcSectionWindow
String ID: pb_statusbar_callback$pb_statusbar_id
API String ID: 4274217687-3395164763
Opcode ID: f7e171a33a8f220ea0c6cbc038c0cfb9685c2d018f2257efdb0433b094da8998
Instruction ID: 2978f9610ec0be769d8d77013a6a62ef60f499d3317b1d631a4d9f8d2c77fd8c
Opcode Fuzzy Hash: f7e171a33a8f220ea0c6cbc038c0cfb9685c2d018f2257efdb0433b094da8998
Instruction Fuzzy Hash: 7A314536201B4596EA02DF23E948B99B761F78CFD4F858026EE5A077B8DF78C14AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D8F4 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000000014005D918
GetProcAddress.KERNEL32 ref: 000000014005D938
GetProcAddress.KERNEL32 ref: 000000014005D953
GetDC.USER32 ref: 000000014005D96C
GetDeviceCaps.GDI32 ref: 000000014005D97D
GetDeviceCaps.GDI32 ref: 000000014005D9A3
ReleaseDC.USER32 ref: 000000014005D9C6

Strings

DwmIsCompositionEnabled, xrefs: 000000014005D92E
DwmGetWindowAttribute, xrefs: 000000014005D945
dwmapi.dll, xrefs: 000000014005D907

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AddressCapsDeviceProc$LibraryLoadRelease
String ID: DwmGetWindowAttribute$DwmIsCompositionEnabled$dwmapi.dll
API String ID: 2286125855-3767204498
Opcode ID: 8f73be39c96b45b4c1b593e37275115602087021babc49e2a4b4e66be1061437
Instruction ID: a79f731339f5b4f7f8d54a46f45f1d1b6a9ecfe26da46b6a31388cd1d690f1ae
Opcode Fuzzy Hash: 8f73be39c96b45b4c1b593e37275115602087021babc49e2a4b4e66be1061437
Instruction Fuzzy Hash: 6C211A76611A069EFB43DF23F8557D53BA1BB4D781F40412A960B223B4EF3D9489CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005803C Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 0000000140058098
memset.MSVCRT ref: 00000001400580F3
LoadCursorW.USER32 ref: 0000000140058128
RegisterClassExW.USER32 ref: 000000014005813D
CreateWindowExW.USER32 ref: 00000001400581DD
SetClassLongPtrW.USER32 ref: 00000001400581F7
SetWindowLongPtrW.USER32 ref: 000000014005821C
InvalidateRect.USER32 ref: 0000000140058233

Strings

PureContainer, xrefs: 000000014005807C

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ClassLongValueWindowmemset$AllocateCreateCursorHeapInvalidateLoadRectRegister
String ID: PureContainer
API String ID: 481525289-2295191815
Opcode ID: 0c1ee3fd1d2f01dcae2ad156badc699a86c7d7869b87812eff6904008fbdd564
Instruction ID: c1c61671dae80b1931d49294047bd8cafc6887e6a43e3a5175261d78cff3fcbf
Opcode Fuzzy Hash: 0c1ee3fd1d2f01dcae2ad156badc699a86c7d7869b87812eff6904008fbdd564
Instruction Fuzzy Hash: 65514872210B408AEB12DF66E9447DA7BA5F78CB98F404226EF1D47BB4DB39C506C744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400523B4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

CreateWindowExW.USER32 ref: 0000000140052427
SetWindowLongPtrW.USER32 ref: 0000000140052440
SetWindowLongPtrW.USER32 ref: 0000000140052452
memset.MSVCRT ref: 0000000140052463
GetParent.USER32 ref: 000000014005247B
IsDlgButtonChecked.USER32 ref: 00000001400524A4
IsDlgButtonChecked.USER32 ref: 00000001400524BB

Strings

@, xrefs: 000000014005246B
tooltips_class32, xrefs: 00000001400523EF

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$ButtonCheckedLongValue$AllocateCreateHeapParentmemset
String ID: @$tooltips_class32
API String ID: 3252620959-517154873
Opcode ID: c2b980bf1f65dfe69ca701bf5bfd5b55a748c2ef79e4a03383ca7c7a15c1e3c0
Instruction ID: 904af95b8a58caedbb48ad19bfb5e9f87698ebc37ed36b1d9bb9e18f2c75ff39
Opcode Fuzzy Hash: c2b980bf1f65dfe69ca701bf5bfd5b55a748c2ef79e4a03383ca7c7a15c1e3c0
Instruction Fuzzy Hash: F0315E72204B8086E711CF22F84478AB7B4F78CB94F605126EB8D43BA8DF39C545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140042898 Relevance: 15.1, APIs: 10, Instructions: 133COMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32 ref: 00000001400428DD
GetObjectType.GDI32 ref: 00000001400428E9
GetObjectW.GDI32 ref: 0000000140042902
00007FFE118FD200.COMCTL32 ref: 0000000140042968
DeleteObject.GDI32 ref: 000000014004297B
DeleteObject.GDI32 ref: 0000000140042989
IsDlgButtonChecked.USER32 ref: 00000001400429B7
IsDlgButtonChecked.USER32 ref: 0000000140042A1F
IsDlgButtonChecked.USER32 ref: 0000000140042A3E
IsDlgButtonChecked.USER32 ref: 0000000140042A59

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ButtonChecked$Object$Delete$00007D200E118Type
String ID:
API String ID: 1600253914-0
Opcode ID: e045d8da5406927a0ee704104aac2c8bb9d9ebeadf38646ce5cc85e47236e1f2
Instruction ID: 4e73422f702b30a200f546e06cb342d2bdac94c2be405ab5d577e57a18b4fb70
Opcode Fuzzy Hash: e045d8da5406927a0ee704104aac2c8bb9d9ebeadf38646ce5cc85e47236e1f2
Instruction Fuzzy Hash: F8518B767006518AEB16CF67E850BEA7BA0F38CB88F844425DF0A53BA4DF38C916C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140056944 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

CreateWindowExW.USER32 ref: 0000000140056A35
IsDlgButtonChecked.USER32 ref: 0000000140056A67
IsDlgButtonChecked.USER32 ref: 0000000140056A81
memset.MSVCRT ref: 0000000140056A9F
IsDlgButtonChecked.USER32 ref: 0000000140056C47
SetWindowLongPtrW.USER32 ref: 0000000140056C5C

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

IsDlgButtonChecked.USER32 ref: 0000000140056CA9

Strings

SysListView32, xrefs: 00000001400569FE

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ButtonChecked$ValueWindow$AcquireAllocateCreateCriticalHeapLeaveLockLongSectionmemset
String ID: SysListView32
API String ID: 1338147022-78025650
Opcode ID: 5d3cc716793b466e2a0f6717c96c355dbff5b4a86847cef3406031d4152f4dc3
Instruction ID: 154e25eabb41d866b907840bd9a7566b1e79f5e9d118594eff7b4a1c62514d8b
Opcode Fuzzy Hash: 5d3cc716793b466e2a0f6717c96c355dbff5b4a86847cef3406031d4152f4dc3
Instruction Fuzzy Hash: C2A1E375621B849AEB12DF26F8917D67BA8F74CB90F804226AB4D037B1EF3AC554C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401097A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

GetPropW.USER32 ref: 0000000140109804
GetPropW.USER32 ref: 0000000140109832
HeapFree.KERNEL32 ref: 0000000140109852
RtlAllocateHeap.NTDLL ref: 0000000140109893
RtlAllocateHeap.NTDLL ref: 00000001401098BA
SetPropW.USER32 ref: 00000001401098D1
SetWindowLongPtrW.USER32 ref: 00000001401098E6

Strings

PB_GadgetStack_%I64i, xrefs: 00000001401097E6

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProp$Value$FreeLongWindow
String ID: PB_GadgetStack_%I64i
API String ID: 1265686114-1095576542
Opcode ID: 241260f12132a6e29b6d92f5cf9ddcc7d100ba6d9c5115a787008eca9544931f
Instruction ID: e1c3a845f48a7e410ee9814ab618b6363a5fb151770200a54f528270a1753ccd
Opcode Fuzzy Hash: 241260f12132a6e29b6d92f5cf9ddcc7d100ba6d9c5115a787008eca9544931f
Instruction Fuzzy Hash: 2B410276200B449AEB25CF26E99439877A4F38CF84F04822ADB8D47BA4DF38D565C780

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140058A24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

Part of subcall function 000000014005A17C: LoadLibraryW.KERNEL32 ref: 000000014005A19B
Part of subcall function 000000014005A17C: GetProcAddress.KERNEL32 ref: 000000014005A1B3
Part of subcall function 000000014005A17C: memset.MSVCRT ref: 000000014005A1CC
Part of subcall function 000000014005A17C: FreeLibrary.KERNEL32 ref: 000000014005A208
Part of subcall function 000000014005A17C: LoadLibraryW.KERNEL32 ref: 000000014005A215
Part of subcall function 000000014005A17C: GetProcAddress.KERNEL32 ref: 000000014005A231

GetProcAddress.KERNEL32 ref: 0000000140058A70
memset.MSVCRT ref: 0000000140058A8E
CreateWindowExW.USER32 ref: 0000000140058C2E
SetWindowLongPtrW.USER32 ref: 0000000140058C5D
SetWindowPos.USER32 ref: 0000000140058C8F

Strings

DrawThemeParentBackground, xrefs: 0000000140058A69
SysTabControl32, xrefs: 0000000140058C03

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AddressLibraryProcWindow$LoadValuememset$AllocateCreateFreeHeapLong
String ID: DrawThemeParentBackground$SysTabControl32
API String ID: 442367357-4092177286
Opcode ID: c54b15d8e2843f8c06e82ae3c0851dd48198f4103a134a537228db6631910028
Instruction ID: f3322bfa9bbdf17a09ea2b75bd7bbea5a663799ec573e32df6ebb6dc9273ff05
Opcode Fuzzy Hash: c54b15d8e2843f8c06e82ae3c0851dd48198f4103a134a537228db6631910028
Instruction Fuzzy Hash: 1261E275625B448AEB22CF16F8803C67BA5F78CB91F804226AE4D437B4EF79C544C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DF94 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57registryclipboardCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014005DFA8
RegisterClassW.USER32 ref: 000000014005DFFE
CreateWindowExW.USER32 ref: 000000014005E047
RegisterClipboardFormatW.USER32 ref: 000000014005E05B

Part of subcall function 000000014007204C: TlsAlloc.KERNEL32 ref: 0000000140072082
Part of subcall function 000000014007204C: RtlAllocateHeap.NTDLL ref: 000000014007209D
Part of subcall function 000000014007204C: TlsSetValue.KERNEL32 ref: 00000001400720AC
Part of subcall function 000000014007204C: TlsGetValue.KERNEL32 ref: 00000001400720CF
Part of subcall function 000000014007204C: RtlReAllocateHeap.NTDLL ref: 00000001400720EB
Part of subcall function 000000014007204C: TlsSetValue.KERNEL32 ref: 00000001400720FD

Part of subcall function 000000014005E9D8: RtlAllocateHeap.NTDLL ref: 000000014005EA11
Part of subcall function 000000014005E9D8: RtlAllocateHeap.NTDLL ref: 000000014005EA42
Part of subcall function 000000014005E9D8: RtlAllocateHeap.NTDLL ref: 000000014005EAB2

RtlInitializeCriticalSection.NTDLL ref: 000000014005E0BB

Strings

PostEventClass, xrefs: 000000014005DFD1
PB_PostEventMessage, xrefs: 000000014005E04D

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateHeap$Value$Register$AllocClassClipboardCreateCriticalFormatInitializeSectionWindowmemset
String ID: PB_PostEventMessage$PostEventClass
API String ID: 258285246-297677326
Opcode ID: 6a58de0acd6f206d3b57b0bef602eba99f44720a4b0cc21f5f44cc6013f01001
Instruction ID: 550606e72bcdf02e498d1b934216786abb347d511b38ba93430ad8505d41d3a6
Opcode Fuzzy Hash: 6a58de0acd6f206d3b57b0bef602eba99f44720a4b0cc21f5f44cc6013f01001
Instruction Fuzzy Hash: 0131F672524B858AF761DF22F8457DAB7A0F389348F50422AE789476B4EB7DC548CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BA80 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140073360: TlsGetValue.KERNEL32 ref: 0000000140073372
Part of subcall function 0000000140073360: RtlReAllocateHeap.NTDLL ref: 00000001400733F2

GetTempPathW.KERNEL32 ref: 000000014004BAAF
LoadLibraryW.KERNEL32 ref: 000000014004BABE
GetProcAddress.KERNEL32 ref: 000000014004BAD9
GetLongPathNameW.KERNEL32(?,?,?,0000000140002D6D), ref: 000000014004BAED
FreeLibrary.KERNEL32 ref: 000000014004BAF4

Strings

GetLongPathNameW, xrefs: 000000014004BACF
Kernel32.DLL, xrefs: 000000014004BAB5

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 1993255246-2943376620
Opcode ID: 4743885935dc812359e953faffabf66b57151c8f8aac2e96d88b203d47865623
Instruction ID: 5a51a99228b08336346173a4317904e71d006373386f9db8efc49d681fbd52c8
Opcode Fuzzy Hash: 4743885935dc812359e953faffabf66b57151c8f8aac2e96d88b203d47865623
Instruction Fuzzy Hash: F5118731311B808AEA159F27A9883A96BE4FB8DFC0F491038EF0E477A5DF38C8118340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400EECB0 Relevance: 12.3, APIs: 8, Instructions: 271networksleepCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00000001400EED16
WSASetLastError.WS2_32 ref: 00000001400EEEA1
Sleep.KERNEL32 ref: 00000001400EEEAF
select.WS2_32 ref: 00000001400EEF57
WSAGetLastError.WS2_32 ref: 00000001400EEF62
__WSAFDIsSet.WS2_32 ref: 00000001400EF01C
__WSAFDIsSet.WS2_32 ref: 00000001400EF034

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sleepselect
String ID:
API String ID: 2806104629-0
Opcode ID: 58f9871f29e71f77ded5fa447ee5438e033b34a5764f64bd78a7200432dac9c5
Instruction ID: eb90eef2e2a672e789385642242beea13e1c946a1988183ce592405c9629faed
Opcode Fuzzy Hash: 58f9871f29e71f77ded5fa447ee5438e033b34a5764f64bd78a7200432dac9c5
Instruction Fuzzy Hash: 1DB1E432214AD889EB7B4E2B98047E96295FB887F8F104215FF2667BF4DB358D418740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140050890 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00000001400508DA
GetParent.USER32 ref: 00000001400508E3
MapWindowPoints.USER32 ref: 00000001400508F9
MoveWindow.USER32 ref: 00000001400509D6
InvalidateRect.USER32 ref: 00000001400509E4
RedrawWindow.USER32 ref: 0000000140050A00
IsDlgButtonChecked.USER32 ref: 0000000140050A1D

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$Rect$ButtonCheckedInvalidateMoveParentPointsRedraw
String ID:
API String ID: 4125024068-0
Opcode ID: efd139ec7a36dd794eae97a742bd94443965ee313206be8c78494827fbd2c0f3
Instruction ID: 2c5198e7fa0d60cdc02624bbba74c2d4e3516abf1f2d3f88931a11e2c7f1468a
Opcode Fuzzy Hash: efd139ec7a36dd794eae97a742bd94443965ee313206be8c78494827fbd2c0f3
Instruction Fuzzy Hash: 41515E7721468086EB66DF27E450BADB762F788FC4F149015EB8A0B7A9CF3AC845C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E55C4 Relevance: 10.6, APIs: 7, Instructions: 119COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32 ref: 00007FFDFF1E561A
GetUpdateRgn.USER32 ref: 00007FFDFF1E5636
BeginPaint.USER32 ref: 00007FFDFF1E564A
DeleteObject.GDI32 ref: 00007FFDFF1E571B
EndPaint.USER32 ref: 00007FFDFF1E5735
GetDC.USER32 ref: 00007FFDFF1E5748
ReleaseDC.USER32 ref: 00007FFDFF1E5763

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Paint$BeginCreateDeleteObjectRectReleaseUpdate
String ID:
API String ID: 3275953111-0
Opcode ID: bc2ed0a4efbc00f23fb1a545f4c3ee6bb74701635c29940619d124c1e5abefe8
Instruction ID: 039542817234f84c0a0f228454fafe33becf8cd98554d87988b5e2fbdda65638
Opcode Fuzzy Hash: bc2ed0a4efbc00f23fb1a545f4c3ee6bb74701635c29940619d124c1e5abefe8
Instruction Fuzzy Hash: B0517473B08A8587EB64CB25E460BAA73A1FB89B84F544131DBAE87749DF3CE551C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004FC48 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 000000014004FC91
GetSystemMetrics.USER32 ref: 000000014004FDA7
GetSystemMetrics.USER32 ref: 000000014004FDB8
CreateWindowExW.USER32 ref: 000000014004FE60
SetWindowLongPtrW.USER32 ref: 000000014004FE95

Strings

ListBox, xrefs: 000000014004FE14

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: MetricsSystemValueWindow$AllocateCreateHeapLongmemset
String ID: ListBox
API String ID: 198341745-2763449597
Opcode ID: be6f786469d105c692e39b572f726dcef0e2168a73edaedd226e26172ac05f55
Instruction ID: af53b9aea2e6e3c761b26a3f95a30f70905366bd5922f7e247fa14984f52da02
Opcode Fuzzy Hash: be6f786469d105c692e39b572f726dcef0e2168a73edaedd226e26172ac05f55
Instruction Fuzzy Hash: 2461B075201B849AEA12CF12F9803D67BA8FB8CB90F404266EB8C43775EF79D654C784

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F7DC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 000000014004F824
CreateWindowExW.USER32 ref: 000000014004F8CD
CreateWindowExW.USER32 ref: 000000014004F947
SetWindowLongPtrW.USER32 ref: 000000014004F95F

Strings

Button, xrefs: 000000014004F88C
Static, xrefs: 000000014004F90E

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$CreateValue$AllocateHeapLongmemset
String ID: Button$Static
API String ID: 10632734-2498952662
Opcode ID: 4fd24cf6bb5ed7c9f519d6832c1d3bbd19b8c63182ef49504c0620ccda19f878
Instruction ID: 8733b975503b3ef00de5011feb298643a247a5fd059819487f5096c5dbd6fac9
Opcode Fuzzy Hash: 4fd24cf6bb5ed7c9f519d6832c1d3bbd19b8c63182ef49504c0620ccda19f878
Instruction Fuzzy Hash: 6B511D71604B848AEB51CF2AE9807D97BA0F74CBA8F54022AFB5D877A5DB3DD544CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C51C Relevance: 10.6, APIs: 7, Instructions: 104windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

Part of subcall function 000000014005E5C4: RtlAcquirePebLock.NTDLL ref: 000000014005E5F6
Part of subcall function 000000014005E5C4: RtlLeaveCriticalSection.NTDLL ref: 000000014005E6ED

PeekMessageW.USER32 ref: 000000014005C587

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Value$AcquireAllocateCriticalHeapLeaveLockMessagePeekSection
String ID:
API String ID: 4200393714-0
Opcode ID: e82325cca8cd40e73bbc46cab73e35183e356610e67812e4f3f0e8b3a6855461
Instruction ID: 8047c18a988b397fc34a16b7c0fef95ea3b58854854b377072509b16625dde32
Opcode Fuzzy Hash: e82325cca8cd40e73bbc46cab73e35183e356610e67812e4f3f0e8b3a6855461
Instruction Fuzzy Hash: A1414832620A508AFB22CF67E854BAD37E1B74CB88F544126EF0A43BA4DF39C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22F96C Relevance: 10.6, APIs: 7, Instructions: 87threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF234010: HeapCreate.KERNEL32(?,?,?,?,00007FFDFF22F981), ref: 00007FFDFF234022
Part of subcall function 00007FFDFF234010: HeapSetInformation.KERNEL32 ref: 00007FFDFF23404C

_RTC_Initialize.LIBCMT ref: 00007FFDFF22F99C
GetCommandLineA.KERNEL32 ref: 00007FFDFF22F9A1

Part of subcall function 00007FFDFF233DEC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233E1B
Part of subcall function 00007FFDFF233DEC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233E5B

Part of subcall function 00007FFDFF233698: GetStartupInfoA.KERNEL32 ref: 00007FFDFF2336BD

__setargv.LIBCMT ref: 00007FFDFF22F9CA
_cinit.LIBCMT ref: 00007FFDFF22F9DE

Part of subcall function 00007FFDFF230C90: FlsFree.KERNEL32(?,?,?,?,00007FFDFF22FA2F), ref: 00007FFDFF230C9F
Part of subcall function 00007FFDFF230C90: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF22FA2F), ref: 00007FFDFF2343EE
Part of subcall function 00007FFDFF230C90: free.LIBCMT ref: 00007FFDFF2343F7
Part of subcall function 00007FFDFF230C90: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF22FA2F), ref: 00007FFDFF234417

Part of subcall function 00007FFDFF233988: free.LIBCMT ref: 00007FFDFF2339CF

Part of subcall function 00007FFDFF232A80: Sleep.KERNEL32(?,?,?,00007FFDFF230D9F,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF232AC5

FlsSetValue.KERNEL32 ref: 00007FFDFF22FA64
GetCurrentThreadId.KERNEL32 ref: 00007FFDFF22FA78
free.LIBCMT ref: 00007FFDFF22FA87

Part of subcall function 00007FFDFF22FD4C: HeapFree.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD62
Part of subcall function 00007FFDFF22FD4C: _errno.LIBCMT ref: 00007FFDFF22FD6C
Part of subcall function 00007FFDFF22FD4C: GetLastError.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD74

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Heapfree$CriticalDeleteEnvironmentFreeSectionStrings$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValue__setargv_cinit_errno
String ID:
API String ID: 1549890855-0
Opcode ID: d02bd2081d09607085ce5f1d8e92870cb961d8c80d51ae04639e7c8ea05c089b
Instruction ID: ed8f598b52a35c734b433b3350756ef00cf83900493219b530a1efb40aebdcbb
Opcode Fuzzy Hash: d02bd2081d09607085ce5f1d8e92870cb961d8c80d51ae04639e7c8ea05c089b
Instruction Fuzzy Hash: 9C3102A4F0D20391FB6467A15872EBD23959F45350FA44734DD3EC92CEEE2CB6808661

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005826C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

IsDlgButtonChecked.USER32 ref: 00000001400582B4
CreateWindowExW.USER32 ref: 000000014005833C
IsDlgButtonChecked.USER32 ref: 000000014005835A
SetWindowLongPtrW.USER32 ref: 000000014005837F
IsDlgButtonChecked.USER32 ref: 0000000140058393

Strings

STATIC, xrefs: 00000001400582E9

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ButtonChecked$ValueWindow$AllocateCreateHeapLong
String ID: STATIC
API String ID: 3753272263-1882779555
Opcode ID: c66a4028819e81026db6c771bf8a244cf24110de1135da88c698416fbf5cf41c
Instruction ID: 06e45d2796808ec676c540834266b69a5d38237d787692eeebebfa8e6b4e820f
Opcode Fuzzy Hash: c66a4028819e81026db6c771bf8a244cf24110de1135da88c698416fbf5cf41c
Instruction Fuzzy Hash: 4F313B36204B908AE721DF62F944B9AB7A0F388B95F514525EF9947BA4DF3CC5158B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004B14C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65memorythreadCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000000014004B192
_wcsdup.MSVCRT ref: 000000014004B1A7
_wcsdup.MSVCRT ref: 000000014004B1B3
CreateThread.KERNEL32 ref: 000000014004B1E7
CloseHandle.KERNEL32 ref: 000000014004B1F5

Strings

Mozilla/5.0 Gecko/41.0 Firefox/41.0, xrefs: 000000014004B14C

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: _wcsdup$AllocateCloseCreateHandleHeapThread
String ID: Mozilla/5.0 Gecko/41.0 Firefox/41.0
API String ID: 788887786-729255037
Opcode ID: 1fc2f6d1230b4df54c3bb6d386e50a06d3f94aff82c57c00d89704710efc373d
Instruction ID: 17bde691890060f8170b5c679faa5ffe91259d470a97150c82d10960ccfe508f
Opcode Fuzzy Hash: 1fc2f6d1230b4df54c3bb6d386e50a06d3f94aff82c57c00d89704710efc373d
Instruction Fuzzy Hash: 55219A32204B418AEB16DF67A9543ADB7A0F788BD4F454125AF5917BB8CB78C051CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F3E4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL ref: 000000014004F3EF
MulDiv.KERNEL32 ref: 000000014004F43F
CreateFontW.GDI32 ref: 000000014004F490
GetStockObject.GDI32 ref: 000000014004F49D
memset.MSVCRT ref: 000000014004F4F2

Strings

Segoe UI, xrefs: 000000014004F445

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CreateCriticalFontInitializeObjectSectionStockmemset
String ID: Segoe UI
API String ID: 211761664-2515502724
Opcode ID: 36e13b0aa82c524283a2a03f98b98c81a4fc296f5cc65cd4c9a1b484396727e4
Instruction ID: 6e0709f83546fc1477cabec03cc8ef520776481926974f5a432401edeb7a4e3a
Opcode Fuzzy Hash: 36e13b0aa82c524283a2a03f98b98c81a4fc296f5cc65cd4c9a1b484396727e4
Instruction Fuzzy Hash: 77316B72514A80CAF312DF26F8043EA77A0F78979AF924224E78A136B5DF7DC149DB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140059124 Relevance: 10.6, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32 ref: 000000014005914D
IsDlgButtonChecked.USER32 ref: 0000000140059187
IsDlgButtonChecked.USER32 ref: 00000001400591A0
ShowWindow.USER32 ref: 00000001400591AB
EnableWindow.USER32 ref: 00000001400591B6
EnableWindow.USER32 ref: 00000001400591CF
ShowWindow.USER32 ref: 00000001400591DD

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$ButtonChecked$EnableShow
String ID:
API String ID: 3376149752-0
Opcode ID: bbb477ab043b01b70c70c936481653d31e308410a509dc065d558457bd559593
Instruction ID: 755f413d0e2c847456135941f962d50d377bd1ec4c3a595977a71360b71964fd
Opcode Fuzzy Hash: bbb477ab043b01b70c70c936481653d31e308410a509dc065d558457bd559593
Instruction Fuzzy Hash: 09113A31704A8186EB11DF23E954BAA6762F7CDFD5F048222DF5A57BE8DE39C5028700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004CA50 Relevance: 9.2, APIs: 6, Instructions: 151filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

CreateFileW.KERNEL32 ref: 000000014004CAED
CreateFileW.KERNEL32 ref: 000000014004CB37
CreateFileW.KERNEL32 ref: 000000014004CB7E
CreateFileW.KERNEL32 ref: 000000014004CBAC
RtlAllocateHeap.NTDLL ref: 000000014004CBED
SetFilePointer.KERNEL32 ref: 000000014004CC47

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: File$Create$AcquireAllocateCriticalHeapLeaveLockPointerSection
String ID:
API String ID: 116771325-0
Opcode ID: 1e58cf1509eb00bdd85570793eba85cc2ec1f94a9f4e8a49ee34421083358480
Instruction ID: 8d667f85ea1d38f99facc649b5ef4d5182df754ce1406b5158efff582e39c563
Opcode Fuzzy Hash: 1e58cf1509eb00bdd85570793eba85cc2ec1f94a9f4e8a49ee34421083358480
Instruction Fuzzy Hash: 0251E3726156908AE7A18F17F941B9A7A90F34CBE8F054739EF6A47BE4DB38C4018B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2306C8 Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FFDFF2306E7

Part of subcall function 00007FFDFF230304: _getptd.LIBCMT ref: 00007FFDFF23030E

Part of subcall function 00007FFDFF2303C0: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FFDFF230702,?,?,?,?,?,00007FFDFF2308D7), ref: 00007FFDFF2303EA

Part of subcall function 00007FFDFF232A14: malloc.LIBCMT ref: 00007FFDFF232A33
Part of subcall function 00007FFDFF232A14: Sleep.KERNEL32(?,?,00000000,00007FFDFF2344B5,?,?,?,00007FFDFF23455F,?,?,?,?,?,?,00000000,00007FFDFF230DC4), ref: 00007FFDFF232A4A

free.LIBCMT ref: 00007FFDFF230773

Part of subcall function 00007FFDFF22FD4C: HeapFree.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD62
Part of subcall function 00007FFDFF22FD4C: _errno.LIBCMT ref: 00007FFDFF22FD6C
Part of subcall function 00007FFDFF22FD4C: GetLastError.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD74

_lock.LIBCMT ref: 00007FFDFF2307AB
free.LIBCMT ref: 00007FFDFF23085B
free.LIBCMT ref: 00007FFDFF23088B
_errno.LIBCMT ref: 00007FFDFF230890

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: free$_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 2878544890-0
Opcode ID: 92579d503bcb9522a044aba3ee9e629867b01f5a482b39ac7e2a5d746da9bbac
Instruction ID: ebbe088e421171e2448f278590d6ddf9566604075d5653f80aff04703f70aac8
Opcode Fuzzy Hash: 92579d503bcb9522a044aba3ee9e629867b01f5a482b39ac7e2a5d746da9bbac
Instruction Fuzzy Hash: 3B51C261F0868286E354CB25A460A79B7A1FB80758F144335DABECB7DECF7CE4818720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066A00 Relevance: 9.1, APIs: 6, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140066A72
RtlAllocateHeap.NTDLL ref: 0000000140066A96
SetFilePointer.KERNEL32 ref: 0000000140066ADA
ReadFile.KERNEL32 ref: 0000000140066B1F
HeapFree.KERNEL32 ref: 0000000140066B51
CloseHandle.KERNEL32 ref: 0000000140066B5A

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: File$Heap$AllocateCloseCreateFreeHandlePointerRead
String ID:
API String ID: 2129294348-0
Opcode ID: 1fd48308879c3e7f8842d72b2311c466c641abf7d3213963d5bf58884b742784
Instruction ID: bbaf812fd702cff21f4f8bac64f84410c62403cc2cc1b53b97d6ca12e93bae06
Opcode Fuzzy Hash: 1fd48308879c3e7f8842d72b2311c466c641abf7d3213963d5bf58884b742784
Instruction Fuzzy Hash: F8417132305B908AE6658F27A80479AA7A1F78DFE4F588615AF9D47BE8CF38C445C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400DDF30 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00000001400DDF83
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DDF8C
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DDF9E
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DDFC4
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DDFE7
??3@YAXPEAX@Z.MSVCRT ref: 00000001400DE01A

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: ccac90523a0f3df49a59181c13ccf0ea859f505d6b54c23af7337f901bbcd0b8
Instruction ID: 95e4d3c6a1ec2423a51ec368fcdba8e6c9929043625f8000f9b6339ee68d6249
Opcode Fuzzy Hash: ccac90523a0f3df49a59181c13ccf0ea859f505d6b54c23af7337f901bbcd0b8
Instruction Fuzzy Hash: 4B310436211A4086DF259F16E9943ACB775FB88F88F484526DB4E07B68DF38C466C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048C24 Relevance: 9.1, APIs: 6, Instructions: 61memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

RtlAllocateHeap.NTDLL ref: 0000000140048C66
wcslen.MSVCRT ref: 0000000140048C84
RtlAllocateHeap.NTDLL ref: 0000000140048C9A
wcscpy.MSVCRT ref: 0000000140048CB4
AppendMenuW.USER32 ref: 0000000140048CD1
SetMenu.USER32 ref: 0000000140048CE6

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateHeap$MenuValue$Appendwcscpywcslen
String ID:
API String ID: 1872928246-0
Opcode ID: e810fc69685ff0297becd6c2ce6dbdb03662f7e29518e50eb7cc9843a015a7c3
Instruction ID: e60fd4aeb489c0b4cbe5c3822b1d9ed90bb9fc42e30d786500ef31406249a77d
Opcode Fuzzy Hash: e810fc69685ff0297becd6c2ce6dbdb03662f7e29518e50eb7cc9843a015a7c3
Instruction Fuzzy Hash: 9F210336300A418AEA25DF17E8847A9B7A0F798FC0F588426AF4E47775DF38C896C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004D980 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 000000014004D9C4
memcpy.MSVCRT ref: 000000014004D9FF

Strings

0 = 32 1 = 64 2 = 3 = 4 = 5 = , xrefs: 000000014004D985

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: FilePointermemcpy
String ID: 0 = 32 1 = 64 2 = 3 = 4 = 5 =
API String ID: 1104741977-3695699275
Opcode ID: 9ccc0d7545e2b4d7292eefb4452d7aaa8241325d1c2e7183530ae5d4901a793f
Instruction ID: cbebe9576e75c766d854539e0036433466d9798f8aca9de44f7ddfd16bd898f0
Opcode Fuzzy Hash: 9ccc0d7545e2b4d7292eefb4452d7aaa8241325d1c2e7183530ae5d4901a793f
Instruction Fuzzy Hash: 2E4182377046408ADB06CF7AE1402ADFBA4EB98BD9F084426EF4C43BA5D678C5A1CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E51D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registryclipboardcomCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32 ref: 00007FFDFF1E5268
RegisterClipboardFormatA.USER32 ref: 00007FFDFF1E527C
OleInitialize.OLE32 ref: 00007FFDFF1E52C1

Strings

MSDEVColumnSelect, xrefs: 00007FFDFF1E521D
MSDEVLineSelect, xrefs: 00007FFDFF1E526E

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: ClipboardFormatRegister$Initialize
String ID: MSDEVColumnSelect$MSDEVLineSelect
API String ID: 4204169304-586212884
Opcode ID: e720e19007854e1a18043cb3f3c74a17eea52210ea24a8b65382159fc26698cf
Instruction ID: 16aced1bad40b82c1446882e40676ce795299e387592bd7e83c84b551f2a1f1b
Opcode Fuzzy Hash: e720e19007854e1a18043cb3f3c74a17eea52210ea24a8b65382159fc26698cf
Instruction Fuzzy Hash: BB21F473718BC1A6D78C8F20EA40699B7A9FB09740F54092AD7BDA3754DFB9A0B5C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005A3E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

SetWindowLongPtrW.USER32 ref: 000000014005A436
SetWindowLongPtrW.USER32 ref: 000000014005A44B
SetPropW.USER32 ref: 000000014005A45E
IsDlgButtonChecked.USER32 ref: 000000014005A475

Strings

PB_ID, xrefs: 000000014005A451

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: LongValueWindow$AllocateButtonCheckedHeapProp
String ID: PB_ID
API String ID: 1240782271-4173770792
Opcode ID: bf392e8224a5fd2b1b01949d83c50be6946f9b1d8e1136e98d8562fd18d435d0
Instruction ID: 6dcdec5b5aa30d21e3c7a0a473bcb5e2756e090560db6381bfbae3244fb89376
Opcode Fuzzy Hash: bf392e8224a5fd2b1b01949d83c50be6946f9b1d8e1136e98d8562fd18d435d0
Instruction Fuzzy Hash: 17114C71300B948AD600DF67E9807997B64F789FE0F588215EF6A17BE4CF38D5568344

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005621C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

RemovePropW.USER32 ref: 000000014005625E

Part of subcall function 000000014005A520: GetWindowLongPtrW.USER32 ref: 000000014005A53A
Part of subcall function 000000014005A520: GetPropW.USER32 ref: 000000014005A55B

RemovePropW.USER32 ref: 0000000140056277
CallWindowProcW.USER32 ref: 0000000140056292

Strings

PB_RectTop, xrefs: 0000000140056257, 0000000140056270
PB_RectBottom, xrefs: 0000000140056264

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Prop$RemoveWindow$CallLongProc
String ID: PB_RectBottom$PB_RectTop
API String ID: 2368525485-3662301043
Opcode ID: de103062bf5e302b880c65fa1d45f411ca5af83f85b05fe561585bffe61c4ee4
Instruction ID: 321b2123a590a1bbeeac7ca934958c688c4994b505fc9444d311357cc8b513d5
Opcode Fuzzy Hash: de103062bf5e302b880c65fa1d45f411ca5af83f85b05fe561585bffe61c4ee4
Instruction Fuzzy Hash: 5E0178B5204A408AEB12CF2BF844799A760F78CFC0F588422EF4943778DE39C506C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140072864 Relevance: 7.6, APIs: 5, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00000001400728BD
RtlAllocateHeap.NTDLL ref: 00000001400728F8
RtlLeaveCriticalSection.NTDLL ref: 0000000140072963
RtlAllocateHeap.NTDLL ref: 0000000140072978
RtlInitializeCriticalSection.NTDLL ref: 00000001400729BA

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateCriticalHeapSection$AcquireInitializeLeaveLock
String ID:
API String ID: 1976302020-0
Opcode ID: c372412a2e2566c064cc3aae1fa1ebcee3528421d3c343974022e757d930dce7
Instruction ID: 8ff372bcb1f86b2368a3363971e20c69fc20d2968f69f27739243753d5af4954
Opcode Fuzzy Hash: c372412a2e2566c064cc3aae1fa1ebcee3528421d3c343974022e757d930dce7
Instruction Fuzzy Hash: 49414732601B008AEB66DF16E8417A87BF4F79CB80F584129EB4D477A4EF38D8A5C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D9F8 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 000000014005DA3C
GetSystemMetrics.USER32 ref: 000000014005DA54
GetActiveWindow.USER32 ref: 000000014005DA73
GetWindowRect.USER32 ref: 000000014005DA89
SetWindowPos.USER32 ref: 000000014005DAEB

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$MetricsSystem$ActiveRect
String ID:
API String ID: 3497069843-0
Opcode ID: 6c3ff8903e48793c812966b0156e19762d78b4567927bc467e7650319938cc6a
Instruction ID: 625f38ed7f49ace5704d1033655c418253bb41cacaa2fde6abe72eb9493aff89
Opcode Fuzzy Hash: 6c3ff8903e48793c812966b0156e19762d78b4567927bc467e7650319938cc6a
Instruction Fuzzy Hash: 0331A4323146418BD721CF39E94478E7BA5F78CB90F594125FF85837A8DE39E8418B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140042BC0 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 0000000140042BEF
RtlAcquirePebLock.NTDLL ref: 0000000140042C08
WaitForSingleObject.KERNEL32 ref: 0000000140042C20
CloseHandle.KERNEL32 ref: 0000000140042C2D
RtlLeaveCriticalSection.NTDLL ref: 0000000140042C80

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireCloseCreateCriticalHandleLeaveLockObjectSectionSingleThreadWait
String ID:
API String ID: 1076354578-0
Opcode ID: 6b17b4ff8c68f084d7edec882389f0a064dc13ffb3c5964e569178e7a7efeac2
Instruction ID: 3f187c02f36e3f14adddbe3136211ac54604a36991fc35afaae4015438d5f421
Opcode Fuzzy Hash: 6b17b4ff8c68f084d7edec882389f0a064dc13ffb3c5964e569178e7a7efeac2
Instruction Fuzzy Hash: 42211436204A4089EB169F13E9957A977A4F78CBC4F998022DB5D43375DF38C945C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023F58 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 546COMMON

Download Yara Rule

APIs

Part of subcall function 000000014005F8E4: GetLocalTime.KERNEL32 ref: 000000014005F8ED

GetTempFileNameW.KERNEL32 ref: 0000000140024159
PathAddBackslashW.SHLWAPI ref: 00000001400241B9

Part of subcall function 000000014004B14C: RtlAllocateHeap.NTDLL ref: 000000014004B192
Part of subcall function 000000014004B14C: _wcsdup.MSVCRT ref: 000000014004B1A7
Part of subcall function 000000014004B14C: _wcsdup.MSVCRT ref: 000000014004B1B3
Part of subcall function 000000014004B14C: CreateThread.KERNEL32 ref: 000000014004B1E7
Part of subcall function 000000014004B14C: CloseHandle.KERNEL32 ref: 000000014004B1F5

Part of subcall function 0000000140072E00: GetLastError.KERNEL32 ref: 0000000140072E04
Part of subcall function 0000000140072E00: TlsGetValue.KERNEL32 ref: 0000000140072E14
Part of subcall function 0000000140072E00: SetLastError.KERNEL32 ref: 0000000140072E31

Part of subcall function 0000000140073020: wcslen.MSVCRT ref: 000000014007303E

Part of subcall function 00000001400730C0: TlsGetValue.KERNEL32 ref: 00000001400730CA

Part of subcall function 0000000140073220: TlsGetValue.KERNEL32 ref: 000000014007322A

Strings

v.txt, xrefs: 000000014002443B
*.*, xrefs: 0000000140024633, 000000014002463D

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast_wcsdup$AllocateBackslashCloseCreateFileHandleHeapLocalNamePathTempThreadTimewcslen
String ID: *.*$v.txt
API String ID: 2959618253-1070794288
Opcode ID: 7d4b2b2fc816c92bb1185460eabccae020a26ff1b112a4ceefeb5ceeefcd8df6
Instruction ID: ebd79884b6acf65e273896bca3bd48ee0990bf379aa2e10b6c5a306d0126e119
Opcode Fuzzy Hash: 7d4b2b2fc816c92bb1185460eabccae020a26ff1b112a4ceefeb5ceeefcd8df6
Instruction Fuzzy Hash: 0DF19DB7E69644D5EA1777B3BC8B7E80261D76C3A0F200110FF18077A3AD7898EA4B11

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400EAC80 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00000001400EAD5E
??3@YAXPEAX@Z.MSVCRT ref: 00000001400EAF28

Strings

Curl_poll(%d ds, %d ms), xrefs: 00000001400EAE96
Mozilla/5.0 Gecko/41.0 Firefox/41.0, xrefs: 00000001400EAC90

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ??3@_malloc_dbg
String ID: Curl_poll(%d ds, %d ms)$Mozilla/5.0 Gecko/41.0 Firefox/41.0
API String ID: 149304988-3927391783
Opcode ID: bca5ce2e32ccd7a7d44e0ff5c962c3d679696d147c5e8713ec2aebbde70484c3
Instruction ID: 216de19f629e2470ec839688be22b7c39e7fd8db2a665d3cc6ef9c28336ad809
Opcode Fuzzy Hash: bca5ce2e32ccd7a7d44e0ff5c962c3d679696d147c5e8713ec2aebbde70484c3
Instruction Fuzzy Hash: FE71E47230468445EB678B2798407EA6691FB4EBF4F145225EF6A23BE5EB3CDC46C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400530A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 00000001400530ED
CreateWindowExW.USER32 ref: 0000000140053221
SetWindowLongPtrW.USER32 ref: 000000014005324F

Strings

Edit, xrefs: 00000001400531ED

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ValueWindow$AllocateCreateHeapLongmemset
String ID: Edit
API String ID: 1875252383-554135844
Opcode ID: 49f00f6dd40d4ccb68d246f976e089c637716b8fb9d76dd60d1728b398f8c760
Instruction ID: b9d2b2513eefeffc0882bcf54f21a73e43410916b631438fa165fd4c17e451b4
Opcode Fuzzy Hash: 49f00f6dd40d4ccb68d246f976e089c637716b8fb9d76dd60d1728b398f8c760
Instruction Fuzzy Hash: EC51F872215B809AEB22CF17E8447C67BA4F78DB94F854226AB8C43775EB3DD145C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048B20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetPropW.USER32 ref: 0000000140048B30
SetWindowLongPtrW.USER32 ref: 0000000140048B48
SetPropW.USER32 ref: 0000000140048B5B

Strings

pb_officemenu_callback, xrefs: 0000000140048B26, 0000000140048B4E

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Prop$LongWindow
String ID: pb_officemenu_callback
API String ID: 3630290438-2649619063
Opcode ID: 021a553a63ca5b9974b5fe52888576ce5c2d709f454171bc0fc44ad295db91db
Instruction ID: d864efedbd5dcebc955101cce65fe6542f53a36e2692cf51cac2a7bedd244af8
Opcode Fuzzy Hash: 021a553a63ca5b9974b5fe52888576ce5c2d709f454171bc0fc44ad295db91db
Instruction Fuzzy Hash: 76E0B6B4601B46CAEE169FA7B845BD42760BB4DF85F845065CB49173B0EF3882998704

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006BA0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000000014006BA17
GetProcAddress.KERNEL32 ref: 000000014006BA33

Strings

AlphaBlend, xrefs: 000000014006BA29
msimg32.dll, xrefs: 000000014006BA10

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: AlphaBlend$msimg32.dll
API String ID: 2574300362-3639726679
Opcode ID: 2d34e8be6a81e5a4093df39eb0738a71cc46b6fbd4f820317fd7298da2c67ace
Instruction ID: 80d89e19dddfdc166a83be06b3956ba708e072cd6b964baf7a3232d160d9ab68
Opcode Fuzzy Hash: 2d34e8be6a81e5a4093df39eb0738a71cc46b6fbd4f820317fd7298da2c67ace
Instruction Fuzzy Hash: 6CE0E570512A0089FB0AAF13FD463E037E0BB8C741F900528860E423B0DBBC91548B90

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004B91C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000000014004B927
GetProcAddress.KERNEL32 ref: 000000014004B943

Strings

hhctrl.ocx, xrefs: 000000014004B920
HtmlHelpW, xrefs: 000000014004B939

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: HtmlHelpW$hhctrl.ocx
API String ID: 2574300362-3773518134
Opcode ID: af41998f4dad1d89bc22652a3260f8d2ad5e3be60e8a2183d632dc01dedbacd0
Instruction ID: 194faf7b0794818a6955e82959a5a85970d0b046ede49be22ddf01e5b23c96ab
Opcode Fuzzy Hash: af41998f4dad1d89bc22652a3260f8d2ad5e3be60e8a2183d632dc01dedbacd0
Instruction Fuzzy Hash: C7E0E278602A02D6EA069F12A99439426E0B74DB40F8100A8860D023B4EF3884168610

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005E9D8 Relevance: 6.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014005F000: HeapFree.KERNEL32 ref: 000000014005F031
Part of subcall function 000000014005F000: HeapFree.KERNEL32 ref: 000000014005F044
Part of subcall function 000000014005F000: HeapFree.KERNEL32 ref: 000000014005F05F
Part of subcall function 000000014005F000: HeapFree.KERNEL32 ref: 000000014005F081

RtlAllocateHeap.NTDLL ref: 000000014005EA11
RtlAllocateHeap.NTDLL ref: 000000014005EA42
RtlAllocateHeap.NTDLL ref: 000000014005EAB2
HeapFree.KERNEL32 ref: 000000014005EAD8

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Heap$Free$Allocate
String ID:
API String ID: 3472947110-0
Opcode ID: 10d6d879d30df3dae176e942c680bba3359aa4f0b8af3985456c19bcd3b25fcc
Instruction ID: 690f51f11fd55dd44884fffc0698b0bff0444d4583156c2bb34a6804acaca47b
Opcode Fuzzy Hash: 10d6d879d30df3dae176e942c680bba3359aa4f0b8af3985456c19bcd3b25fcc
Instruction Fuzzy Hash: 4B316B72200B809BE715CF23EA8439977A4F78CB80F588525EF9903B64DF79E465C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E8F90 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FFDFF1E8FB5
SetWindowLongPtrA.USER32 ref: 00007FFDFF1E8FEF

Part of subcall function 00007FFDFF1E51D4: RegisterClipboardFormatA.USER32 ref: 00007FFDFF1E5268
Part of subcall function 00007FFDFF1E51D4: RegisterClipboardFormatA.USER32 ref: 00007FFDFF1E527C
Part of subcall function 00007FFDFF1E51D4: OleInitialize.OLE32 ref: 00007FFDFF1E52C1

DefWindowProcA.USER32 ref: 00007FFDFF1E901A
SetWindowLongA.USER32 ref: 00007FFDFF1E904B

Part of subcall function 00007FFDFF22E0DC: malloc.LIBCMT ref: 00007FFDFF22E0F6

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Window$Long$ClipboardFormatRegister$InitializeProcmalloc
String ID:
API String ID: 91366664-0
Opcode ID: aa9b75f5386dfc0db8df2177c9cfcf37b8f39b39492cd4f08124e947a016817e
Instruction ID: 4edd6566ee4a339750a031d0396d905d4ed072ac1afd5d2ff78e88b422afa674
Opcode Fuzzy Hash: aa9b75f5386dfc0db8df2177c9cfcf37b8f39b39492cd4f08124e947a016817e
Instruction Fuzzy Hash: A321D332F08A8082E714DF53A9549AE6356ABC5FD0F544030DE3E47B89CF7EE4828340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400E0510 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT ref: 00000001400E052C
_malloc_dbg.MSVCRT ref: 00000001400E055C
??3@YAXPEAX@Z.MSVCRT ref: 00000001400E05D1
??3@YAXPEAX@Z.MSVCRT ref: 00000001400E05E2

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ??3@$_calloc_dbg_malloc_dbg
String ID:
API String ID: 3423559903-0
Opcode ID: f314fc00f65b947275321ba1abf922f49c3417c95078a5c6874ccc732330d156
Instruction ID: 4ab6d10a0c1104f9002c9864f9dd137043c3262c7711fc655137db15acea355f
Opcode Fuzzy Hash: f314fc00f65b947275321ba1abf922f49c3417c95078a5c6874ccc732330d156
Instruction Fuzzy Hash: FB214F32616B8085E781CF26E84039A36A0F788BA4F585135EF9E577A8DF38C4908B50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140051E94 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32 ref: 0000000140051EC6
GetWindowRect.USER32 ref: 0000000140051EE6

Part of subcall function 000000014005F77C: ceil.MSVCRT ref: 000000014005F799

IsDlgButtonChecked.USER32 ref: 0000000140051F2C
IsDlgButtonChecked.USER32 ref: 0000000140051F46

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ButtonChecked$RectWindowceil
String ID:
API String ID: 3899230379-0
Opcode ID: 93d39dc2aba75ad2a2f8baef5f6b1f758d232298bb0298e8e96bf0756355cb2a
Instruction ID: 3ed9f3b84781f675329556019227889ef3c52b7b2c02e9b4950f32b30c7b795e
Opcode Fuzzy Hash: 93d39dc2aba75ad2a2f8baef5f6b1f758d232298bb0298e8e96bf0756355cb2a
Instruction Fuzzy Hash: 7211307670468086E751DF2AE841BAA7761F7C8BE4F149311EF6A57BE9CF38C4428B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140058CB8 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32 ref: 0000000140058CF5
CallWindowProcW.USER32 ref: 0000000140058D07
GetUpdateRect.USER32 ref: 0000000140058D36
CallWindowProcW.USER32 ref: 0000000140058D6C

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CallProcWindow$RectUpdate
String ID:
API String ID: 956583892-0
Opcode ID: 2354f96fc10e7db040eaae6ed6695d54ec97f70ddcc9b22b512919b1beeb0a97
Instruction ID: e988b0b752da5e46e9d4650d23acd5dc3b4c0439c65e876c48dbe4a5af84ef6e
Opcode Fuzzy Hash: 2354f96fc10e7db040eaae6ed6695d54ec97f70ddcc9b22b512919b1beeb0a97
Instruction Fuzzy Hash: 6F115E71634A4086F622DF23F8447A9A760B78DFC5F444521AF4A57BB9DA7DC4018700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140051490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 00000001400514E3
CreateWindowExW.USER32 ref: 00000001400515EF

Strings

Static, xrefs: 00000001400515BB

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Value$AllocateCreateHeapWindowmemset
String ID: Static
API String ID: 2419737561-2272013587
Opcode ID: 42fcea230a7bbd279f7766e9f701b309ba4d49d8920facea435ded5ffc9200cc
Instruction ID: 6ddcfd062129714c094d33133924cac4ec3d52f34d82b7001bd9defbaca30ecb
Opcode Fuzzy Hash: 42fcea230a7bbd279f7766e9f701b309ba4d49d8920facea435ded5ffc9200cc
Instruction Fuzzy Hash: AA411C76615B808AEB62CF16E8807C67BA4F78CB94F84422AAB9C43775DB3DC145CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005109C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 00000001400510E2
CreateWindowExW.USER32 ref: 00000001400511E9

Strings

Button, xrefs: 00000001400511BC

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Value$AllocateCreateHeapWindowmemset
String ID: Button
API String ID: 2419737561-1034594571
Opcode ID: 7ea70e526704e5d3c2137e541c402ba5e03b0e297ef175390141bf6614d3e5dd
Instruction ID: c0a8b1e1051e6d8c8a896044b1eeb2ade8e944ba4d66e06d48cfdcf2dee127a5
Opcode Fuzzy Hash: 7ea70e526704e5d3c2137e541c402ba5e03b0e297ef175390141bf6614d3e5dd
Instruction Fuzzy Hash: 9441E972204B848AEB62DF16E9807CA7BA0F78CB94F404126EB5D837B9DB79C545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005049C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

memset.MSVCRT ref: 00000001400504DD
CreateWindowExW.USER32 ref: 00000001400505C5

Strings

Button, xrefs: 0000000140050581

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Value$AllocateCreateHeapWindowmemset
String ID: Button
API String ID: 2419737561-1034594571
Opcode ID: bc0be5c61b9050d2b30ea71fda43069fd3696cc9296c54b944a2607e50edc1b9
Instruction ID: 7b6e2004c375bad6f8fdd601d3178fefb23a00ba84c055c3d5fc569436a4f360
Opcode Fuzzy Hash: bc0be5c61b9050d2b30ea71fda43069fd3696cc9296c54b944a2607e50edc1b9
Instruction Fuzzy Hash: FD310771605A848AEB22CF16F9403DABBA5F78C790F40422AEB8C477B5EB7DC545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004CCA0 Relevance: 4.6, APIs: 3, Instructions: 75filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

CreateFileW.KERNEL32 ref: 000000014004CD00
CreateFileW.KERNEL32 ref: 000000014004CD2E
RtlAllocateHeap.NTDLL ref: 000000014004CD59

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CreateFile$AcquireAllocateCriticalHeapLeaveLockSection
String ID:
API String ID: 3315829013-0
Opcode ID: c9be869c75ffcf1ffbfc23eff0d8c888bf9a31b93fa89c7bf280bbb6c50e70b5
Instruction ID: 245f9eccafd189cdcf7c25ff0f5035ea0ebf2e3c30c11a691a0857230a801ebe
Opcode Fuzzy Hash: c9be869c75ffcf1ffbfc23eff0d8c888bf9a31b93fa89c7bf280bbb6c50e70b5
Instruction Fuzzy Hash: 8F3141326157808AEB518F27A944796BAA0F78CBF4F094735AFB947BE4CB78D4118B04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140073360 Relevance: 4.6, APIs: 3, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0000000140073372
RtlReAllocateHeap.NTDLL ref: 00000001400733F2
RtlReAllocateHeap.NTDLL ref: 0000000140073452

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateHeap$Value
String ID:
API String ID: 2497967046-0
Opcode ID: 49a4dad35a94be57cfac48aa09ba3cbc473bedaa79613bc40b0839159e9dbce1
Instruction ID: 78593fb721e37414f033d63e927ebdbd986d799233c8d4747f5146571deceb17
Opcode Fuzzy Hash: 49a4dad35a94be57cfac48aa09ba3cbc473bedaa79613bc40b0839159e9dbce1
Instruction Fuzzy Hash: 18316336609B44C6DB25CF1AE49135ABBA0F7CCBA8F144216EB8D43778DB78C681CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140072E50 Relevance: 4.6, APIs: 3, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0000000140072E63
RtlAllocateHeap.NTDLL ref: 0000000140072EA6
RtlReAllocateHeap.NTDLL ref: 0000000140072ED3

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateHeap$Value
String ID:
API String ID: 2497967046-0
Opcode ID: 17f37e2a8e0ceee9280e77000b53c739a84a8b65e75333f1700e164d1442fef5
Instruction ID: 486f05978c46c03407e230d7dc019030803508d5e334c39bd380dde77f6094a1
Opcode Fuzzy Hash: 17f37e2a8e0ceee9280e77000b53c739a84a8b65e75333f1700e164d1442fef5
Instruction Fuzzy Hash: C721D576609A40C6DA24DF1AE89136ABBB1FBCDB84F104026EB8D87778DF3DC5418B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140072F30 Relevance: 4.6, APIs: 3, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0000000140072F83
RtlReAllocateHeap.NTDLL ref: 0000000140072FB1
HeapFree.KERNEL32 ref: 0000000140072FF4

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$Free
String ID:
API String ID: 4277724868-0
Opcode ID: a967ec9a5a5a6dda2fe9fff8d2f2cd491b509e21a8b00e8389956681cc3c30f1
Instruction ID: 552704e9442e3032d94a7e1afa445caf5f344ec3306ab8c86bbf51bd3d4830cc
Opcode Fuzzy Hash: a967ec9a5a5a6dda2fe9fff8d2f2cd491b509e21a8b00e8389956681cc3c30f1
Instruction Fuzzy Hash: C6218336218A8486EB259F16E85439ABBB1F7CDB84F508122EB8D43778DF3DC541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EE38 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

GetParent.USER32 ref: 000000014004EEA4
GetWindowRect.USER32 ref: 000000014004EEBF
EnumChildWindows.USER32 ref: 000000014004EED6

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireChildCriticalEnumLeaveLockParentRectSectionWindowWindows
String ID:
API String ID: 48959757-0
Opcode ID: ef18355e43c21ed366e221ded0eb7d75f480a57ac7b10aa697d46b57cbce97aa
Instruction ID: 3f38871db054c5b69e8cac32b919378c6f5896409bf79de4695afb01aaa78fb5
Opcode Fuzzy Hash: ef18355e43c21ed366e221ded0eb7d75f480a57ac7b10aa697d46b57cbce97aa
Instruction Fuzzy Hash: E5110332214B8486EB118F1BE94079ABBA1F788FC4F089122EF8D47B69CF38C441CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004C8A4 Relevance: 4.5, APIs: 3, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderLocation.SHELL32 ref: 000000014004C8CD
SHGetPathFromIDListW.SHELL32 ref: 000000014004C8DF
wcslen.MSVCRT ref: 000000014004C8EC

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: FolderFromListLocationPathwcslen
String ID:
API String ID: 376986313-0
Opcode ID: 7e3896b39ac32ff4c2689654c1c15c0d08600e5491f596e8dc0fcf8bffef6527
Instruction ID: 1d8be3c98689690d0c13841c0c9b7b448447928f2e1dc868d082cf9a224d850e
Opcode Fuzzy Hash: 7e3896b39ac32ff4c2689654c1c15c0d08600e5491f596e8dc0fcf8bffef6527
Instruction Fuzzy Hash: 9A018C32320A5092E7618F27E5857AE63B4FB98BC0F558134EF5D83764EF35C8568748

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BB64 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 000000014004BB82
wcslen.MSVCRT ref: 000000014004BB94
CreateDirectoryW.KERNEL32 ref: 000000014004BBE4

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: ab7810b2da6d2b59c3fe5451aec6b3706cbb6a298658312f5cf4c1ebe3e755af
Instruction ID: b52ac60cc556f6047f29b04c56e8c975d77d484509379350962b5591f2603e39
Opcode Fuzzy Hash: ab7810b2da6d2b59c3fe5451aec6b3706cbb6a298658312f5cf4c1ebe3e755af
Instruction Fuzzy Hash: D801B17621168091EF72DB62D8A43E96250FB9C784F814131AB8D436A8EB7CC24AC708

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400524D8 Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 0000000140052513
GetWindowLongPtrW.USER32 ref: 0000000140052521
CallWindowProcW.USER32 ref: 0000000140052538

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Window$CallLongProc
String ID:
API String ID: 4084987330-0
Opcode ID: 324557f9100b9ba659e0572719b2cecf0ee86b8b71a60bb968cb9a8889ed2bd7
Instruction ID: 03a81f10e0d836b133075b4e28697ce2b278e2e5a2988aaf1da04379dcc0a33a
Opcode Fuzzy Hash: 324557f9100b9ba659e0572719b2cecf0ee86b8b71a60bb968cb9a8889ed2bd7
Instruction Fuzzy Hash: F0F06936710B508AE7108F27E844B59BA60F7D9FA4F188125AF4903BA4CF38C8568B44

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400DDA90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

fread.MSVCRT ref: 00000001400DDB3B

Strings

o, xrefs: 00000001400DDD25

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: fread
String ID: o
API String ID: 1766058891-252678980
Opcode ID: ee0eb557d876965eac43b6ea62f6f9c12b49a3e156a54aac625a2df0ac36c1c8
Instruction ID: e38e6f55ea59656e01a449e665f8ad494bf8d632d45c6a777caaa9fc2e1cf2d3
Opcode Fuzzy Hash: ee0eb557d876965eac43b6ea62f6f9c12b49a3e156a54aac625a2df0ac36c1c8
Instruction Fuzzy Hash: 9D71B2323103858AEF268B2AE4407ED77A2FB497D8F445126EF4947BE5DB38C452C714

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400CEC20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00000001400CEC47

Strings

Out of memory, xrefs: 00000001400CEC52

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: _malloc_dbg
String ID: Out of memory
API String ID: 1527718024-696950042
Opcode ID: 138cb016a45ad1076b4cf82d57bbfd7b353780d121b137148af128cdd958b86b
Instruction ID: d48be999f3bc0458cda334dfa9ab7df9dcf51fc2a39847fc4bacf0e514eaf03e
Opcode Fuzzy Hash: 138cb016a45ad1076b4cf82d57bbfd7b353780d121b137148af128cdd958b86b
Instruction Fuzzy Hash: 83E046B031AB8580FD6FABA7A5D53F502956F5DBD0F1C0835AF1E0B3B1EE3880824210

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140071DE8 Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

MulDiv.KERNEL32 ref: 0000000140071E7B
CreateFontW.GDI32 ref: 0000000140071EC6

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireCreateCriticalFontLeaveLockSection
String ID:
API String ID: 3924561995-0
Opcode ID: bccf3d836e6ef0da998f451242074ad6c2e76c6fbdcd88817296b6d57c3bc385
Instruction ID: bc4782ca98bb00218ec33c9cacca7c529f489fd37d93004a790b1a7c0f83eedb
Opcode Fuzzy Hash: bccf3d836e6ef0da998f451242074ad6c2e76c6fbdcd88817296b6d57c3bc385
Instruction Fuzzy Hash: E73173332047818AEB12CF5AE89079BBAE4F7887E4F544625EF69477E4EB78C451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004CDF0 Relevance: 3.1, APIs: 2, Instructions: 59memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140072250: RtlAcquirePebLock.NTDLL ref: 000000014007226C
Part of subcall function 0000000140072250: RtlLeaveCriticalSection.NTDLL ref: 00000001400722FD

CreateFileW.KERNEL32 ref: 000000014004CE4A
RtlAllocateHeap.NTDLL ref: 000000014004CE73

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireAllocateCreateCriticalFileHeapLeaveLockSection
String ID:
API String ID: 35634316-0
Opcode ID: 4ab8a49597c68ab51c75921afc1c268e0878ae8af21936fb2685a82dce668648
Instruction ID: ac6756dccaeada2bb5cdabfc0f969a8869358d7ffe0eaf56485c1f4afc58ba25
Opcode Fuzzy Hash: 4ab8a49597c68ab51c75921afc1c268e0878ae8af21936fb2685a82dce668648
Instruction Fuzzy Hash: 95216A32205B408AEB519F17FA4079AB6A0F78CBF4F488724AB7947BE4CF78D4618744

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006A140 Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000000014006A172
RtlAllocateHeap.NTDLL ref: 000000014006A18D

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bc781e1a2d37f473ec89b141d8ba33e39c57813a73ee3448d4112420ddf3f6ff
Instruction ID: 680a745fc6eef3b5f0119aeabfae8e6847f9ed4feb4793ae2ef2673e0117ad58
Opcode Fuzzy Hash: bc781e1a2d37f473ec89b141d8ba33e39c57813a73ee3448d4112420ddf3f6ff
Instruction Fuzzy Hash: 3F213232614B84ABE715CF23EA443997BA4F399B84F588524DB890BF56CF79E0B1C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF236340 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FFDFF236363

Part of subcall function 00007FFDFF232254: DecodePointer.KERNEL32 ref: 00007FFDFF23227B

RtlAllocateHeap.NTDLL(?,?,?,?,00000000,00007FFDFF232AB3,?,?,?,00007FFDFF230D9F,?,?,?,00007FFDFF23232D), ref: 00007FFDFF2363AC

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: AllocateDecodeHeapPointer_errno
String ID:
API String ID: 15861996-0
Opcode ID: 6c06a48bf546cd914a236b5a30d788fd99260294df85df3a73b8b044cc8a529b
Instruction ID: d05100e0f3c3a5fb09a1b4a644ac1c42e1e2d5217009473c52e672fc50988a6e
Opcode Fuzzy Hash: 6c06a48bf546cd914a236b5a30d788fd99260294df85df3a73b8b044cc8a529b
Instruction Fuzzy Hash: 7F11C4A2B0824281FB154B65D664FB967A5BF84F94F088731DE3DCA6DDDF7CE0808600

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140081410 Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT(?,?,00000001,000000014007C630), ref: 0000000140081456
??3@YAXPEAX@Z.MSVCRT(?,?,00000001,000000014007C630), ref: 0000000140081461

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 397ea9d017a93245fcb8a4b73f0af12a8ef3a5589f1a4a05b8faa9de59477c31
Instruction ID: 2738b0ec4ec0e24fa8a2e5f37df09ccd0774cfe9b21d796faaa6701e5da021e5
Opcode Fuzzy Hash: 397ea9d017a93245fcb8a4b73f0af12a8ef3a5589f1a4a05b8faa9de59477c31
Instruction Fuzzy Hash: F80112B320254485EF6ACFAAD0943E823A4FF89FD4F1C66119B59472E5DB35CAC2C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E6AAC Relevance: 3.0, APIs: 2, Instructions: 28timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 00007FFDFF1E6AD0
KillTimer.USER32 ref: 00007FFDFF1E6AF3

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Timer$Kill
String ID:
API String ID: 3307318486-0
Opcode ID: 072ef83535ecc30f3334ec0a55a301971fd786f5df42f21ab2bd1e7d34d56c27
Instruction ID: 21840f387d8dabc29e89992e29d7bb5027da434177bc93de5eead03f2667446c
Opcode Fuzzy Hash: 072ef83535ecc30f3334ec0a55a301971fd786f5df42f21ab2bd1e7d34d56c27
Instruction Fuzzy Hash: 75F06233B28685C6D7549F20D0567F837A0F745B0CFAC8130CAA94E254CF299599C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E6A3C Relevance: 3.0, APIs: 2, Instructions: 28timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 00007FFDFF1E6A6C
KillTimer.USER32 ref: 00007FFDFF1E6A86

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Timer$Kill
String ID:
API String ID: 3307318486-0
Opcode ID: b09841acffa7056f7a30501fc01371b772154fb9e9a757475d0913cc32261305
Instruction ID: 8a219fb253668eabaf13115f64cb0b46b0ee06c7fb6922be2cfcb8393f3a62e5
Opcode Fuzzy Hash: b09841acffa7056f7a30501fc01371b772154fb9e9a757475d0913cc32261305
Instruction Fuzzy Hash: A3F0CD32B18685C6D7108F26E19099873A1FB84B48F69C131C76D4F658CF3AE452C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005BE44 Relevance: 3.0, APIs: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140072318: RtlAllocateHeap.NTDLL ref: 0000000140072345
Part of subcall function 0000000140072318: RtlAllocateHeap.NTDLL ref: 0000000140072373
Part of subcall function 0000000140072318: RtlInitializeCriticalSection.NTDLL ref: 0000000140072381

Part of subcall function 000000014007204C: TlsAlloc.KERNEL32 ref: 0000000140072082
Part of subcall function 000000014007204C: RtlAllocateHeap.NTDLL ref: 000000014007209D
Part of subcall function 000000014007204C: TlsSetValue.KERNEL32 ref: 00000001400720AC
Part of subcall function 000000014007204C: TlsGetValue.KERNEL32 ref: 00000001400720CF
Part of subcall function 000000014007204C: RtlReAllocateHeap.NTDLL ref: 00000001400720EB
Part of subcall function 000000014007204C: TlsSetValue.KERNEL32 ref: 00000001400720FD

LoadIconW.USER32 ref: 000000014005BE97
LoadCursorW.USER32 ref: 000000014005BEAB

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AllocateHeap$Value$Load$AllocCriticalCursorIconInitializeSection
String ID:
API String ID: 2482360699-0
Opcode ID: 651a2b23da79e8d65a3f8ce19a1dcf2f6722dd49c05b27aa9f98032fa56f3bf7
Instruction ID: 09bb3a12d48358b5c987e25ef62efe9fb28c8173136af7a76369036511867a5c
Opcode Fuzzy Hash: 651a2b23da79e8d65a3f8ce19a1dcf2f6722dd49c05b27aa9f98032fa56f3bf7
Instruction Fuzzy Hash: E8F0E235601B11CAF706EF27E815BDA37A1FB8E704F4089299B09037B2EF3D9566C640

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BB28 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32 ref: 000000014004BB48
DeleteFileW.KERNEL32 ref: 000000014004BB51

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 523116f317e0b37df0ea50e201f56b420c1ac289f4f572830257359e87b20e02
Instruction ID: 189a30bb9b122f408657d16bb332bdda71a93b14a13cffd61a8fcc9b779a46d7
Opcode Fuzzy Hash: 523116f317e0b37df0ea50e201f56b420c1ac289f4f572830257359e87b20e02
Instruction Fuzzy Hash: 1DE02E3070200089FB7F4BA36C667F00181EF9D380F288130AE02032F8CB7C50890248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF234010 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(?,?,?,?,00007FFDFF22F981), ref: 00007FFDFF234022
HeapSetInformation.KERNEL32 ref: 00007FFDFF23404C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: f4fcbb66ce901025b55f67e3821f6c73a10a52db3cf1abbaa1ef3e5b0aaa4f72
Instruction ID: 364524b5897daa59c6fa5a6038907b6bdad4aac2ed696d155b200b6d608ea2b0
Opcode Fuzzy Hash: f4fcbb66ce901025b55f67e3821f6c73a10a52db3cf1abbaa1ef3e5b0aaa4f72
Instruction Fuzzy Hash: AEE0D8B0B2574142F7489B11A429B653350FF48340F804138E96DC27C8DF7CC0808A00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F714 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ValidateRect.USER32 ref: 000000014004F71F
CallWindowProcW.USER32 ref: 000000014004F73E

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CallProcRectValidateWindow
String ID:
API String ID: 3098300140-0
Opcode ID: a7234a047eeb9450c94c17bf9e30c967892f29f6966a028a014a9e8127dd90a9
Instruction ID: a625f5c3b94f08483a7cadb84c6c2e6b7c4d97acd8588b1269bdc859196154fa
Opcode Fuzzy Hash: a7234a047eeb9450c94c17bf9e30c967892f29f6966a028a014a9e8127dd90a9
Instruction Fuzzy Hash: F8D0A734B1468485EA219F33FC407BA1661BBEDBC4F518460EE4D47274CE3C8024B604

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400EF3F0 Relevance: 3.0, APIs: 2, Instructions: 13sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00000001400EF3FF
Sleep.KERNEL32 ref: 00000001400EF40D

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: b1423a8644219b21860269d51c0de9ee150eb64b25dac3572b0a2b3eab9c9144
Instruction ID: fc88d2a18e3ce921423f105ed736776227badfd14a9b4fa98148301561a33281
Opcode Fuzzy Hash: b1423a8644219b21860269d51c0de9ee150eb64b25dac3572b0a2b3eab9c9144
Instruction Fuzzy Hash: F2D01274F1240186FB1A3B339C553B610907B5C771FC00618D725852F0DE3C45AB4A00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140072D90 Relevance: 3.0, APIs: 2, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 0000000140072D9E
TlsAlloc.KERNEL32 ref: 0000000140072DAB

Part of subcall function 0000000140073B90: RtlAllocateHeap.NTDLL ref: 0000000140073BA3
Part of subcall function 0000000140073B90: RtlAllocateHeap.NTDLL ref: 0000000140073BBD
Part of subcall function 0000000140073B90: TlsSetValue.KERNEL32 ref: 0000000140073BF0

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$AllocCreateValue
String ID:
API String ID: 3361498153-0
Opcode ID: e8acd9415d81985eb8cb4f6844d50d2bf3ac95edaef8d35d432be9bbb665cf37
Instruction ID: 28b70351988f47dbce6a353754498af082549b1a05e9bc17540dacee7fd0c12f
Opcode Fuzzy Hash: e8acd9415d81985eb8cb4f6844d50d2bf3ac95edaef8d35d432be9bbb665cf37
Instruction Fuzzy Hash: 54D0C938A22750CAF7567F72AD5AB9A2AA0F74C741F906429DB05427B5DF3C80558A00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004AAD0 Relevance: 2.5, APIs: 2, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400DC4B0: ??3@YAXPEAX@Z.MSVCRT ref: 00000001400DC556
Part of subcall function 00000001400DC4B0: ??3@YAXPEAX@Z.MSVCRT ref: 00000001400DC55F

HeapFree.KERNEL32 ref: 000000014004AAF6
HeapFree.KERNEL32 ref: 000000014004AB0E

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ??3@FreeHeap
String ID:
API String ID: 1511904387-0
Opcode ID: 36065e0689b59ae25cc90955ed544104d3806b3e4de492921f11b493857ea2d2
Instruction ID: 4a5c298898c067f69ff7dadd2c3cafdbdbc24683dc54892e802b16890c4e2210
Opcode Fuzzy Hash: 36065e0689b59ae25cc90955ed544104d3806b3e4de492921f11b493857ea2d2
Instruction Fuzzy Hash: C80112B2604A8089F716CF739C557E52792F78DB84F4990169F0857266CE388492D350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004C930 Relevance: 2.5, APIs: 2, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014004C988
CloseHandle.KERNEL32 ref: 000000014004C991

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleHeap
String ID:
API String ID: 1642312469-0
Opcode ID: b0e64ecd165a58aeca844b01025d1d498112bca6d1c31d3122f3006aa1eb1935
Instruction ID: ab48b880740cca082a7c7b77d5e3445cb164434db1b37ac447be66a5cb8cbf4c
Opcode Fuzzy Hash: b0e64ecd165a58aeca844b01025d1d498112bca6d1c31d3122f3006aa1eb1935
Instruction Fuzzy Hash: 85013131614A4095EA579B27E9997E96790BB8DBE4F049221AF2D0B3F5DE38C440C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF232A14 Relevance: 2.5, APIs: 2, Instructions: 30sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FFDFF232A33

Part of subcall function 00007FFDFF22FF04: _FF_MSGBANNER.LIBCMT ref: 00007FFDFF22FF34
Part of subcall function 00007FFDFF22FF04: RtlAllocateHeap.NTDLL(?,?,?,00007FFDFF22E0FB,?,?,?,?,?,?,?,00007FFDFF1C1A47), ref: 00007FFDFF22FF59
Part of subcall function 00007FFDFF22FF04: _errno.LIBCMT ref: 00007FFDFF22FF7D
Part of subcall function 00007FFDFF22FF04: _errno.LIBCMT ref: 00007FFDFF22FF88

Sleep.KERNEL32(?,?,00000000,00007FFDFF2344B5,?,?,?,00007FFDFF23455F,?,?,?,?,?,?,00000000,00007FFDFF230DC4), ref: 00007FFDFF232A4A

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: _errno$AllocateHeapSleepmalloc
String ID:
API String ID: 4275769124-0
Opcode ID: 05b6573d59e8e93d7b5710d36b3a35c6d201a7e2f30ebd1697e0108080f8a896
Instruction ID: 00aedc1b8d87ee24c7d5e7ac2b278d98f17f77c5536fb9d44473152519f4c245
Opcode Fuzzy Hash: 05b6573d59e8e93d7b5710d36b3a35c6d201a7e2f30ebd1697e0108080f8a896
Instruction Fuzzy Hash: C3F0C272B19A8686EB509F12A56046E73A1EB94B90F440334EA7DCB7D9CF7CE9918700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E4A68 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557f77a70a80bbb14c1a7bd53803204ebe58c77c4546cf7bad90a32a775a646e
Instruction ID: 9f44d1bca106a490c2560e7080bd5bb352a4710588757f4ab383c4674cec1dab
Opcode Fuzzy Hash: 557f77a70a80bbb14c1a7bd53803204ebe58c77c4546cf7bad90a32a775a646e
Instruction Fuzzy Hash: EAE15D37F1968381EB649B1884B4BB827A0EB41F84F684735D67D866DDCF2DF8529340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F928 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

_mktime64.MSVCRT ref: 000000014005FAF8

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: _mktime64
String ID:
API String ID: 2731814466-0
Opcode ID: c4ac7a430b6e43bbaa99b5db4a950bb6ad107a1f8dbe209fd0eb16066980884c
Instruction ID: 02e408cabc781342f713d8645153e85f785dfdecb1b3bad975e1cb0d83d52dbe
Opcode Fuzzy Hash: c4ac7a430b6e43bbaa99b5db4a950bb6ad107a1f8dbe209fd0eb16066980884c
Instruction Fuzzy Hash: 8A512633E10A4046FB2ACA67C4853FD6BA9B35C3D4F148126FF0597AE1CB7AD881D641

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001BCDC Relevance: 1.6, APIs: 1, Instructions: 138windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140073140: TlsGetValue.KERNEL32 ref: 0000000140073158

IsWindowVisible.USER32 ref: 000000014001BDC1

Part of subcall function 000000014004CFF0: RtlAcquirePebLock.NTDLL ref: 00000001400723C0
Part of subcall function 000000014004CFF0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072405

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireCriticalLeaveLockSectionValueVisibleWindow
String ID:
API String ID: 110955310-0
Opcode ID: 2368624805d7a74cc8eea8286cfc9d370ce585c758d10cff553a477e8559904a
Instruction ID: 3e6afee2e6dfae3ceab8b3e8ba3e818aa7bd6282ed34b18856f847f8dc34eaa0
Opcode Fuzzy Hash: 2368624805d7a74cc8eea8286cfc9d370ce585c758d10cff553a477e8559904a
Instruction Fuzzy Hash: 2251FF32215A41D9FA23AF63BD527E91791B74D7D4F180825BF0D0B3B2EF7AD4908610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E6DFC Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32 ref: 00007FFDFF1E6F54

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 00247146936d7c4eeb0a6acdb56a4b3edebd83f53ffac34bfaae8a46000c57b0
Instruction ID: eb7687e0ebdd9d53ee9f8cb2e0a8f061177e80001783617342085993c53db38a
Opcode Fuzzy Hash: 00247146936d7c4eeb0a6acdb56a4b3edebd83f53ffac34bfaae8a46000c57b0
Instruction Fuzzy Hash: DA41D033A29381CBD764CF11E1945AEBBB5F788B84F54512AE7A903B58CB39D850CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400EA3B0 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00000001400EA4CC

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 66cac8fe770576109460e470b2552ea287734445d989293d7b112310b5212771
Instruction ID: 4f736889138cb5aef3aec48fec8f000dddad9f6279447cdc5aa67f812c1b5a7c
Opcode Fuzzy Hash: 66cac8fe770576109460e470b2552ea287734445d989293d7b112310b5212771
Instruction Fuzzy Hash: BE313072711A4082EA1AEF27D5513AD73A0FB8DBD4F484025FB4947BA6DF78E861C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000D073 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140073140: TlsGetValue.KERNEL32 ref: 0000000140073158

Part of subcall function 0000000140072E00: GetLastError.KERNEL32 ref: 0000000140072E04
Part of subcall function 0000000140072E00: TlsGetValue.KERNEL32 ref: 0000000140072E14
Part of subcall function 0000000140072E00: SetLastError.KERNEL32 ref: 0000000140072E31

Part of subcall function 000000014004C1BC: LoadLibraryW.KERNEL32 ref: 000000014004C1F5
Part of subcall function 000000014004C1BC: GetProcAddress.KERNEL32 ref: 000000014004C20D
Part of subcall function 000000014004C1BC: wcscpy.MSVCRT ref: 000000014004C23E
Part of subcall function 000000014004C1BC: wcscat.MSVCRT ref: 000000014004C24D
Part of subcall function 000000014004C1BC: wcslen.MSVCRT ref: 000000014004C255
Part of subcall function 000000014004C1BC: FreeLibrary.KERNEL32 ref: 000000014004C26B
Part of subcall function 000000014004C1BC: wcscat.MSVCRT ref: 000000014004C290
Part of subcall function 000000014004C1BC: wcslen.MSVCRT ref: 000000014004C298

Part of subcall function 0000000140072E50: TlsGetValue.KERNEL32 ref: 0000000140072E63
Part of subcall function 0000000140072E50: RtlAllocateHeap.NTDLL ref: 0000000140072EA6

Part of subcall function 0000000140073020: wcslen.MSVCRT ref: 000000014007303E

Part of subcall function 0000000140072E50: RtlReAllocateHeap.NTDLL ref: 0000000140072ED3

PathAddBackslashW.SHLWAPI ref: 000000014000D119

Part of subcall function 000000014004BB64: wcsncpy.MSVCRT ref: 000000014004BB82
Part of subcall function 000000014004BB64: wcslen.MSVCRT ref: 000000014004BB94
Part of subcall function 000000014004BB64: CreateDirectoryW.KERNEL32 ref: 000000014004BBE4

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: wcslen$Value$AllocateErrorHeapLastLibrarywcscat$AddressBackslashCreateDirectoryFreeLoadPathProcwcscpywcsncpy
String ID:
API String ID: 1679855796-0
Opcode ID: f64d57f6a6ed6cebcd74d2a7afb2e4a75d8c54752973f287be2470c1722c81d0
Instruction ID: 7518d534293f1204b131c68fa64bf139a33e79a35d8f95d5c56dc00e9c6ca9cb
Opcode Fuzzy Hash: f64d57f6a6ed6cebcd74d2a7afb2e4a75d8c54752973f287be2470c1722c81d0
Instruction Fuzzy Hash: 9C115EB6E25A44E5F91B7B73BC877D80321A76C390F504110BF09572B3AD7C51EA4B45

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004D6E0 Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

WriteFile.KERNEL32 ref: 000000014004D74E

Part of subcall function 000000014004D980: SetFilePointer.KERNEL32 ref: 000000014004D9C4
Part of subcall function 000000014004D980: memcpy.MSVCRT ref: 000000014004D9FF

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: File$AcquireCriticalLeaveLockPointerSectionWritememcpy
String ID:
API String ID: 3116041622-0
Opcode ID: 56a6bdff6fe8edb0a03917202f887701f2f3cc40f13b3a9ce877d2762e13d0d0
Instruction ID: 18881a2bcd8e118ef7928cffc3829049da678ba539245af755595c64727ff0f5
Opcode Fuzzy Hash: 56a6bdff6fe8edb0a03917202f887701f2f3cc40f13b3a9ce877d2762e13d0d0
Instruction Fuzzy Hash: D8015A36718A9092EB119B56F48435AE7A0FB8DBC0F598436FF8C43B69DA38C8418B04

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004D900 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

SetFilePointer.KERNEL32 ref: 000000014004D935

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireCriticalFileLeaveLockPointerSection
String ID:
API String ID: 3048853361-0
Opcode ID: f5e0f7e569a938d4553d2e05bded5de4b43f6ae2ff6afb2d7bdc8994ec86fbed
Instruction ID: 846396e8a09de132e6ce6769a4f4519e47256432b35fe8f376387d8dd9ad74cd
Opcode Fuzzy Hash: f5e0f7e569a938d4553d2e05bded5de4b43f6ae2ff6afb2d7bdc8994ec86fbed
Instruction Fuzzy Hash: 0301867271164486EF59CF6BE4853692790E78CBB4F045225EA2D873E4DE3CC8D1C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048A08 Relevance: 1.5, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014004923C: CreateMenu.USER32 ref: 0000000140049283
Part of subcall function 000000014004923C: GetPropW.USER32 ref: 00000001400492A9
Part of subcall function 000000014004923C: SetWindowLongPtrW.USER32 ref: 00000001400492C1
Part of subcall function 000000014004923C: SetPropW.USER32 ref: 00000001400492D4

HeapCreate.KERNEL32 ref: 0000000140048A5B

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CreateProp$AcquireCriticalHeapLeaveLockLongMenuSectionWindow
String ID:
API String ID: 2911112708-0
Opcode ID: 42cf29abe022985a2e7b5411f3026ba295cf5e7959140fe7ef8e16bb2a61c277
Instruction ID: 46ba5f07f06461f11db500ecfe6deca1003a81e63bce99cc1974930617890eb5
Opcode Fuzzy Hash: 42cf29abe022985a2e7b5411f3026ba295cf5e7959140fe7ef8e16bb2a61c277
Instruction Fuzzy Hash: AD015A31211B8089FB66DB27A44439976A0F74CBE0F494635BF6C077E9DF78C9918744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048A94 Relevance: 1.5, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140048DF4: CreatePopupMenu.USER32 ref: 0000000140048E27

HeapCreate.KERNEL32 ref: 0000000140048AE6

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Create$AcquireCriticalHeapLeaveLockMenuPopupSection
String ID:
API String ID: 3609714891-0
Opcode ID: 10c630742c61ea02d13e2ca59f6bb95b7e9cbe9fa305852cbb8ec05c0dbc4785
Instruction ID: f070a851e0149d37037b42970fef5ce734a190899a6e0a23e9e609a354feb103
Opcode Fuzzy Hash: 10c630742c61ea02d13e2ca59f6bb95b7e9cbe9fa305852cbb8ec05c0dbc4785
Instruction Fuzzy Hash: 81015A71201B408AEB669B17E45439A66A0F78CBE0F095A35AF6D077E5DB78C481C784

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140052F20 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32 ref: 0000000140052F70

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 63fda6f2d3b90f10a1e1187f07ed52df0278f0370e1f3f1ba4772e4b2108130b
Instruction ID: 7990071d2a38ef10cba0e722b8f7cba0fbddc5cc2c6aae98e2948e9f55ec7a68
Opcode Fuzzy Hash: 63fda6f2d3b90f10a1e1187f07ed52df0278f0370e1f3f1ba4772e4b2108130b
Instruction Fuzzy Hash: A8F06731318A4082E6118F07F40038AE760FB8ABC0F688030FF9C87B69DA39C9528B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E6CC0 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetCaretPos.USER32 ref: 00007FFDFF1E6D1F

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Caret
String ID:
API String ID: 1115476763-0
Opcode ID: 3364073bb209627ba320578a8e662740248f8183c3bbefc21863ca586bb71156
Instruction ID: 9ab389a99f914cce506eaa41487031027a12b566dd0d18a98c8bc3d8d0f704a1
Opcode Fuzzy Hash: 3364073bb209627ba320578a8e662740248f8183c3bbefc21863ca586bb71156
Instruction Fuzzy Hash: A8F06823F2A18386EB909B25D464EB93391EF41B84F5C1131D6795A1D9DF2DF882CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054E34 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

ShowWindow.USER32 ref: 0000000140054E7D

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireCriticalLeaveLockSectionShowWindow
String ID:
API String ID: 3347344642-0
Opcode ID: 19e153e9759d8e97d2c253a91377dabe828eebb9646d22a09db612c8e2a86fb9
Instruction ID: 008f4708a4811243bbc38f88cf90d04839b66b5b6302e5aac926dadc95fa6db8
Opcode Fuzzy Hash: 19e153e9759d8e97d2c253a91377dabe828eebb9646d22a09db612c8e2a86fb9
Instruction Fuzzy Hash: 62F06D7170169085FF16CB9398913E62291FBDCFD8F6884255F1D473B5DE3AC8828300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BED8 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

FindNextFileW.KERNEL32 ref: 000000014004BF0D

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireCriticalFileFindLeaveLockNextSection
String ID:
API String ID: 2566760965-0
Opcode ID: 4e94c08cccfe50eadf6821d92fadb988587affa844ee2242cd23363ae4e55400
Instruction ID: 80e5968ce25acf8be85ab000f7e04334605018ddedf6ee4d8db64c41c43ab8cf
Opcode Fuzzy Hash: 4e94c08cccfe50eadf6821d92fadb988587affa844ee2242cd23363ae4e55400
Instruction Fuzzy Hash: 76F08971200681C5EB154F56ED803A46290F78CBF4F59C235AB3D473F5DB38C8958704

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004D080 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

SetFilePointer.KERNEL32 ref: 000000014004D0D4

Part of subcall function 000000014004C9C0: WriteFile.KERNEL32 ref: 000000014004C9ED

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: File$AcquireCriticalLeaveLockPointerSectionWrite
String ID:
API String ID: 2540408055-0
Opcode ID: d60d9d47e4f065e42ce1ee6e787e62e383724124571d5709814626d448b3941e
Instruction ID: 082dd46448a705c7fc13c163ccc617f5db57ea9b5962644482c33cb7d18cb6bf
Opcode Fuzzy Hash: d60d9d47e4f065e42ce1ee6e787e62e383724124571d5709814626d448b3941e
Instruction Fuzzy Hash: 81F0827211164085EB5ACF53E45879A77A0F78CB88F059026EB09073B9DB38C495CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048BBC Relevance: 1.5, APIs: 1, Instructions: 25windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140071FB4: TlsGetValue.KERNEL32 ref: 0000000140071FCC
Part of subcall function 0000000140071FB4: RtlAllocateHeap.NTDLL ref: 0000000140071FEB
Part of subcall function 0000000140071FB4: TlsSetValue.KERNEL32 ref: 0000000140071FFD

SetMenu.USER32 ref: 0000000140048C09

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Value$AllocateHeapMenu
String ID:
API String ID: 1798796344-0
Opcode ID: 2c442d74bc49ae7015f7c9359563ac4aeda0d9d47db671339dadf0de2236811b
Instruction ID: 14d976fbdc345034a102ee425907080e46d43c300f0c2389232c5755fc80c9e1
Opcode Fuzzy Hash: 2c442d74bc49ae7015f7c9359563ac4aeda0d9d47db671339dadf0de2236811b
Instruction Fuzzy Hash: A1F012B220198486EA12AF56E1943E967A1F788FC0F09D925EF09073A9CF78C8A4C744

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C4C8 Relevance: 1.5, APIs: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

SetTimer.USER32 ref: 000000014005C4FF

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: AcquireCriticalLeaveLockSectionTimer
String ID:
API String ID: 2188216108-0
Opcode ID: af9281121f6510893300f00ec542bd5cd1ee7b55326ae8f391bfafca2e8796a0
Instruction ID: 0e353f60ca4ce229b9b27ac6402eda38ac6cd0bc05243a85cf2627ea00211746
Opcode Fuzzy Hash: af9281121f6510893300f00ec542bd5cd1ee7b55326ae8f391bfafca2e8796a0
Instruction Fuzzy Hash: 18E09231714A9081EB518B53B844B9AAB60FBCCFC0F489435BF5D87B29DE3CC4428700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004C9C0 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014004C9ED

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ef2db61e50803a8ec3b4c65a70507900094f3ac6f3dbd3da36829219669562ff
Instruction ID: 886a3ca652e9b7483a029ec96223b8f43f73945d6c1e72b1de78244ff4bfe627
Opcode Fuzzy Hash: ef2db61e50803a8ec3b4c65a70507900094f3ac6f3dbd3da36829219669562ff
Instruction Fuzzy Hash: 68F030B6624654CBCB50CF3AE005669B7B0F349B88F204516DF4847724DB36C562CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004D180 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400721F0: RtlAcquirePebLock.NTDLL ref: 0000000140072209
Part of subcall function 00000001400721F0: RtlLeaveCriticalSection.NTDLL ref: 0000000140072226

Part of subcall function 000000014004D900: SetFilePointer.KERNEL32 ref: 000000014004D935

Part of subcall function 000000014004D080: SetFilePointer.KERNEL32 ref: 000000014004D0D4

SetEndOfFile.KERNEL32 ref: 000000014004D1BA

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: File$Pointer$AcquireCriticalLeaveLockSection
String ID:
API String ID: 2549087813-0
Opcode ID: 6215e8d3e819d288217bceaacdae4f289ba49103330836ed17c588c54203d23c
Instruction ID: df3f02ab434b44838f3695a314c7c7b62019c8cfcd70e231439030031eba05f7
Opcode Fuzzy Hash: 6215e8d3e819d288217bceaacdae4f289ba49103330836ed17c588c54203d23c
Instruction Fuzzy Hash: 1EE04631316640A0EE06AB53F9553EA62A0BB8CFC0F088031BF5E4B3BADE38C8508344

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400536BC Relevance: 1.5, APIs: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00000001400536FB

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: Focus
String ID:
API String ID: 2734777837-0
Opcode ID: 96f0996e99b06dd449aedd88fe789c9d97847a05e7742e46e765f0b7619bd08e
Instruction ID: 0e1c487f8ef2749ff387cfe4319add1aadda08dcc34e45de498e92698cf921a8
Opcode Fuzzy Hash: 96f0996e99b06dd449aedd88fe789c9d97847a05e7742e46e765f0b7619bd08e
Instruction Fuzzy Hash: 9FE0E574B1294084ED5ADB1BD9953A816A0AB8CBF4F94832AAB3E473F4DE3A84524200

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140043BF8 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32 ref: 0000000140043C19

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 87338098468cc9ab85642e252e63c712382b852e6a3e217f8e5faabf69bf4e9e
Instruction ID: 3eb5ca6b594b4af2ba0836341650f724cfe7828218401683c0be9cbe7d74ddf6
Opcode Fuzzy Hash: 87338098468cc9ab85642e252e63c712382b852e6a3e217f8e5faabf69bf4e9e
Instruction Fuzzy Hash: 8BD0A730B10A4085E722AB93EC85BEA1651B79DBC0F106070FF5D577F5DA3DC8118704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400439A0 Relevance: 1.5, APIs: 1, Instructions: 10libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00000001400439B5

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dd8d59afa42592c36a3245908324823f0dcfaef43541099f1e65c408819396cc
Instruction ID: aff727f0de9a7a4ffb9261fbb8394a4aa50d02643f4274f8a4727d928071e9a0
Opcode Fuzzy Hash: dd8d59afa42592c36a3245908324823f0dcfaef43541099f1e65c408819396cc
Instruction Fuzzy Hash: 21D08C34703B0088FD0F6F43AA8139826E0BB0C781F8829B8CB8D06370DA3C4C958700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140071640 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014007164E

Memory Dump Source

Source File: 00000005.00000002.2925263104.0000000140042000.00000040.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2925244332.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.0000000140001000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.000000014039A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925263104.00000001403C3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925544056.00000001403C5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2925563252.00000001403C7000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000_Bat_To_Exe_Converter.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a25d225a6baa7dcad69abc5aa3dac0c19b8bd1a674fdca1386d9ec1895419c9f
Instruction ID: 9824b89684213303b12c0de4546fe463432a8921623b9f96407c0696c9f6de49
Opcode Fuzzy Hash: a25d225a6baa7dcad69abc5aa3dac0c19b8bd1a674fdca1386d9ec1895419c9f
Instruction Fuzzy Hash: 95C09B347516A1C6E7592B625C57B5A1550F34D341FD09819DA5501764CE7D81564B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22E0DC Relevance: 1.3, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FFDFF22E0F6

Part of subcall function 00007FFDFF22FF04: _FF_MSGBANNER.LIBCMT ref: 00007FFDFF22FF34
Part of subcall function 00007FFDFF22FF04: RtlAllocateHeap.NTDLL(?,?,?,00007FFDFF22E0FB,?,?,?,?,?,?,?,00007FFDFF1C1A47), ref: 00007FFDFF22FF59
Part of subcall function 00007FFDFF22FF04: _errno.LIBCMT ref: 00007FFDFF22FF7D
Part of subcall function 00007FFDFF22FF04: _errno.LIBCMT ref: 00007FFDFF22FF88

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: _errno$AllocateHeapmalloc
String ID:
API String ID: 3105967009-0
Opcode ID: fbbb7fdc57efdf51458817c3e5e168f641ab2f55b5a9b17b09f678d55096a9df
Instruction ID: 72f9ae97fafb7a568feaded46587dcd84f4c0d2c0665ed8025c9cdc8eff4875a
Opcode Fuzzy Hash: fbbb7fdc57efdf51458817c3e5e168f641ab2f55b5a9b17b09f678d55096a9df
Instruction Fuzzy Hash: F1010561B08A0791FB10EB10A8609B427A0AF56380F880635DD3EC66DAEF6CE744E740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF232A80 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFDFF236340: _errno.LIBCMT ref: 00007FFDFF236363

Sleep.KERNEL32(?,?,?,00007FFDFF230D9F,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF232AC5

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: 987fe2fcbdc9d1e325909607a2df3cd92253b1beacba056260e72759cb310de1
Instruction ID: 22a90529bd2fa25e521280eb31d45ca9626674a98f80f6ea5503782315082518
Opcode Fuzzy Hash: 987fe2fcbdc9d1e325909607a2df3cd92253b1beacba056260e72759cb310de1
Instruction Fuzzy Hash: 2301A772B25A8186E7548F169860469B7A1FB88FD0B084231DE7D8BBD8CF7CE891C704

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFDFF1F0920 Relevance: 33.1, Strings: 26, Instructions: 555COMMON

Download Yara Rule

Strings

switch, xrefs: 00007FFDFF1F0E25
endfunc, xrefs: 00007FFDFF1F0E3F
fold.comment, xrefs: 00007FFDFF1F095E, 00007FFDFF1F0971
case, xrefs: 00007FFDFF1F0EC9
endselect, xrefs: 00007FFDFF1F0F0E
func, xrefs: 00007FFDFF1F0DB4
fold.compact, xrefs: 00007FFDFF1F0991
endswitch, xrefs: 00007FFDFF1F0F24
wend, xrefs: 00007FFDFF1F0EAD
, xrefs: 00007FFDFF1F0B5E
with, xrefs: 00007FFDFF1F0DE0
#region, xrefs: 00007FFDFF1F0DF6
elseif, xrefs: 00007FFDFF1F0EF5
for, xrefs: 00007FFDFF1F0D9E
;, xrefs: 00007FFDFF1F0C25
while, xrefs: 00007FFDFF1F0DCA
_, xrefs: 00007FFDFF1F1042
until, xrefs: 00007FFDFF1F0E81
select, xrefs: 00007FFDFF1F0E0F
else, xrefs: 00007FFDFF1F0EDF
next, xrefs: 00007FFDFF1F0E6B
endif, xrefs: 00007FFDFF1F0E55
then, xrefs: 00007FFDFF1F0CBF
endwith, xrefs: 00007FFDFF1F0E97
#endregion, xrefs: 00007FFDFF1F0F42
fold.preprocessor, xrefs: 00007FFDFF1F09A9

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $#endregion$#region$;$_$case$else$elseif$endfunc$endif$endselect$endswitch$endwith$fold.comment$fold.compact$fold.preprocessor$for$func$next$select$switch$then$until$wend$while$with
API String ID: 0-3870396653
Opcode ID: 6dd099ad33d699f569c1487b0d01e86228e5a27ff417eb6eae1db14346132234
Instruction ID: d979d6942378493f1252e4362a9826f35926472800ad7c38817b289724cadaaf
Opcode Fuzzy Hash: 6dd099ad33d699f569c1487b0d01e86228e5a27ff417eb6eae1db14346132234
Instruction Fuzzy Hash: 37328E23F0C6C686EB749B24A0A087D6791FB95744F940236DABE827DEDF2CE545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2226E8 Relevance: 26.7, Strings: 21, Instructions: 484COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF2228FD
", xrefs: 00007FFDFF222729
/, xrefs: 00007FFDFF2229AB
., xrefs: 00007FFDFF222955
_, xrefs: 00007FFDFF22295B
', xrefs: 00007FFDFF222B48
`, xrefs: 00007FFDFF222989
", xrefs: 00007FFDFF222CE5
., xrefs: 00007FFDFF222AF0
", xrefs: 00007FFDFF2229E9
", xrefs: 00007FFDFF222967
\, xrefs: 00007FFDFF222C7F
", xrefs: 00007FFDFF222B4E
`, xrefs: 00007FFDFF222B32
_, xrefs: 00007FFDFF222AFA
', xrefs: 00007FFDFF222CEB
', xrefs: 00007FFDFF2229E3
', xrefs: 00007FFDFF222961
/, xrefs: 00007FFDFF222BD4
', xrefs: 00007FFDFF222BFB
tab.timmy.whinge.level, xrefs: 00007FFDFF222779

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $"$"$"$"$"$'$'$'$'$'$.$.$/$/$\$_$_$`$`$tab.timmy.whinge.level
API String ID: 0-1475303128
Opcode ID: c695e7c3d55a8083ecbc471a244ce4e1eb127130358f253d9b8f7f27556a3826
Instruction ID: e4cc99c7d6accdd17ebaea4eaf500d5fd5dd88c442d95351fb300921affaca31
Opcode Fuzzy Hash: c695e7c3d55a8083ecbc471a244ce4e1eb127130358f253d9b8f7f27556a3826
Instruction Fuzzy Hash: 2012BF22F0C68246FB748A15C1A4B7D63A0BB49B80F915231DF7AC77D9CFAEE8448751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF203B54 Relevance: 25.0, Strings: 17, Instructions: 3796COMMON

Download Yara Rule

Strings

fold.html, xrefs: 00007FFDFF203DF3
.-_:!#, xrefs: 00007FFDFF203E8E
", xrefs: 00007FFDFF206E7F
php, xrefs: 00007FFDFF204806
script, xrefs: 00007FFDFF204621
.xXabcdefABCDEF, xrefs: 00007FFDFF206C69
fold.compact, xrefs: 00007FFDFF203E5E
asp.default.language, xrefs: 00007FFDFF203D2C
fold, xrefs: 00007FFDFF203E14
d, xrefs: 00007FFDFF20508E
.-_:!#/, xrefs: 00007FFDFF203ED9
fold.html.preprocessor, xrefs: 00007FFDFF203E3E
.-_:!#[, xrefs: 00007FFDFF203EB7
html.tags.case.sensitive, xrefs: 00007FFDFF203E6E
, xrefs: 00007FFDFF20680B
>, xrefs: 00007FFDFF2054B2
<<<, xrefs: 00007FFDFF206DA1, 00007FFDFF2070F7

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $"$.-_:!#$.-_:!#/$.-_:!#[$.xXabcdefABCDEF$<<<$>$asp.default.language$d$fold$fold.compact$fold.html$fold.html.preprocessor$html.tags.case.sensitive$php$script
API String ID: 0-3624711261
Opcode ID: f1f2052b33d76d801d42483a3d051948b29c682b8ae6986b802e7100ee4d576a
Instruction ID: 0dca9d416760cc6fdad3bfb927851d2a76e44bfbf8c3d388a9488e15ebf5af78
Opcode Fuzzy Hash: f1f2052b33d76d801d42483a3d051948b29c682b8ae6986b802e7100ee4d576a
Instruction Fuzzy Hash: 1373B337B0C1428AEB748A15D0A4B7D67A1FB85B84F188235DB7AC77C8DE7DE8458B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DFA80 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 179windowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00007FFDFF1DFB20
EndPaint.USER32 ref: 00007FFDFF1DFB2E
SendMessageA.USER32 ref: 00007FFDFF1DFB50
SetWindowPos.USER32 ref: 00007FFDFF1DFB80
SetWindowLongA.USER32 ref: 00007FFDFF1DFBB6
DefWindowProcA.USER32 ref: 00007FFDFF1DFBCA
GetWindowLongPtrA.USER32 ref: 00007FFDFF1DFBE2
CreateWindowExA.USER32 ref: 00007FFDFF1DFC34
SetWindowLongPtrA.USER32 ref: 00007FFDFF1DFC4D
SetWindowLongPtrA.USER32 ref: 00007FFDFF1DFC5F
ReleaseCapture.USER32 ref: 00007FFDFF1DFCD4

Strings

listbox, xrefs: 00007FFDFF1DFC25
P, xrefs: 00007FFDFF1DFC04

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Window$Long$Paint$BeginCaptureCreateMessageProcReleaseSend
String ID: P$listbox
API String ID: 2579475255-659389835
Opcode ID: 95c885148dd482c24a8b51dbe3dd40894480514e3094618763e44e92adeb8aa7
Instruction ID: 3fb6dc6d8e37c3445801f9e1843cbbb1aea2fa47fe6d004f806c930e8beafe67
Opcode Fuzzy Hash: 95c885148dd482c24a8b51dbe3dd40894480514e3094618763e44e92adeb8aa7
Instruction Fuzzy Hash: F4716E63F08B4282E7549F29A464BBD2360EB85B85F144331DE7E8A6EDCF3CE641C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF20FAEC Relevance: 24.0, Strings: 19, Instructions: 277COMMON

Download Yara Rule

Strings

SectionEnd, xrefs: 00007FFDFF20FEA7
!ifdef, xrefs: 00007FFDFF20FC4F
!macro, xrefs: 00007FFDFF20FCA1
SubSection, xrefs: 00007FFDFF20FDE2
PageExEnd, xrefs: 00007FFDFF20FECC
Section, xrefs: 00007FFDFF20FD74
PageEx, xrefs: 00007FFDFF20FE0B
!macroend, xrefs: 00007FFDFF20FCF3
Function, xrefs: 00007FFDFF20FDB9
!ifndef, xrefs: 00007FFDFF20FC0E
!endif, xrefs: 00007FFDFF20FCCA
!, xrefs: 00007FFDFF20FBFE
FunctionEnd, xrefs: 00007FFDFF20FE82
nsis.ignorecase, xrefs: 00007FFDFF20FB74
SubSectionEnd, xrefs: 00007FFDFF20FE5D
!else, xrefs: 00007FFDFF20FD26
SectionGroup, xrefs: 00007FFDFF20FD94
SectionGroupEnd, xrefs: 00007FFDFF20FE34
!if, xrefs: 00007FFDFF20FC78

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: !$!else$!endif$!if$!ifdef$!ifndef$!macro$!macroend$Function$FunctionEnd$PageEx$PageExEnd$Section$SectionEnd$SectionGroup$SectionGroupEnd$SubSection$SubSectionEnd$nsis.ignorecase
API String ID: 0-3081094940
Opcode ID: fdcd076affbcecae079d0dc349dd6f7e7ddb4b0f19a467f4bf21c3bef0b04011
Instruction ID: a04c0f3d0508a2d22653821226f92553aef22ce0f3d5129debed58bcb5094fc9
Opcode Fuzzy Hash: fdcd076affbcecae079d0dc349dd6f7e7ddb4b0f19a467f4bf21c3bef0b04011
Instruction Fuzzy Hash: 50B16812F8C54751F7A4976490B5AB96362FF44340F981332E8BEC55EE8E3CF7889642

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF23163C Relevance: 20.0, APIs: 10, Strings: 1, Instructions: 714COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF22E4C4: _getptd.LIBCMT ref: 00007FFDFF22E4DA

_errno.LIBCMT ref: 00007FFDFF2316A4

Part of subcall function 00007FFDFF232254: DecodePointer.KERNEL32 ref: 00007FFDFF23227B

_errno.LIBCMT ref: 00007FFDFF231770
write_multi_char.LIBCMT ref: 00007FFDFF231D8F
write_multi_char.LIBCMT ref: 00007FFDFF231DC0
write_multi_char.LIBCMT ref: 00007FFDFF231E76
free.LIBCMT ref: 00007FFDFF231E8E

Strings

, xrefs: 00007FFDFF231D63

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: write_multi_char$_errno$DecodePointer_getptdfree
String ID:
API String ID: 2009448492-3916222277
Opcode ID: d9d66a26c22875bb9f69010a30017b2abdf9d309f1169151429ecf31f44f3b05
Instruction ID: ade0c56b4b12d68e83653591398cc02d6b19ba46f3587d024622fcb9e395ab80
Opcode Fuzzy Hash: d9d66a26c22875bb9f69010a30017b2abdf9d309f1169151429ecf31f44f3b05
Instruction Fuzzy Hash: 0D52D2A2F0C68685FB748A149464B7A6BA1BB41740F145332DABECA6DDDF7CE8C1C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF21FF9C Relevance: 16.8, Strings: 12, Instructions: 1803COMMON

Download Yara Rule

Strings

and, xrefs: 00007FFDFF220F3F
, xrefs: 00007FFDFF220DDF, 00007FFDFF221524
\ntrfvaebs, xrefs: 00007FFDFF220FC1
)}]., xrefs: 00007FFDFF220D3C
"'`_-, xrefs: 00007FFDFF22068E
qQrwWx, xrefs: 00007FFDFF2209E3, 00007FFDFF220A2F
print, xrefs: 00007FFDFF220F15
def, xrefs: 00007FFDFF220DF3
[*!~+-*/%=<>&^|, xrefs: 00007FFDFF220783
, xrefs: 00007FFDFF2219DF
__END__, xrefs: 00007FFDFF220ED6
=end, xrefs: 00007FFDFF22158F

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $"'`_-$)}].$=end$[*!~+-*/%=<>&^|$\ntrfvaebs$__END__$and$def$print$qQrwWx
API String ID: 0-1154094840
Opcode ID: b14b02de520cc81cc261f763eaf8f0e5ab04154d93b30b0d4f094dfe442e6ed7
Instruction ID: a56f2f2cf2f3f8fce7fab7076d2a951119895381fdbcf080ee178e4a8271a80f
Opcode Fuzzy Hash: b14b02de520cc81cc261f763eaf8f0e5ab04154d93b30b0d4f094dfe442e6ed7
Instruction Fuzzy Hash: B2F2DF22B0D6828AFB64CB14C1A4B7D77A0EB45780F905235DA7AC7BE9CF7DE4418B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DF8F0 Relevance: 16.6, APIs: 11, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FFDFF1DF954
CallWindowProcA.USER32 ref: 00007FFDFF1DF972
DefWindowProcA.USER32 ref: 00007FFDFF1DF988
GetParent.USER32 ref: 00007FFDFF1DF993
GetWindowLongPtrA.USER32 ref: 00007FFDFF1DF99E
SendMessageA.USER32 ref: 00007FFDFF1DF9D8
SendMessageA.USER32 ref: 00007FFDFF1DF9FE
BeginPaint.USER32 ref: 00007FFDFF1DFA23
GetParent.USER32 ref: 00007FFDFF1DFA2F
GetWindowLongPtrA.USER32 ref: 00007FFDFF1DFA3A
EndPaint.USER32 ref: 00007FFDFF1DFA5A

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Window$Long$MessagePaintParentProcSend$BeginCall
String ID:
API String ID: 841268368-0
Opcode ID: fd3ace368267e05a14c7a397d9dca320fc9d7b816de5ca4fe37129a8bf0e193b
Instruction ID: f86d4c33f329d5c39555761644e93fd950035f2f41de64a139e0643aae51e486
Opcode Fuzzy Hash: fd3ace368267e05a14c7a397d9dca320fc9d7b816de5ca4fe37129a8bf0e193b
Instruction Fuzzy Hash: 02316662F0965241EB585B65A838B7D13A1AF8AFC0F485735D97ECA7DCDE2CA6C4C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF215B94 Relevance: 15.9, Strings: 10, Instructions: 3366COMMON

Download Yara Rule

Strings

__DATA__, xrefs: 00007FFDFF21892F
sub, xrefs: 00007FFDFF217B8B
rwxoRWXOezsfdlpSbctugkTBMAC, xrefs: 00007FFDFF2179D6
elsif if split while, xrefs: 00007FFDFF215BB8
=cut, xrefs: 00007FFDFF216869
\[$@%&*];, xrefs: 00007FFDFF216C1E
format, xrefs: 00007FFDFF21899E
, xrefs: 00007FFDFF218A3E
^/|,\";#%^:?<>)[], xrefs: 00007FFDFF21771E
__END__, xrefs: 00007FFDFF218958

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: malloc
String ID: $=cut$\[$@%&*];$^/|,\";#%^:?<>)[]$__DATA__$__END__$elsif if split while$format$rwxoRWXOezsfdlpSbctugkTBMAC$sub
API String ID: 2803490479-65773373
Opcode ID: 40f99e071ad322cbf325b12c9da6faba7fb69ddf7b27aa43cb7916ecf5dae964
Instruction ID: 434181cccd0c59f9d287cc050d69cb37c57da7bda2feb381b5c3906074afe61c
Opcode Fuzzy Hash: 40f99e071ad322cbf325b12c9da6faba7fb69ddf7b27aa43cb7916ecf5dae964
Instruction Fuzzy Hash: EC53C422F0C286A6EB748A14C1A0BBD7BA1FB84744F544235C67DC3BD9CF2DE8958749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF211B58 Relevance: 14.6, Strings: 11, Instructions: 863COMMON

Download Yara Rule

Strings

call, xrefs: 00007FFDFF211F93
errorlevel, xrefs: 00007FFDFF211F61
goto, xrefs: 00007FFDFF211F1C
choice, xrefs: 00007FFDFF212210
set, xrefs: 00007FFDFF211F46
start, xrefs: 00007FFDFF212226
prompt, xrefs: 00007FFDFF211F31
exist, xrefs: 00007FFDFF211F7A
echo, xrefs: 00007FFDFF211F07, 00007FFDFF212165
loadhigh, xrefs: 00007FFDFF211FBD
rem, xrefs: 00007FFDFF211E48

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: call$choice$echo$errorlevel$exist$goto$loadhigh$prompt$rem$set$start
API String ID: 0-3690992575
Opcode ID: fb2f72c92d7e77a6cb69b554a048e5211f155d563d9d40b7a79813fa717d9055
Instruction ID: 7ec70143b4f8f4a9095ba6fd583c13d223c97f167c54f4699c9419ebb0b6a565
Opcode Fuzzy Hash: fb2f72c92d7e77a6cb69b554a048e5211f155d563d9d40b7a79813fa717d9055
Instruction Fuzzy Hash: FC72F322B0C28666FB208E159074BBD6792BB45784F441231EABEC76CDDFBDE545C708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DCF48 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 343COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32 ref: 00007FFDFF1DCF93
CreateDIBSection.GDI32 ref: 00007FFDFF1DD066
SelectObject.GDI32 ref: 00007FFDFF1DD07A
SelectObject.GDI32 ref: 00007FFDFF1DD3FD
DeleteObject.GDI32 ref: 00007FFDFF1DD40B
DeleteDC.GDI32 ref: 00007FFDFF1DD414
FrameRect.USER32 ref: 00007FFDFF1DD48A

Strings

(, xrefs: 00007FFDFF1DCFE3

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Object$CreateDeleteSelect$CompatibleFrameRectSection
String ID: (
API String ID: 3454737074-3887548279
Opcode ID: 7718ed8e86ca21d2ae9df324f9424b9f23c288b90b17f83c44061518bf612cdf
Instruction ID: faa8585993b9c34cc1174588c7fb955f6c18a6b67594cd5bfffcec07e67f956d
Opcode Fuzzy Hash: 7718ed8e86ca21d2ae9df324f9424b9f23c288b90b17f83c44061518bf612cdf
Instruction Fuzzy Hash: B5D190B3B197D58AC364CF19E440BAAB7A5F799780F044229DA9987F58DB3CE444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22DB70 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDFF22FC13
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFF22FC32
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFF22FC7E
IsDebuggerPresent.KERNEL32 ref: 00007FFDFF22FCF0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF22FD08
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF22FD15
GetCurrentProcess.KERNEL32 ref: 00007FFDFF22FD2E
TerminateProcess.KERNEL32 ref: 00007FFDFF22FD3C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 7c1035404f81da8873fcb7d32fc1a852b9de1c1d07edfc00c6e294ca62eefff7
Instruction ID: ca27da26e541a347c1c17cabad7d2aa096390f1429e4d1a403b967bf221519d2
Opcode Fuzzy Hash: 7c1035404f81da8873fcb7d32fc1a852b9de1c1d07edfc00c6e294ca62eefff7
Instruction Fuzzy Hash: D931F671A09B42C5F7509B14F4A0B6973A4FB86750F900235D9BDC6BA9DFBCE284C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1FB64C Relevance: 11.9, Strings: 9, Instructions: 694COMMON

Download Yara Rule

Strings

///, xrefs: 00007FFDFF1FBFEC
, xrefs: 00007FFDFF1FBAA9
/*!, xrefs: 00007FFDFF1FBF77
+, xrefs: 00007FFDFF1FB93C
*, xrefs: 00007FFDFF1FBFD6
/, xrefs: 00007FFDFF1FBFCE
////, xrefs: 00007FFDFF1FC001
//!, xrefs: 00007FFDFF1FC016
/**, xrefs: 00007FFDFF1FBF62

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $*$+$/$/*!$/**$//!$///$////
API String ID: 0-689628245
Opcode ID: 9090b670076be6ef2eea28bed1931a44d22e96e3b4f490fd8a6cab143e754d9b
Instruction ID: 91572f652abb6bf3731cc094e935ccdf39cabe8b4dbadd30dc2ad26ab61200b9
Opcode Fuzzy Hash: 9090b670076be6ef2eea28bed1931a44d22e96e3b4f490fd8a6cab143e754d9b
Instruction Fuzzy Hash: 08525223F0C28386EB70DB1590A4A7E6760FB86B44F144235DB7A47AE9DF7DE8449B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1F4E54 Relevance: 11.8, Strings: 9, Instructions: 598COMMON

Download Yara Rule

Strings

)]};,'"`#, xrefs: 00007FFDFF1F52B1
lexer.caml.magic, xrefs: 00007FFDFF1F4F01
*, xrefs: 00007FFDFF1F5384
*, xrefs: 00007FFDFF1F534E
bBoOxX, xrefs: 00007FFDFF1F515F
!$%&*+-./:<=>?@^|~, xrefs: 00007FFDFF1F52C8
)]};,, xrefs: 00007FFDFF1F52E5
, xrefs: 00007FFDFF1F5374
!?~=<>@^|&+-*/$%()[]{};,:.#, xrefs: 00007FFDFF1F5265

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $!$%&*+-./:<=>?@^|~$!?~=<>@^|&+-*/$%()[]{};,:.#$)]};,$)]};,'"`#$*$*$bBoOxX$lexer.caml.magic
API String ID: 0-4014405382
Opcode ID: dc68437cffff64adcf2dc3e6e63ffadfc6f29ad70e8035e9aa801464299ade1a
Instruction ID: 736dd2545f3efbef50d76420333081e17b1d8294cc68407ce9e8a18d42110e0f
Opcode Fuzzy Hash: dc68437cffff64adcf2dc3e6e63ffadfc6f29ad70e8035e9aa801464299ade1a
Instruction Fuzzy Hash: D532C033F0C68286FB60CA15D064A7A7BA1FB85B98F540235D67E46ADDDF7DE8418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2026E0 Relevance: 11.7, Strings: 9, Instructions: 427COMMON

Download Yara Rule

Strings

qualified, xrefs: 00007FFDFF2028B2
, xrefs: 00007FFDFF202B96
, xrefs: 00007FFDFF202B8E
data, xrefs: 00007FFDFF202A12
, xrefs: 00007FFDFF202D06
module, xrefs: 00007FFDFF202A6C
class, xrefs: 00007FFDFF202954
import, xrefs: 00007FFDFF202A4E
instance, xrefs: 00007FFDFF202A30

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $ $class$data$import$instance$module$qualified
API String ID: 0-2113066623
Opcode ID: 07bef6d0d5aa546e66d63c677f37498b2bcfc35d13988c32c8aa83657df686f3
Instruction ID: cdbcaa60f1c1c6bd444854ceda0e559678aca76f0cebeb3e09284309fc152a1b
Opcode Fuzzy Hash: 07bef6d0d5aa546e66d63c677f37498b2bcfc35d13988c32c8aa83657df686f3
Instruction Fuzzy Hash: A202AE23B0C24646EB608A14D0A0BBE6B61EB85744F594233EA7DC76DDDFBDE8458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF235E38 Relevance: 10.6, APIs: 7, Instructions: 138COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FFDFF235E7E
_errno.LIBCMT ref: 00007FFDFF235EEC
_errno.LIBCMT ref: 00007FFDFF235EF7
_errno.LIBCMT ref: 00007FFDFF235F2B
WideCharToMultiByte.KERNEL32 ref: 00007FFDFF235FC6
GetLastError.KERNEL32 ref: 00007FFDFF235FE6
_errno.LIBCMT ref: 00007FFDFF23600C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: _errno$ByteCharErrorLastMultiWide
String ID:
API String ID: 3895584640-0
Opcode ID: 1a12ca6371de6c14788f646b0550fb972380e5c9f179bd6164d10f1c45dcf1e7
Instruction ID: 0e89bfdfd38753a4a8906132fde5a5979854c836ec0c814711c2868561ce20c6
Opcode Fuzzy Hash: 1a12ca6371de6c14788f646b0550fb972380e5c9f179bd6164d10f1c45dcf1e7
Instruction Fuzzy Hash: 515181B2B0C6C24AE7709F65E161A7DB790EB81B50F584235E6BDCAACDCE7C94818701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22970C Relevance: 10.4, Strings: 8, Instructions: 386COMMON

Download Yara Rule

Strings

lexer.tex.comment.process, xrefs: 00007FFDFF229764
i, xrefs: 00007FFDFF2299B9
lexer.tex.use.keywords, xrefs: 00007FFDFF22977B
, xrefs: 00007FFDFF229C5B
f, xrefs: 00007FFDFF2299C0
lexer.tex.auto.if, xrefs: 00007FFDFF229796
newif, xrefs: 00007FFDFF229994
lexer.tex.interface.default, xrefs: 00007FFDFF2297B1

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $f$i$lexer.tex.auto.if$lexer.tex.comment.process$lexer.tex.interface.default$lexer.tex.use.keywords$newif
API String ID: 0-3038620678
Opcode ID: da08516ddb15a79067723fa2279f24a06a42532b98048714e10d95db4c698ab6
Instruction ID: 20a66923ce7664bfca0285af51383bb3e6648b4cac4fab1df2916f3ebd711eda
Opcode Fuzzy Hash: da08516ddb15a79067723fa2279f24a06a42532b98048714e10d95db4c698ab6
Instruction Fuzzy Hash: E3F19032B0864686FB24CF19D0A0B6D77A1EB89B84F854131DEA9C37EDCE3DE5459B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF21CC88 Relevance: 9.5, Strings: 7, Instructions: 759COMMON

Download Yara Rule

Strings

""", xrefs: 00007FFDFF21D1B2
class, xrefs: 00007FFDFF21D026
import, xrefs: 00007FFDFF21D072
''', xrefs: 00007FFDFF21D164
\, xrefs: 00007FFDFF21D348
tab.timmy.whinge.level, xrefs: 00007FFDFF21CD15
def, xrefs: 00007FFDFF21D04D

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: """$'''$\$class$def$import$tab.timmy.whinge.level
API String ID: 0-2586483003
Opcode ID: 8b09a8c27619edc4ab8fa275824f8457dcb4ada8f1bc9c35db739b3df156edc2
Instruction ID: 9b25901a4c07ea2d3ad11b383abe60e979d5e53c5d499d141917050c426b6059
Opcode Fuzzy Hash: 8b09a8c27619edc4ab8fa275824f8457dcb4ada8f1bc9c35db739b3df156edc2
Instruction Fuzzy Hash: 1C62A632B0C646D6D7608B189090A7EB7A0FB85740F914232EAB9C3ADDEE7DE445CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1EF720 Relevance: 8.7, Strings: 6, Instructions: 1158COMMON

Download Yara Rule

Strings

#comments, xrefs: 00007FFDFF1EFA67, 00007FFDFF1EFFF7
#comments-start, xrefs: 00007FFDFF1EFAB9, 00007FFDFF1F0640
#ce, xrefs: 00007FFDFF1EFE1D, 00007FFDFF1F0013
#include, xrefs: 00007FFDFF1EFA7F, 00007FFDFF1EFB83
#cs, xrefs: 00007FFDFF1EFA9D, 00007FFDFF1F0622
#comments-end, xrefs: 00007FFDFF1EFE2F, 00007FFDFF1F002B

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: #ce$#comments$#comments-end$#comments-start$#cs$#include
API String ID: 0-3757738668
Opcode ID: 4e02c94c5724d114cd4bdda8eecd6b9784156b4a15a455fbc4c96bcb090894ed
Instruction ID: b275766072ed8cb8ab186e0ac8f3b0318d21b066c3e51243e56a0d7565c6059c
Opcode Fuzzy Hash: 4e02c94c5724d114cd4bdda8eecd6b9784156b4a15a455fbc4c96bcb090894ed
Instruction Fuzzy Hash: 23A2E023F1CA8685EB748B14C0A4BBD6791AB85B84F444232DABD437DDDF6CE845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1F5794 Relevance: 8.3, Strings: 6, Instructions: 804COMMON

Download Yara Rule

Strings

BOHboh, xrefs: 00007FFDFF1F6196
ABCDEF, xrefs: 00007FFDFF1F6176
DEKNPSTdeknpst, xrefs: 00007FFDFF1F6347
DEKNPST, xrefs: 00007FFDFF1F6372
BOH, xrefs: 00007FFDFF1F61A2
ABCDEFabcdef, xrefs: 00007FFDFF1F616A

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: ABCDEF$ABCDEFabcdef$BOH$BOHboh$DEKNPST$DEKNPSTdeknpst
API String ID: 0-3669997280
Opcode ID: 0a7feb1bef95c4787201762b94c90f9922fab89947907de9a0f95a0797a1112a
Instruction ID: 8c49a3f39fb1f4f3cd552d502f3e274a926923615766d7662387fe64e34ea36c
Opcode Fuzzy Hash: 0a7feb1bef95c4787201762b94c90f9922fab89947907de9a0f95a0797a1112a
Instruction Fuzzy Hash: A9829133F1C6C28AE7608B15D050AAEB7A1FB85B44F444136DAAE47ADDDF7DE8418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF20D590 Relevance: 7.9, Strings: 6, Instructions: 410COMMON

Download Yara Rule

Strings

btex, xrefs: 00007FFDFF20D792
=, xrefs: 00007FFDFF20D8ED
verbatimtex, xrefs: 00007FFDFF20D7AB
lexer.metapost.interface.default, xrefs: 00007FFDFF20D5F9
etex, xrefs: 00007FFDFF20D7C5
lexer.metapost.comment.process, xrefs: 00007FFDFF20D5E8

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: =$btex$etex$lexer.metapost.comment.process$lexer.metapost.interface.default$verbatimtex
API String ID: 0-377892542
Opcode ID: f441eb180525576fc67aa8b05d37a707f0dc1f746b7439eeda97255033013b9b
Instruction ID: 941e5a5fdb94cea0e8136b7f7e2d351b73c8398952c3e3dd63442d16ea00e4f3
Opcode Fuzzy Hash: f441eb180525576fc67aa8b05d37a707f0dc1f746b7439eeda97255033013b9b
Instruction Fuzzy Hash: A2F19233B0D24246EB248A19D0A0B7D67A1EB85B44F885235DA7DC77EDEF3CE5458B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF21B8C0 Relevance: 7.2, Strings: 5, Instructions: 981COMMON

Download Yara Rule

Strings

ps.tokenize, xrefs: 00007FFDFF21B955
ps.level, xrefs: 00007FFDFF21B966
, xrefs: 00007FFDFF21C4A0
, xrefs: 00007FFDFF21C4A8
, xrefs: 00007FFDFF21C498

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $ $ps.level$ps.tokenize
API String ID: 0-2005195314
Opcode ID: 7f1a490fdc0a7c2c99582f44f06f696927923bf050279aa0ce60b591176f6661
Instruction ID: 2614f4f3534cfe6b44a79bdc84d38d28b483225f63fa57a5d837516651da1fdb
Opcode Fuzzy Hash: 7f1a490fdc0a7c2c99582f44f06f696927923bf050279aa0ce60b591176f6661
Instruction Fuzzy Hash: 6792C836B0C28296EB748A1990A4A7D77B0FB89740F251135EA79C77ECCE7DE844CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF224020 Relevance: 6.8, Strings: 5, Instructions: 580COMMON

Download Yara Rule

Strings

--!, xrefs: 00007FFDFF22472F
, xrefs: 00007FFDFF2243B6
, xrefs: 00007FFDFF2243BE
, xrefs: 00007FFDFF22488E
//!, xrefs: 00007FFDFF2246DC

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $ $--!$//!
API String ID: 0-857175557
Opcode ID: 4dec65035ad96f4dcc670ee5b78e97c7d18b96c04646a5443018137097944281
Instruction ID: 7083d30c9fba8e2e4f03a57912e0eefd4685c58973f8cfe941eae474d2073396
Opcode Fuzzy Hash: 4dec65035ad96f4dcc670ee5b78e97c7d18b96c04646a5443018137097944281
Instruction Fuzzy Hash: 03426532B1C2828AFB608B1590D066DB760FB95744F550136EFBAC76DEDABDE4408F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22AFA4 Relevance: 5.5, Strings: 4, Instructions: 498COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF22B6DB
, xrefs: 00007FFDFF22B313
//!, xrefs: 00007FFDFF22B552
, xrefs: 00007FFDFF22B30B

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $ $//!
API String ID: 0-3383868062
Opcode ID: 0eb00d5e2403a9461c3f047257537bd5896c1199f1cf93d0595cd01ecf982b97
Instruction ID: 3757a637a157282d55e66cc53de537b8d4a283aefaee4abbc63c71c8149c945d
Opcode Fuzzy Hash: 0eb00d5e2403a9461c3f047257537bd5896c1199f1cf93d0595cd01ecf982b97
Instruction Fuzzy Hash: A122A532F1C2418AFB608B1590A0A7EA7A0FB89744F545131EF7AC7AE9DA7DE440CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1F1B94 Relevance: 5.4, Strings: 4, Instructions: 432COMMON

Download Yara Rule

Strings

dllusage, xrefs: 00007FFDFF1F1EEA
, xrefs: 00007FFDFF1F21B2
enddllusage, xrefs: 00007FFDFF1F1DB8
styling.within.preprocessor, xrefs: 00007FFDFF1F1BE0

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $dllusage$enddllusage$styling.within.preprocessor
API String ID: 0-1789709456
Opcode ID: 37b55eb77b09d4164ef2d46050aa061280283c8b1356a6db6ed5dfd2719b86f1
Instruction ID: 508a971483ac37f8a3b5cce9a27d715664f5c42924f967754281ab6b282b4d0c
Opcode Fuzzy Hash: 37b55eb77b09d4164ef2d46050aa061280283c8b1356a6db6ed5dfd2719b86f1
Instruction Fuzzy Hash: E1029633F1C6C28AE7608A1590A0A6EB7B1FB85744F141236EBBA576DDCB7DE4418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1FDBB4 Relevance: 5.4, Strings: 4, Instructions: 408COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF1FE17C
, xrefs: 00007FFDFF1FDE88
escript.case.sensitive, xrefs: 00007FFDFF1FDC19
, xrefs: 00007FFDFF1FDE90

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $ $escript.case.sensitive
API String ID: 0-3830128347
Opcode ID: da2b7c025c2134ae6c5b9ec97366906e074ba539234e36b89f6997972daf9371
Instruction ID: 0f68abb746d076e91dd6484849e7a0e5c34fd9c9c6af94bdb5563903517aa662
Opcode Fuzzy Hash: da2b7c025c2134ae6c5b9ec97366906e074ba539234e36b89f6997972daf9371
Instruction Fuzzy Hash: 3602A633E1C2C68AEB608B15D0A0A7EB760FB85754F150236EBBA076DDDB7DE4418B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22A768 Relevance: 4.3, Strings: 3, Instructions: 515COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFDFF22AD1E
rem, xrefs: 00007FFDFF22A9C7
, xrefs: 00007FFDFF22AF00

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $d$rem
API String ID: 0-4059199007
Opcode ID: 27f449a0d0617556573bb0ab85b0dbcf4b835495cf008959066cee3c7289ebe8
Instruction ID: f52d67a12fbd69245a3f662e6c855afd36558ecc22b87f598c844023d249e1bc
Opcode Fuzzy Hash: 27f449a0d0617556573bb0ab85b0dbcf4b835495cf008959066cee3c7289ebe8
Instruction Fuzzy Hash: 6222D532A1C2418AF7609B1590A067EB7A0FB95740F900176EFBAC7ECDDA7DE4418F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1FE87C Relevance: 4.2, Strings: 3, Instructions: 467COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF1FEEEF
, xrefs: 00007FFDFF1FEB17
, xrefs: 00007FFDFF1FEB23

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $
API String ID: 0-3665324030
Opcode ID: 5ee9cb9672b69ab0a00fe389fb0435900095660fe03f575474fa449b5141ddb6
Instruction ID: 61888f71b687051a8064d3f357f395935439d331badd966b5345eb81f2100255
Opcode Fuzzy Hash: 5ee9cb9672b69ab0a00fe389fb0435900095660fe03f575474fa449b5141ddb6
Instruction Fuzzy Hash: AE12A433F081D28AEB748A1590A0ABF67A0FBC5744F140135EA7A47ADDDF7DE8458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1EE8F0 Relevance: 4.2, Strings: 3, Instructions: 425COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF1EEF52
, xrefs: 00007FFDFF1EECEF
, xrefs: 00007FFDFF1EECE7

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $ $
API String ID: 0-3665324030
Opcode ID: 05263eae233d3d1e30ec7b47e90899490fe0b1df79b710a19c8071f668f816eb
Instruction ID: 641715829592b21e48ced8231d8601d1388778b250823522efe836304763b539
Opcode Fuzzy Hash: 05263eae233d3d1e30ec7b47e90899490fe0b1df79b710a19c8071f668f816eb
Instruction Fuzzy Hash: 49124027A1C2828AE7608B15E06076FBBA1F7C5744F155136EBAA07ADDDBFDE4448F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1F2598 Relevance: 3.7, Strings: 2, Instructions: 1208COMMON

Download Yara Rule

Strings

rwxoRWXOezsfdlpSbctugkTBMACahGLNn, xrefs: 00007FFDFF1F3559
C, xrefs: 00007FFDFF1F334E

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: malloc
String ID: C$rwxoRWXOezsfdlpSbctugkTBMACahGLNn
API String ID: 2803490479-4287770927
Opcode ID: c264da48566c5e06910ff0e572ec0ea9590b8fd8a5affa5ba454b069b5e7e910
Instruction ID: cc81a1bebba2c5fbdea9b3d8ec5ca4abb4930a7478d50be579d3aac551bfdfaf
Opcode Fuzzy Hash: c264da48566c5e06910ff0e572ec0ea9590b8fd8a5affa5ba454b069b5e7e910
Instruction Fuzzy Hash: D4B2AD27F0D6C286EB788A15C1A4B7D67A0BB45780F145235CA7E57BE8CFBDE8418B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF20BA2C Relevance: 3.3, Strings: 2, Instructions: 821COMMON

Download Yara Rule

Strings

:, xrefs: 00007FFDFF20BFA0
, xrefs: 00007FFDFF20C31C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $:
API String ID: 0-4041779174
Opcode ID: f725205291d96a23e0f2b2817a15d8ecd4bc77d6e353e59a15cb298e65a1df63
Instruction ID: e47f404e23056ca65184165bb9a48c410e175b97c24c27c03ab4e32bb8c1b62c
Opcode Fuzzy Hash: f725205291d96a23e0f2b2817a15d8ecd4bc77d6e353e59a15cb298e65a1df63
Instruction Fuzzy Hash: 30729363A1C1818AD7308F1990A0B6EB7A1FB85744F184135EBBAD7BADDA7DE4448F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1FF9C8 Relevance: 3.2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF1FFF38
$, xrefs: 00007FFDFF2001E8

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $$
API String ID: 0-182950533
Opcode ID: 1fe377d165e5c276245ebdbbdf86243b3c276fa34708031b31aca675025253c1
Instruction ID: ddee0aa30bccce541c45c1a8312661d2b65efacc8d6bd859b5ce5eebd17e21c4
Opcode Fuzzy Hash: 1fe377d165e5c276245ebdbbdf86243b3c276fa34708031b31aca675025253c1
Instruction Fuzzy Hash: 05625133F1C5828AE760CB15D0A0B6DA7A1FB85744F154232EABA876DDCB7DE4458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF21993C Relevance: 3.1, Strings: 2, Instructions: 611COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF21A216
abfnrtuv0'", xrefs: 00007FFDFF219DBF

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $abfnrtuv0'"
API String ID: 0-3061920473
Opcode ID: 4711d3e339b8790fe53df79310a0c16a55ff78fc6f2ff465371b9b4b8e2f5972
Instruction ID: ef2d727df3bd222c085a1d501ef244d2afbee22ad07aa66a2af75dedafbf1398
Opcode Fuzzy Hash: 4711d3e339b8790fe53df79310a0c16a55ff78fc6f2ff465371b9b4b8e2f5972
Instruction Fuzzy Hash: 7B428132B1C2819ADB608F14E0906AEB7A1FB89744F144136EAAEC779DDE7DE444CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF214598 Relevance: 3.1, Strings: 2, Instructions: 564COMMON

Download Yara Rule

Strings

*, xrefs: 00007FFDFF214CA6
\, xrefs: 00007FFDFF214C62

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: *$\
API String ID: 0-1504634461
Opcode ID: 595e4e777af853315660251ba1662c0ea4e854a500caa4589aa9a21dad669947
Instruction ID: 1a2a8bf8937a2039a82f78a3570eb8f6c1e91c2d628094306dfa6ff4522c299f
Opcode Fuzzy Hash: 595e4e777af853315660251ba1662c0ea4e854a500caa4589aa9a21dad669947
Instruction Fuzzy Hash: 5622E226F0D686A6EB748615C1F0F7E63A1AB47B80F254232CA7DC3BD8CF2DA4458745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF20EE70 Relevance: 3.0, Strings: 2, Instructions: 503COMMON

Download Yara Rule

Strings

fold, xrefs: 00007FFDFF20EEB0
, xrefs: 00007FFDFF20F33E

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: $fold
API String ID: 0-1551796345
Opcode ID: c6519654d9765e1a713b6d9046943239349dc4c0afef831271d12e6bb83add2f
Instruction ID: c9d6f747b6c2c6c1dc648c49b0d500579680c60a7a368eb2157f868e2f0bfd64
Opcode Fuzzy Hash: c6519654d9765e1a713b6d9046943239349dc4c0afef831271d12e6bb83add2f
Instruction Fuzzy Hash: 4D22D12374C6828AEB648B15C1A8B7D7791FB45B80F484236DA7EC3BD9CF3DA5848701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22764C Relevance: 3.0, Strings: 2, Instructions: 467COMMON

Download Yara Rule

Strings

..., xrefs: 00007FFDFF227A68
/, xrefs: 00007FFDFF227892

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: ...$/
API String ID: 0-2429815136
Opcode ID: 6769d04b7ed8c0f83f004346decc81e40639d3ed75433465f5b922d4d3b48b79
Instruction ID: d6dc6c1f018a39bb2053f4b60316db547e31b9d38748ee2672d4dc2487c1562a
Opcode Fuzzy Hash: 6769d04b7ed8c0f83f004346decc81e40639d3ed75433465f5b922d4d3b48b79
Instruction Fuzzy Hash: BF126632B1C24286F7648A1590A0A7EB761FB96700F944236EBB9C7ADDCB7DE441CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF21D7DC Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

fold.comment.python, xrefs: 00007FFDFF21D82B
fold.quotes.python, xrefs: 00007FFDFF21D848

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: fold.comment.python$fold.quotes.python
API String ID: 0-3821945798
Opcode ID: 0b493983a66bbb11e84a885d403ca8cc54834dcd59a032aff09496e23476567c
Instruction ID: 39044933715d2aee97fb9df6f74ca8f79aad22bb4ac3ed5cf33459fd2b7ef6d8
Opcode Fuzzy Hash: 0b493983a66bbb11e84a885d403ca8cc54834dcd59a032aff09496e23476567c
Instruction Fuzzy Hash: 67D19672B1C68296EB748E25905477A77A1FB88B84F404235DEAED77C8EF7CD8058B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1CCB70 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

%2X, xrefs: 00007FFDFF1CD1E7

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: %2X
API String ID: 0-1225248942
Opcode ID: 4f9758f81b4905d2ad776ca43407c5c16c45cb2ec4b700ad1625e99494fe8b04
Instruction ID: e53f6cb137d080037bf3a5a1dd94fcb976705626a5f67508c097e48c5660c8a4
Opcode Fuzzy Hash: 4f9758f81b4905d2ad776ca43407c5c16c45cb2ec4b700ad1625e99494fe8b04
Instruction Fuzzy Hash: 8D629F73B0868586EB258F25D160ABE7BA1F785B84F014236CF7D47B99DB39E851CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1F4740 Relevance: 1.8, Strings: 1, Instructions: 503COMMON

Download Yara Rule

Strings

fold, xrefs: 00007FFDFF1F477A

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: fold
API String ID: 0-4279597620
Opcode ID: 7ec73794d23c22ae01a0819b377ab828887eb23dc7742cce6b404c2246086a6f
Instruction ID: d7e1148695cfb2a7d8f9d9828c80970cb49481763f568897e071dec404386dad
Opcode Fuzzy Hash: 7ec73794d23c22ae01a0819b377ab828887eb23dc7742cce6b404c2246086a6f
Instruction Fuzzy Hash: 60227F27F086C686EB748A15C2E0B7D73A1BB49B80F109231CA7E437D9DF7DA4658B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1EDAA0 Relevance: 1.7, Strings: 1, Instructions: 492COMMON

Download Yara Rule

Strings

\, xrefs: 00007FFDFF1EDF66

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: f84b303a02f693f1a325f92f1811e06099e4ff828af955822082b3e8444908f6
Instruction ID: 741e7d0bdf251acf324c187fb900fb02305ac52f6f86c3c5ab9b4b0c9428f802
Opcode Fuzzy Hash: f84b303a02f693f1a325f92f1811e06099e4ff828af955822082b3e8444908f6
Instruction Fuzzy Hash: DB12A433F0824649FB648B149064B7E77A1EB85780F490236DABD436DDEFADF8858B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1F9EC0 Relevance: 1.7, Strings: 1, Instructions: 465COMMON

Download Yara Rule

Strings

\, xrefs: 00007FFDFF1F9F98

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 3fc161fc9560a275d0101214f3c3824a1291edb4bd9b0b9a2a60dd205657452d
Instruction ID: 09440c0af999e11624970dc2a7c613f1a3f834106a53df1ef5287ed62adb07db
Opcode Fuzzy Hash: 3fc161fc9560a275d0101214f3c3824a1291edb4bd9b0b9a2a60dd205657452d
Instruction Fuzzy Hash: 7612BD27F1C1D28AFB608A18D068B7D77A1AB95780F490376DAB9436DDDF2DE8418B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1C6B24 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

$, xrefs: 00007FFDFF1C6D5F

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: malloc
String ID: $
API String ID: 2803490479-3993045852
Opcode ID: fb0ab97de536bff04d1ad8d168f48439ed197266f1a0bb6b331c842296749b67
Instruction ID: 2f84a7fa0f405384368c5380027a9c5d14a7edf949baaaba762c77493e9a5b2f
Opcode Fuzzy Hash: fb0ab97de536bff04d1ad8d168f48439ed197266f1a0bb6b331c842296749b67
Instruction Fuzzy Hash: 60F10023F0C2D646E7719A2590A0BFE77A2BB45B84F444235DABD43AC9DF7DE8548B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1EB7F8 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

E, xrefs: 00007FFDFF1EB8F3

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: d9eb8611ef28812f1dd7945a439b9727dd00f2ed138854082ac1fde500faa697
Instruction ID: ec1d5ba038cf9843aef48cee67b4d3f3f83017d73633467bc021ee59b2a5c2ac
Opcode Fuzzy Hash: d9eb8611ef28812f1dd7945a439b9727dd00f2ed138854082ac1fde500faa697
Instruction Fuzzy Hash: B4026B23F5D24685FB74CB159064BBAB7A1AB89784F440232DABD036EDCF6CF8448B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1FC49C Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

%, xrefs: 00007FFDFF1FC61F

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: c1580c9f5b80937968c6fe9180bd339c3398576dc338a7aadabf2a705d94e310
Instruction ID: 4ef72bff74d0f2a860e58dcbdfab21245add2be6eb740c7a8f46f67abb7d5a78
Opcode Fuzzy Hash: c1580c9f5b80937968c6fe9180bd339c3398576dc338a7aadabf2a705d94e310
Instruction Fuzzy Hash: C2E1A933F1C6C28AEB648A16A090A7D67A0FB89744F150232EB7A436DCDF7DE5419F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF21DC84 Relevance: 1.6, Strings: 1, Instructions: 355COMMON

Download Yara Rule

Strings

\, xrefs: 00007FFDFF21DE77

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 40fac78e7493baf75f26bc0d98c81d12b107521c65f6e7e244002245ca03b793
Instruction ID: 8d05ba33ab22b7b6fd100fa966efe09523e35a2fbf73da6984d46dec6e395289
Opcode Fuzzy Hash: 40fac78e7493baf75f26bc0d98c81d12b107521c65f6e7e244002245ca03b793
Instruction Fuzzy Hash: 61E1FA32B1C6429AEB748A1494E0B7D63A0FB86740F550136DA7EC36DDEE7EF8408B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22BDE4 Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF22C285

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 83c5f75d2101a5a85edad5b8b5a2801bfb490ce416e20205d49c12278e8ed33d
Instruction ID: 2507635eb404b6700a8dea9f47463b08676d0195d7d5ca7922f247e90870ff0c
Opcode Fuzzy Hash: 83c5f75d2101a5a85edad5b8b5a2801bfb490ce416e20205d49c12278e8ed33d
Instruction Fuzzy Hash: 32E18132B1C6828AFB608B19D090BADA760FB85754F904132EFA9877DDDF7DE5448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF23605C Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 00007FFDFF236084

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 282329815c33d5fe623b8cb2dfa9c23466bafef5bc01abb3ac81ecd6f032d96c
Instruction ID: 1c5504314255d6c42cfe30d2eae380f9fdc4434a125844b6107304774f93a0bb
Opcode Fuzzy Hash: 282329815c33d5fe623b8cb2dfa9c23466bafef5bc01abb3ac81ecd6f032d96c
Instruction Fuzzy Hash: 77E06561B0C98181F7309720E472BAA27A1BF99758FD00332D9BCC66EDDE2CE241CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1D3FBC Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd53065a9217e3980c37039b9884ad4969059d10391a594366ad0bb576eeb275
Instruction ID: 06278dcbef8af31fdaf2168122bf012da7c4fb5ad0a1564fc551dda9260ed29b
Opcode Fuzzy Hash: bd53065a9217e3980c37039b9884ad4969059d10391a594366ad0bb576eeb275
Instruction Fuzzy Hash: 93327123F0928285F7649A2985F5EBD23A2EB95744F248331D93D476DECF3EE8528740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF20979C Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04e6f144aaf4c78402c0fe9803503de31614e887a05bfc903f3db7bb64facd1
Instruction ID: 400d13ed3d7b5bdd64cff73cb121babdca38d6c2b2dd3408631a6fdd8e1a2b2f
Opcode Fuzzy Hash: e04e6f144aaf4c78402c0fe9803503de31614e887a05bfc903f3db7bb64facd1
Instruction Fuzzy Hash: D0229022B0C6478AFB748E1590B8B7D73A0EB49B50F194236CA7FC77D9DE2DA8458341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF20CB48 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f74a11bf79d2bd0550db7feb1df278cf5a8cf63a3c27013945ec9b4172f974
Instruction ID: 2a99ddd56a2b97908294ab2f8578d7f73908d74c5bf7d9ba8d94de583b2da830
Opcode Fuzzy Hash: 19f74a11bf79d2bd0550db7feb1df278cf5a8cf63a3c27013945ec9b4172f974
Instruction Fuzzy Hash: 18E1A373B0C2428AEB608B19D0A4B7E77A0EF85744F190232DA79C3ADDDE7DE4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1EADD4 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e623b771e6882b3f23352b553471dea90f87691287affa57beb56d70d50a3ca6
Instruction ID: 35d75dad00db9f5ff5fb418f21e9da151761f09387d92ce34f1bcb05baa77d12
Opcode Fuzzy Hash: e623b771e6882b3f23352b553471dea90f87691287affa57beb56d70d50a3ca6
Instruction Fuzzy Hash: CBC11273F0858556E764DF248164BBD2BA0EB45B84F54833AC67A87AD9DF2DF0168300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF21A644 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b775fdd8e3178838117b6d97ad8f967db1b9bccc76efc7727d91ad4db192b264
Instruction ID: 8ea804a2c4c83290ccdd5dfbcc16b22e803d70539fe171b7a6523c18a5241d8b
Opcode Fuzzy Hash: b775fdd8e3178838117b6d97ad8f967db1b9bccc76efc7727d91ad4db192b264
Instruction Fuzzy Hash: 5BB1A132B0C2429AEB608B15D0A0B7D63A1EB85B44F514176DAB9C7ACDDF3DE4468F05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF22EB70 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d51b54366542bde79496863fdd82e37a0756f1abe4cdb5d05788124cbebdaff
Instruction ID: e82bd100cf503390f30e52dac81addc96a93d7ee060fba7dbbe06933654eb2ab
Opcode Fuzzy Hash: 3d51b54366542bde79496863fdd82e37a0756f1abe4cdb5d05788124cbebdaff
Instruction Fuzzy Hash: 2B41C842F0AEAA04FB658D9C4534BB417809F227A4FE813B8CCB9D77DBCC0D65479101

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2349F0 Relevance: 53.8, APIs: 43, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFDFF234A05

Part of subcall function 00007FFDFF22FD4C: HeapFree.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD62
Part of subcall function 00007FFDFF22FD4C: _errno.LIBCMT ref: 00007FFDFF22FD6C
Part of subcall function 00007FFDFF22FD4C: GetLastError.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD74

free.LIBCMT ref: 00007FFDFF234A0E
free.LIBCMT ref: 00007FFDFF234A17
free.LIBCMT ref: 00007FFDFF234A20
free.LIBCMT ref: 00007FFDFF234A29
free.LIBCMT ref: 00007FFDFF234A32
free.LIBCMT ref: 00007FFDFF234A3A
free.LIBCMT ref: 00007FFDFF234A43
free.LIBCMT ref: 00007FFDFF234A4C
free.LIBCMT ref: 00007FFDFF234A55
free.LIBCMT ref: 00007FFDFF234A5E
free.LIBCMT ref: 00007FFDFF234A67
free.LIBCMT ref: 00007FFDFF234A70
free.LIBCMT ref: 00007FFDFF234A79
free.LIBCMT ref: 00007FFDFF234A82
free.LIBCMT ref: 00007FFDFF234A8B
free.LIBCMT ref: 00007FFDFF234A97
free.LIBCMT ref: 00007FFDFF234AA3
free.LIBCMT ref: 00007FFDFF234AAF
free.LIBCMT ref: 00007FFDFF234ABB
free.LIBCMT ref: 00007FFDFF234AC7
free.LIBCMT ref: 00007FFDFF234AD3
free.LIBCMT ref: 00007FFDFF234ADF
free.LIBCMT ref: 00007FFDFF234AEB
free.LIBCMT ref: 00007FFDFF234AF7
free.LIBCMT ref: 00007FFDFF234B03
free.LIBCMT ref: 00007FFDFF234B0F
free.LIBCMT ref: 00007FFDFF234B1B
free.LIBCMT ref: 00007FFDFF234B27
free.LIBCMT ref: 00007FFDFF234B33
free.LIBCMT ref: 00007FFDFF234B3F
free.LIBCMT ref: 00007FFDFF234B4B
free.LIBCMT ref: 00007FFDFF234B57
free.LIBCMT ref: 00007FFDFF234B63
free.LIBCMT ref: 00007FFDFF234B6F
free.LIBCMT ref: 00007FFDFF234B7B
free.LIBCMT ref: 00007FFDFF234B87
free.LIBCMT ref: 00007FFDFF234B93
free.LIBCMT ref: 00007FFDFF234B9F
free.LIBCMT ref: 00007FFDFF234BAB
free.LIBCMT ref: 00007FFDFF234BB7
free.LIBCMT ref: 00007FFDFF234BC3
free.LIBCMT ref: 00007FFDFF234BCF

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: c827e5dd2de503780ca73d1a3315debbfb4803c72b1e63681b510c6d81b702eb
Instruction ID: 63b45836155e64c62801f944999d1e4cd27d75a4dfda0f13fd2bd62d204560b2
Opcode Fuzzy Hash: c827e5dd2de503780ca73d1a3315debbfb4803c72b1e63681b510c6d81b702eb
Instruction Fuzzy Hash: 83417522B1554181FB49ABB5C8616BC3331AF84B44F444A31DD7DCF5EBCE14D95583A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF234E20 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 130libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234E5D
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234E79
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234EA1
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234EAA
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234EC0
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234EC9
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234EDF
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234EE8
GetProcAddress.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234F06
EncodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234F0F
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234F41
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234F50
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234FA8
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234FC8
DecodePointer.KERNEL32(?,?,?,?,?,000000FC,00000001,00007FFDFF2312E4,?,?,?,?,?,00007FFDFF231378), ref: 00007FFDFF234FE1

Strings

GetProcessWindowStation, xrefs: 00007FFDFF234EFC
GetLastActivePopup, xrefs: 00007FFDFF234EAF
GetUserObjectInformationA, xrefs: 00007FFDFF234ECE
GetActiveWindow, xrefs: 00007FFDFF234E90
MessageBoxA, xrefs: 00007FFDFF234E6F
USER32.DLL, xrefs: 00007FFDFF234E56

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Pointer$AddressDecodeProc$Encode$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3085332118-232180764
Opcode ID: 2e82e3b323785dd4e3a64b00ea04288ac91efc02eb5e2f21cda7a63e61b36ceb
Instruction ID: 9c17d80ea712e65443c05c414bfec370efabffed6a4752ab82299b3c82f97c4e
Opcode Fuzzy Hash: 2e82e3b323785dd4e3a64b00ea04288ac91efc02eb5e2f21cda7a63e61b36ceb
Instruction Fuzzy Hash: D9512AA0B1AB4344FF54DB55A8709B82390AF46B80F480735EC7DCB7DAEE7CE5858214

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DED40 Relevance: 21.2, APIs: 14, Instructions: 191windowCOMMON

Download Yara Rule

APIs

FillRect.USER32 ref: 00007FFDFF1DEDBF
FillRect.USER32 ref: 00007FFDFF1DEDD6
GetSysColor.USER32 ref: 00007FFDFF1DEDDF
SetBkColor.GDI32 ref: 00007FFDFF1DEDEB
FillRect.USER32 ref: 00007FFDFF1DEDFD
GetSysColor.USER32 ref: 00007FFDFF1DEE08
SetBkColor.GDI32 ref: 00007FFDFF1DEE14
GetSysColor.USER32 ref: 00007FFDFF1DEE1F
SetTextColor.GDI32 ref: 00007FFDFF1DEE2B
InflateRect.USER32 ref: 00007FFDFF1DEEA5
DrawTextW.USER32 ref: 00007FFDFF1DEEE8
DrawTextA.USER32 ref: 00007FFDFF1DEF07
DrawFocusRect.USER32 ref: 00007FFDFF1DEF1C
SetTextAlign.GDI32 ref: 00007FFDFF1DF000

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Color$Rect$Text$DrawFill$AlignFocusInflate
String ID:
API String ID: 1753992375-0
Opcode ID: a3b0c5fa26a39a25ec0b7bc7932076468720baa26f9dc0264b02ed942989af6f
Instruction ID: 2f044301943e05ab58b82ba62f6c9b5844d98691cc077cde351b41797dcaa383
Opcode Fuzzy Hash: a3b0c5fa26a39a25ec0b7bc7932076468720baa26f9dc0264b02ed942989af6f
Instruction Fuzzy Hash: D2914D72B18B4186E7508F25E45096EB371FB89B85F145235EEAE87B98DF7CE484CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DF7CC Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1DE218: GetClientRect.USER32 ref: 00007FFDFF1DE249

CreateCompatibleBitmap.GDI32 ref: 00007FFDFF1DF810
CreateCompatibleDC.GDI32 ref: 00007FFDFF1DF81C
SelectObject.GDI32 ref: 00007FFDFF1DF82B
FillRect.USER32 ref: 00007FFDFF1DF854
SendMessageA.USER32 ref: 00007FFDFF1DF86C
BitBlt.GDI32 ref: 00007FFDFF1DF898
GetStockObject.GDI32 ref: 00007FFDFF1DF8A0
SelectObject.GDI32 ref: 00007FFDFF1DF8AC
SelectObject.GDI32 ref: 00007FFDFF1DF8B8
DeleteDC.GDI32 ref: 00007FFDFF1DF8C1
DeleteObject.GDI32 ref: 00007FFDFF1DF8CA

Strings

, xrefs: 00007FFDFF1DF872

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Object$Select$CompatibleCreateDeleteRect$BitmapClientFillMessageSendStock
String ID:
API String ID: 2736277039-3916222277
Opcode ID: cba81942cc72ea239b3b865416d91da52741d9c53c6d22f628ae2cd5a8d6173f
Instruction ID: 05ec772d1f85df0b928130e14763950e4a79b1b364279f96ebacf9db4655eee6
Opcode Fuzzy Hash: cba81942cc72ea239b3b865416d91da52741d9c53c6d22f628ae2cd5a8d6173f
Instruction Fuzzy Hash: DB318F767187018BD7148F12E858A6AB7A2FB89FD1F404134DE6987B58CF3DE489CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF230E14 Relevance: 18.1, APIs: 12, Instructions: 82COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFDFF230E33

Part of subcall function 00007FFDFF22FD4C: HeapFree.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD62
Part of subcall function 00007FFDFF22FD4C: _errno.LIBCMT ref: 00007FFDFF22FD6C
Part of subcall function 00007FFDFF22FD4C: GetLastError.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD74

free.LIBCMT ref: 00007FFDFF230E41
free.LIBCMT ref: 00007FFDFF230E4F
free.LIBCMT ref: 00007FFDFF230E5D
free.LIBCMT ref: 00007FFDFF230E6B
free.LIBCMT ref: 00007FFDFF230E79
free.LIBCMT ref: 00007FFDFF230E8A
free.LIBCMT ref: 00007FFDFF230EA2
_lock.LIBCMT ref: 00007FFDFF230EAC
free.LIBCMT ref: 00007FFDFF230EDA
_lock.LIBCMT ref: 00007FFDFF230EEF
free.LIBCMT ref: 00007FFDFF230F39

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: free$_lock$ErrorFreeHeapLast_errno
String ID:
API String ID: 1575098132-0
Opcode ID: 9eaeb06af66d76f43f01b434b3e69dcc1442da3f0981aab6ca058e75a8b23b52
Instruction ID: 7d81b1c37f9c5a26d1c7ec5673cde80c2de69ed5867660521283276c5e85bc50
Opcode Fuzzy Hash: 9eaeb06af66d76f43f01b434b3e69dcc1442da3f0981aab6ca058e75a8b23b52
Instruction Fuzzy Hash: 1831DB65B0A50245FF59EBA1D0B1B783361AF84B48F441735D93ECE7CE8F1CE9808265

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E8D90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FFDFF1E8DBD
SetWindowLongPtrA.USER32 ref: 00007FFDFF1E8DD8
DefWindowProcA.USER32 ref: 00007FFDFF1E8DEB
SetWindowLongA.USER32 ref: 00007FFDFF1E8E06
BeginPaint.USER32 ref: 00007FFDFF1E8E24
EndPaint.USER32 ref: 00007FFDFF1E8EA5

Strings

, xrefs: 00007FFDFF1E8EE1

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Window$Long$Paint$BeginProc
String ID:
API String ID: 2954720972-3916222277
Opcode ID: f37fc3628b41853b83bd4ae39bca91aaa9b6ef58c7a4fb0748555d1234068016
Instruction ID: 8a970a2ca8830813eb5da5aa8e6fcab4fde9aad7cdd1a964ea37092ce657ce39
Opcode Fuzzy Hash: f37fc3628b41853b83bd4ae39bca91aaa9b6ef58c7a4fb0748555d1234068016
Instruction Fuzzy Hash: 53519122F0864286FB64DB269464BB923A1FB89B94F144232DE7E877CDDF3CE5458704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF233DEC Relevance: 15.1, APIs: 10, Instructions: 121COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233E1B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233E35
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233E5B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233EB0
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233EEC
free.LIBCMT ref: 00007FFDFF233EFA
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233F05
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233F1D
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233F5E
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,?,?,00007FFDFF22F9B3), ref: 00007FFDFF233F7A

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide$ErrorLastfree
String ID:
API String ID: 994105223-0
Opcode ID: 1f064ed7a373630bc32a020183496b02dbb363b7bc83c8f35f61365713518047
Instruction ID: 2aa5753d4207735b1797ef811b6684749355ca9f28a3009ddfa820dcb2c7e795
Opcode Fuzzy Hash: 1f064ed7a373630bc32a020183496b02dbb363b7bc83c8f35f61365713518047
Instruction Fuzzy Hash: 204181A2B0874281EB549F11A4A487877A1BF45B90B540634DA7EEBBDCCF7CE9D1C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1D5900 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

LoadCursorA.USER32 ref: 00007FFDFF1DE39B
SetCursor.USER32 ref: 00007FFDFF1DE3A4

Strings

Scintilla, xrefs: 00007FFDFF1DE340
SciLexer, xrefs: 00007FFDFF1DE359

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Cursor$Load
String ID: SciLexer$Scintilla
API String ID: 1675784387-727677536
Opcode ID: 2d2b64d89ad96170111bb4afa349402c0018a900ed7a6068a7970f36f499ed1f
Instruction ID: 4b31d5a42203d116426587d5c3bf87aa5e5c174bbcc2d994e85fe8016968bb17
Opcode Fuzzy Hash: 2d2b64d89ad96170111bb4afa349402c0018a900ed7a6068a7970f36f499ed1f
Instruction Fuzzy Hash: BA21D362F0D70396EBA58B25987493E27A29F85742F248735C43EC66DCEF3CB9859301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2308E8 Relevance: 13.8, APIs: 11, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFDFF230934

Part of subcall function 00007FFDFF22FD4C: HeapFree.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD62
Part of subcall function 00007FFDFF22FD4C: _errno.LIBCMT ref: 00007FFDFF22FD6C
Part of subcall function 00007FFDFF22FD4C: GetLastError.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD74

Part of subcall function 00007FFDFF234C24: free.LIBCMT ref: 00007FFDFF234C42
Part of subcall function 00007FFDFF234C24: free.LIBCMT ref: 00007FFDFF234C54
Part of subcall function 00007FFDFF234C24: free.LIBCMT ref: 00007FFDFF234C66
Part of subcall function 00007FFDFF234C24: free.LIBCMT ref: 00007FFDFF234C78
Part of subcall function 00007FFDFF234C24: free.LIBCMT ref: 00007FFDFF234C8A
Part of subcall function 00007FFDFF234C24: free.LIBCMT ref: 00007FFDFF234C9C
Part of subcall function 00007FFDFF234C24: free.LIBCMT ref: 00007FFDFF234CAE

free.LIBCMT ref: 00007FFDFF230956
free.LIBCMT ref: 00007FFDFF23096E
free.LIBCMT ref: 00007FFDFF23097A
free.LIBCMT ref: 00007FFDFF23099E
free.LIBCMT ref: 00007FFDFF2309B2
free.LIBCMT ref: 00007FFDFF2309C1
free.LIBCMT ref: 00007FFDFF2309CD
free.LIBCMT ref: 00007FFDFF2309FA
free.LIBCMT ref: 00007FFDFF230A22
free.LIBCMT ref: 00007FFDFF230A3C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 6db853f7139b46b1748a02a76d94e57502c0ce5066eb1a01dceee37d26322552
Instruction ID: ce2ed2146727c3d7cbd4a57ad789f4c5efcdf04e0dcc8eae576061bcc33d5f16
Opcode Fuzzy Hash: 6db853f7139b46b1748a02a76d94e57502c0ce5066eb1a01dceee37d26322552
Instruction Fuzzy Hash: 5041D872B1968684FF55DB65D470BB82360AF84F58F480631DE3DCE3DECE6CA5918260

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2346F8 Relevance: 13.7, APIs: 9, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,?,?,00000107,00007FFDFF2349CA), ref: 00007FFDFF234758
GetLastError.KERNEL32(?,?,?,?,?,?,00000107,00007FFDFF2349CA), ref: 00007FFDFF23476A
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,00000107,00007FFDFF2349CA), ref: 00007FFDFF2347CA
malloc.LIBCMT ref: 00007FFDFF234836
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,00000107,00007FFDFF2349CA), ref: 00007FFDFF234880
GetStringTypeW.KERNEL32(?,?,?,?,?,?,00000107,00007FFDFF2349CA), ref: 00007FFDFF234897
free.LIBCMT ref: 00007FFDFF2348A8
GetStringTypeA.KERNEL32(?,?,?,?,?,?,00000107,00007FFDFF2349CA), ref: 00007FFDFF234925
free.LIBCMT ref: 00007FFDFF234935

Part of subcall function 00007FFDFF2360B0: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF236106
Part of subcall function 00007FFDFF2360B0: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF236125
Part of subcall function 00007FFDFF2360B0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF236229
Part of subcall function 00007FFDFF2360B0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,?,00000000,?,00000000,?), ref: 00007FFDFF236264

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Infofree$ErrorLastmalloc
String ID:
API String ID: 3804003340-0
Opcode ID: 13137d0530c6258c4cecb949efd4c55dbe1fa709db5765d6179791ea5039cb09
Instruction ID: 6aa885fbe4f44e64ef8dca6ef6bf2872dee115402d6682cc0f8a4a63e1d3a4d8
Opcode Fuzzy Hash: 13137d0530c6258c4cecb949efd4c55dbe1fa709db5765d6179791ea5039cb09
Instruction Fuzzy Hash: 646194B2B0868186E7609F5198A08687795FB45BE8B540735EE3DDBBDCDF7CE9808340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DE74C Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1DE0E4: GetWindowRect.USER32 ref: 00007FFDFF1DE0F6

GetDC.USER32 ref: 00007FFDFF1DE7CC
SelectObject.GDI32 ref: 00007FFDFF1DE7DC
GetTextExtentPoint32W.GDI32 ref: 00007FFDFF1DE840
GetTextExtentPoint32A.GDI32 ref: 00007FFDFF1DE85A
GetTextMetricsA.GDI32 ref: 00007FFDFF1DE868
SelectObject.GDI32 ref: 00007FFDFF1DE880
ReleaseDC.USER32 ref: 00007FFDFF1DE88D
GetSystemMetrics.USER32 ref: 00007FFDFF1DE8DE
AdjustWindowRectEx.USER32 ref: 00007FFDFF1DE8F8

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Text$ExtentMetricsObjectPoint32RectSelectWindow$AdjustReleaseSystem
String ID:
API String ID: 2082942421-0
Opcode ID: e08b485109c0f440d0e3ef88323c2edb791b0547969e7b759e9376df56041b73
Instruction ID: 43e560df37f646500bc4985d5a2ee0d5ca2283fc09e2f7c5c272fc5ea12ee2dc
Opcode Fuzzy Hash: e08b485109c0f440d0e3ef88323c2edb791b0547969e7b759e9376df56041b73
Instruction Fuzzy Hash: 4551A273B0468586D750DF26E464A6E73A5FB89B89F404231EE6E87798CF3CE845CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF232D90 Relevance: 13.6, APIs: 9, Instructions: 98COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FFDFF232DB9
DecodePointer.KERNEL32 ref: 00007FFDFF232DEC
DecodePointer.KERNEL32 ref: 00007FFDFF232E09
DecodePointer.KERNEL32 ref: 00007FFDFF232E48
DecodePointer.KERNEL32 ref: 00007FFDFF232E61
DecodePointer.KERNEL32 ref: 00007FFDFF232E70
_initterm.LIBCMT ref: 00007FFDFF232EAF
_initterm.LIBCMT ref: 00007FFDFF232EC2
ExitProcess.KERNEL32 ref: 00007FFDFF232EFB

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: DecodePointer$_initterm$ExitProcess_lock
String ID:
API String ID: 2551688548-0
Opcode ID: b71efe3907c1a25f888b91d33c002a6688df67601a4a9a617049103d994e407e
Instruction ID: 1960a6211d426683505e20a3c9d0e6a3a3e78b9fb0aefdbebd78f31f9eba1075
Opcode Fuzzy Hash: b71efe3907c1a25f888b91d33c002a6688df67601a4a9a617049103d994e407e
Instruction Fuzzy Hash: AC41AFA1B1A64281EB50DB01E8619787394BF48784F040338EA7DCA7EEDFBCE481C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DC9D8 Relevance: 13.6, APIs: 9, Instructions: 56windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FFDFF1DC9F4
DeleteObject.GDI32 ref: 00007FFDFF1DC9FE
SelectObject.GDI32 ref: 00007FFDFF1DCA19
DeleteObject.GDI32 ref: 00007FFDFF1DCA23
SelectObject.GDI32 ref: 00007FFDFF1DCA3E
SelectObject.GDI32 ref: 00007FFDFF1DCA59
DeleteObject.GDI32 ref: 00007FFDFF1DCA63
SelectPalette.GDI32 ref: 00007FFDFF1DCA84
DeleteDC.GDI32 ref: 00007FFDFF1DCA98

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Object$Select$Delete$Palette
String ID:
API String ID: 213217401-0
Opcode ID: 78a9329245d1274e096a20fe25956b2885dfe4eeae306a5ca254faa183350fd1
Instruction ID: e44208c48a96eb8362f204532054cea63f8df2b1c265a40915dc4c5190c16d3e
Opcode Fuzzy Hash: 78a9329245d1274e096a20fe25956b2885dfe4eeae306a5ca254faa183350fd1
Instruction Fuzzy Hash: 9521D8B6A18B0186D7148F25EA9442C73B6FB45FC8B105235CE7D8A7ACDF39D895C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E8918 Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00007FFDFF1E89E6
GlobalSize.KERNEL32 ref: 00007FFDFF1E8A0D
ScreenToClient.USER32 ref: 00007FFDFF1E8B5D
GlobalUnlock.KERNEL32 ref: 00007FFDFF1E8BBC

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Global$ClientLockScreenSizeUnlock
String ID:
API String ID: 2805851903-0
Opcode ID: 8686568280dbf83aa44fa6e417f9302d0f4de86972a32286387ca6eff0e22f80
Instruction ID: d7980122d67ce4a01a0472156e9333f5b2fa5ace603a970524a83eba19b14338
Opcode Fuzzy Hash: 8686568280dbf83aa44fa6e417f9302d0f4de86972a32286387ca6eff0e22f80
Instruction Fuzzy Hash: CB916173B086C186D724DF25E454AAAB7A1F785B90F104635DAAA97BD8CF3CD481CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF235994 Relevance: 12.1, APIs: 8, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FFDFF2359BD
_errno.LIBCMT ref: 00007FFDFF2359C6
__doserrno.LIBCMT ref: 00007FFDFF235A15
_errno.LIBCMT ref: 00007FFDFF235A1C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 5e0216f213588a50212f73a5a4aec4dd37b0a117b03eae22cb22f75283446dc5
Instruction ID: d5be53be3383e64f8f457fc357e5e6defed0bf285336e95c06156bdfe398c1a4
Opcode Fuzzy Hash: 5e0216f213588a50212f73a5a4aec4dd37b0a117b03eae22cb22f75283446dc5
Instruction Fuzzy Hash: D631C0B2B1829245E7159F65A8A297D7B50AF80B60F554331EA3DCF7DACF7CE4828700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DDB0C Relevance: 10.7, APIs: 7, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1DCC74: SelectObject.GDI32 ref: 00007FFDFF1DCC99

GetTextExtentExPointW.GDI32 ref: 00007FFDFF1DDBC3
GetTextExtentPoint32W.GDI32 ref: 00007FFDFF1DDBF1
MultiByteToWideChar.KERNEL32 ref: 00007FFDFF1DDCDF
MultiByteToWideChar.KERNEL32 ref: 00007FFDFF1DDD06
GetTextExtentPoint32W.GDI32 ref: 00007FFDFF1DDD31
IsDBCSLeadByteEx.KERNEL32 ref: 00007FFDFF1DDD72
GetTextExtentExPointA.GDI32 ref: 00007FFDFF1DDDD4

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: ExtentText$Byte$CharMultiPointPoint32Wide$LeadObjectSelect
String ID:
API String ID: 4132324575-0
Opcode ID: 5b0136683d906342e4df677a696098cb57ddad37dee8e43c30912c1546a4163c
Instruction ID: dee3ea905c8ccc1d794baa0614bd746edfd16046e22a882da1c83be7a5ebba24
Opcode Fuzzy Hash: 5b0136683d906342e4df677a696098cb57ddad37dee8e43c30912c1546a4163c
Instruction Fuzzy Hash: 32919062F0878586EB209F15E0949AE7771FB85788F504235DA6D43B9DEF3CE546CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF233698 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 00007FFDFF2336BD

Part of subcall function 00007FFDFF232A80: Sleep.KERNEL32(?,?,?,00007FFDFF230D9F,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF232AC5

GetFileType.KERNEL32 ref: 00007FFDFF23383A

Strings

@, xrefs: 00007FFDFF233935

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID: @
API String ID: 1527402494-2766056989
Opcode ID: 70a2d2ea3702c63a6df8e2767d7105796ea43283e755f09b05e2ecf2c78b17bb
Instruction ID: aaeea46ff962da0de4c25d2cb5e73494e43378162eccc7f0b1e8b2f90c4f3c0b
Opcode Fuzzy Hash: 70a2d2ea3702c63a6df8e2767d7105796ea43283e755f09b05e2ecf2c78b17bb
Instruction Fuzzy Hash: 579190A1B0869281E7108F28D4A8A683795BB06774F254735C67DDB3E9CF7DED82C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF236F38 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FFDFF236F51
_errno.LIBCMT ref: 00007FFDFF236F9E

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: dee4bd3cb8b946069a342dc4b2f3c205795d501fec933c9add919682ee652058
Instruction ID: bd667dda971c71825f69cd8c3c5f1dba8f72135452e95498a85e749b0eea85b9
Opcode Fuzzy Hash: dee4bd3cb8b946069a342dc4b2f3c205795d501fec933c9add919682ee652058
Instruction Fuzzy Hash: 8831C4A1F1C68245FB159F259871F7D2B51AF80750F544334EA3ECE6DACF7CA4818210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2368AC Relevance: 9.1, APIs: 6, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

__initconout.LIBCMT ref: 00007FFDFF2368DA

Part of subcall function 00007FFDFF236DBC: CreateFileA.KERNEL32 ref: 00007FFDFF236DE5

WriteConsoleW.KERNEL32 ref: 00007FFDFF236906
GetLastError.KERNEL32 ref: 00007FFDFF236921
GetConsoleOutputCP.KERNEL32 ref: 00007FFDFF236933
WideCharToMultiByte.KERNEL32 ref: 00007FFDFF236966
WriteConsoleA.KERNEL32 ref: 00007FFDFF23698C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide__initconout
String ID:
API String ID: 2210154019-0
Opcode ID: ff5c1ec2110e3c9d8427f88193a2b399819a378c0c8cb7cdf8c3035b68acafdf
Instruction ID: 64c8f75046c46af4727bc62bce8b9d8b3ba57011d23064e76470ee1f22702ba4
Opcode Fuzzy Hash: ff5c1ec2110e3c9d8427f88193a2b399819a378c0c8cb7cdf8c3035b68acafdf
Instruction Fuzzy Hash: 25314CA1B1894282FB109F10E425B7967A4FB86B75F500335E5BDCA9DCCFBDD5898B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF230D6C Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2,?,?,?,00007FFDFF22E0FB), ref: 00007FFDFF230D76
FlsGetValue.KERNEL32(?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2,?,?,?,00007FFDFF22E0FB), ref: 00007FFDFF230D84
SetLastError.KERNEL32(?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2,?,?,?,00007FFDFF22E0FB), ref: 00007FFDFF230DDC

Part of subcall function 00007FFDFF232A80: Sleep.KERNEL32(?,?,?,00007FFDFF230D9F,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF232AC5

FlsSetValue.KERNEL32(?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2,?,?,?,00007FFDFF22E0FB), ref: 00007FFDFF230DB0
free.LIBCMT ref: 00007FFDFF230DD3

Part of subcall function 00007FFDFF230CB8: _lock.LIBCMT ref: 00007FFDFF230D08
Part of subcall function 00007FFDFF230CB8: _lock.LIBCMT ref: 00007FFDFF230D28

GetCurrentThreadId.KERNEL32 ref: 00007FFDFF230DC4

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 0a8204f6f33cb5e66b91052a81dc48ea5e40ee39a0ff7f9395dcb28afdf64f6f
Instruction ID: 75dc275b8d833e9ecef72ec854504e64cd5681abc0f420af5b8b2dc5422df0e2
Opcode Fuzzy Hash: 0a8204f6f33cb5e66b91052a81dc48ea5e40ee39a0ff7f9395dcb28afdf64f6f
Instruction Fuzzy Hash: F8012561B09B4282FB549F69A4748793392EF4A764B148334CD3DCA3DDEE3CF4858621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DAEC8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF22E0DC: malloc.LIBCMT ref: 00007FFDFF22E0F6

LoadLibraryA.KERNEL32 ref: 00007FFDFF1DAF37

Strings

GetLexerCount, xrefs: 00007FFDFF1DAF68
Lex, xrefs: 00007FFDFF1DAF94
Fold, xrefs: 00007FFDFF1DAFA7
GetLexerName, xrefs: 00007FFDFF1DAF84

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: LibraryLoadmalloc
String ID: Fold$GetLexerCount$GetLexerName$Lex
API String ID: 3900084889-2069656008
Opcode ID: 2ffab1b4f0c2d0a3a85dfa083b6e4375b7e11e582e46a2457288091af32bab15
Instruction ID: be934961fa22aedfb877b25d9d30217b1746266465f8b7beb8e9763b5c8c80e0
Opcode Fuzzy Hash: 2ffab1b4f0c2d0a3a85dfa083b6e4375b7e11e582e46a2457288091af32bab15
Instruction Fuzzy Hash: B5512872B04B4682EB10DB15E4A47AD73A0FB48B84F548235DE6D4B7A9DF7DD455C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DE5F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FFDFF1DE63C
CreateWindowExA.USER32 ref: 00007FFDFF1DE68D
MapWindowPoints.USER32 ref: 00007FFDFF1DE6A9

Strings

ListBoxX, xrefs: 00007FFDFF1DE677
P, xrefs: 00007FFDFF1DE663

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Window$CreateLongPoints
String ID: ListBoxX$P
API String ID: 162144314-2724320830
Opcode ID: 52558d631af45d60a490c8f099cbc23d1e02361306a5efb31e074ab7b50107df
Instruction ID: a1dd7b98e9eb8faa509aff14b4a2b8b0a0210be0c00f1bffcb7a83f55819e685
Opcode Fuzzy Hash: 52558d631af45d60a490c8f099cbc23d1e02361306a5efb31e074ab7b50107df
Instruction Fuzzy Hash: 05113D72608B8186E710CF14F44079A77A4F788B54F244235E7A987B68CF3DC096CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF234C24 Relevance: 8.8, APIs: 7, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FFDFF234C42

Part of subcall function 00007FFDFF22FD4C: HeapFree.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD62
Part of subcall function 00007FFDFF22FD4C: _errno.LIBCMT ref: 00007FFDFF22FD6C
Part of subcall function 00007FFDFF22FD4C: GetLastError.KERNEL32(?,?,00000000,00007FFDFF230DD8,?,?,?,00007FFDFF23232D,?,?,?,?,00007FFDFF22FFA2), ref: 00007FFDFF22FD74

free.LIBCMT ref: 00007FFDFF234C54
free.LIBCMT ref: 00007FFDFF234C66
free.LIBCMT ref: 00007FFDFF234C78
free.LIBCMT ref: 00007FFDFF234C8A
free.LIBCMT ref: 00007FFDFF234C9C
free.LIBCMT ref: 00007FFDFF234CAE

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: d51a666402fb47c19eb42a99d15c53fe91c408ce5428aee34a45398d462b8c2b
Instruction ID: c36b25df41367f85a6f2026c738d60a9938b8d676448c417cb3ecc586eb16f26
Opcode Fuzzy Hash: d51a666402fb47c19eb42a99d15c53fe91c408ce5428aee34a45398d462b8c2b
Instruction Fuzzy Hash: 0B019962B0980291FB55DB91D4F28783361AF94744F850A72DD3ECA5DE8EACF9C08264

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E79AC Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 00007FFDFF1E7A4E
GlobalLock.KERNEL32 ref: 00007FFDFF1E7A5F
GlobalAlloc.KERNEL32 ref: 00007FFDFF1E7A90
GlobalLock.KERNEL32 ref: 00007FFDFF1E7AA1
GlobalUnlock.KERNEL32 ref: 00007FFDFF1E7AC5

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Global$AllocLock$Unlock
String ID:
API String ID: 3539109396-0
Opcode ID: a288ba400e94511ccb48c1cf40598669454151759060f1defe2dd6b8497c930f
Instruction ID: de5e9e939c5a8d93947262a23f6dd83727361941e3b82a7e5bb50cf5fa017afc
Opcode Fuzzy Hash: a288ba400e94511ccb48c1cf40598669454151759060f1defe2dd6b8497c930f
Instruction Fuzzy Hash: 90314762F0A78286EB249F21E06456963A1EB84B84F084635DB7A473C9DF7CFA84C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E6B6C Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32 ref: 00007FFDFF1E6C06
CreateRectRgn.GDI32 ref: 00007FFDFF1E6C1E
CombineRgn.GDI32 ref: 00007FFDFF1E6C3D
DeleteObject.GDI32 ref: 00007FFDFF1E6C51
DeleteObject.GDI32 ref: 00007FFDFF1E6C5A

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: CreateDeleteObjectRect$Combine
String ID:
API String ID: 2067609871-0
Opcode ID: 7c8713bd5d6bcbfd2bef2450c0254898ae6bee78d9bb6d1807855076742bffa2
Instruction ID: af94ecb7ae9b1fe784c8431580ee44f5240c88f8f0b86d1b9f5c90f1dcb0d359
Opcode Fuzzy Hash: 7c8713bd5d6bcbfd2bef2450c0254898ae6bee78d9bb6d1807855076742bffa2
Instruction Fuzzy Hash: 9C318E73B1468686E3148F21D5A49AC7361F749F80F944635CA7987799CF3CF8A5C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DCC0C Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FFDFF1DCC27
DeleteObject.GDI32 ref: 00007FFDFF1DCC31
GetNearestColor.GDI32 ref: 00007FFDFF1DCC49
CreateSolidBrush.GDI32 ref: 00007FFDFF1DCC51
SelectObject.GDI32 ref: 00007FFDFF1DCC62

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Object$Select$BrushColorCreateDeleteNearestSolid
String ID:
API String ID: 2375338405-0
Opcode ID: e47441e30976984e43c325bae6c40830caf9c774175427a3007738b6f587449c
Instruction ID: 8d4e91a70652f64647111c4926a90911b79552562581f27b231059e2447e2578
Opcode Fuzzy Hash: e47441e30976984e43c325bae6c40830caf9c774175427a3007738b6f587449c
Instruction Fuzzy Hash: 2BF0EC76A15B018BDB448F21E4A872933B5FB89F59F101635CE2E9A398CF39D4D5C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E7704 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FFDFF1E7727
CreateWindowExA.USER32 ref: 00007FFDFF1E7775

Strings

ACallTip, xrefs: 00007FFDFF1E7732
CallTip, xrefs: 00007FFDFF1E7762

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Window$CreateLong
String ID: ACallTip$CallTip
API String ID: 1475011609-1662286206
Opcode ID: dbea683522d1c730bb75b1b5fad904775fc79d7f7fe1d5dc92676b5c21b90bc2
Instruction ID: 68fe15763107d380f02250a1ea0ffb6c19dcbd46c60de1576f90f3cc1b17b847
Opcode Fuzzy Hash: dbea683522d1c730bb75b1b5fad904775fc79d7f7fe1d5dc92676b5c21b90bc2
Instruction Fuzzy Hash: 82012D72608B8187E7548F28F554799B7A0F748754F244235EBA98B798DF3DD0A5CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF232C04 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00007FFDFF232C4D,?,?,00000000,00007FFDFF234492,?,?,?,00007FFDFF23455F), ref: 00007FFDFF232C13
GetProcAddress.KERNEL32(?,?,000000FF,00007FFDFF232C4D,?,?,00000000,00007FFDFF234492,?,?,?,00007FFDFF23455F), ref: 00007FFDFF232C28

Strings

CorExitProcess, xrefs: 00007FFDFF232C1E
mscoree.dll, xrefs: 00007FFDFF232C0C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 284b1cc4e5b3155bfd53f47e4293e2cdaa7eb1468d550c2b942aa836089c5e81
Instruction ID: 91950a61ed48f486633e83e94939efa734d472210d9ab7d50c63285adb11ccd1
Opcode Fuzzy Hash: 284b1cc4e5b3155bfd53f47e4293e2cdaa7eb1468d550c2b942aa836089c5e81
Instruction Fuzzy Hash: C4E08CA0B0A30641FF084B50A8A497423506F48700B480A38C43ECA3D8DF7CE4C8C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E7EB0 Relevance: 6.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

ImmGetContext.IMM32 ref: 00007FFDFF1E7EF4
ImmSetCompositionWindow.IMM32 ref: 00007FFDFF1E7F30
ImmSetCompositionFontA.IMM32(?), ref: 00007FFDFF1E8097
ImmReleaseContext.IMM32 ref: 00007FFDFF1E80B5

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: CompositionContext$FontReleaseWindow
String ID:
API String ID: 3587243089-0
Opcode ID: b8e006bea70a35b6a82125b61ec03fd434ade7a2dc2b44e2f8d1f003af302e2a
Instruction ID: 0c60d273d3b0a754bcca03362286c764f6ab4ed412818ae8977dec946ccc01df
Opcode Fuzzy Hash: b8e006bea70a35b6a82125b61ec03fd434ade7a2dc2b44e2f8d1f003af302e2a
Instruction Fuzzy Hash: 4051A177A0C6C18AD714DB25E0605AFBBA4F785784F440225EBAE83B9ADF7DE454CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E57B4 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FFDFF1E58A9
ImmSetCompositionWindow.IMM32 ref: 00007FFDFF1E591C
ImmReleaseContext.IMM32 ref: 00007FFDFF1E5928
DefWindowProcA.USER32 ref: 00007FFDFF1E593C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Window$ByteCharCompositionContextMultiProcReleaseWide
String ID:
API String ID: 3977324709-0
Opcode ID: 3dc14d72a87a3d095729a1d49f7192b22b93132e756e8a99f5e4b108138a51ba
Instruction ID: 4cf5bea4645e5d188bbef59db7c5ac65060a9691a40d85ea940faa0dd0da5dcf
Opcode Fuzzy Hash: 3dc14d72a87a3d095729a1d49f7192b22b93132e756e8a99f5e4b108138a51ba
Instruction Fuzzy Hash: 2341A762B0C68286E710DB65E074BEEA7A0FB85B84F444135DBAD87B99DF3CE405CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DDA04 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF1DCC74: SelectObject.GDI32 ref: 00007FFDFF1DCC99

GetTextExtentPoint32W.GDI32 ref: 00007FFDFF1DDA6F
MultiByteToWideChar.KERNEL32 ref: 00007FFDFF1DDAA0
MultiByteToWideChar.KERNEL32 ref: 00007FFDFF1DDAC1
GetTextExtentPoint32A.GDI32 ref: 00007FFDFF1DDAE3

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: ByteCharExtentMultiPoint32TextWide$ObjectSelect
String ID:
API String ID: 2885946197-0
Opcode ID: 5a898a046883d93383dee5c151781ae58e45a7dbf96ed0f3de4a502e5a0070fd
Instruction ID: d12b3d824fd8416a5cab5d58eb8f3b1a498be90b47ab2802888a9ae0f3a4d980
Opcode Fuzzy Hash: 5a898a046883d93383dee5c151781ae58e45a7dbf96ed0f3de4a502e5a0070fd
Instruction Fuzzy Hash: 2E21C263F1C78196E764CB25A46086D77A4FB86B84F045235EE6D83B99DF3CE950CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1E85F8 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FFDFF1E861B
GetStockObject.GDI32 ref: 00007FFDFF1E8629
SelectObject.GDI32 ref: 00007FFDFF1E8635
ReleaseDC.USER32 ref: 00007FFDFF1E8687

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Object$ReleaseSelectStock
String ID:
API String ID: 3383022508-0
Opcode ID: 5f20d1a40bc0a6f1281a52c6e575e2a95c4d33682f7a3e1fcc9ed37259b7025a
Instruction ID: 69a1296e3b2f28db119d9815cef0e95499a0ae8566bc3870a588ed854f3af3da
Opcode Fuzzy Hash: 5f20d1a40bc0a6f1281a52c6e575e2a95c4d33682f7a3e1fcc9ed37259b7025a
Instruction Fuzzy Hash: B7110A66B08A4682EB149F22E4645AD6761FB89FC0F084131DF6E4BB99DF2CD0558704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF230C90 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,00007FFDFF22FA2F), ref: 00007FFDFF230C9F
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF22FA2F), ref: 00007FFDFF2343EE
free.LIBCMT ref: 00007FFDFF2343F7
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFF22FA2F), ref: 00007FFDFF234417

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 2ad3d28c587bd08eb7902974d992a7a010c9b92d8139d310635880315e2a9b10
Instruction ID: 56ec3767afdd220ff0a04d9afe4ae31c5220456dc7f60c021df9278e741f87be
Opcode Fuzzy Hash: 2ad3d28c587bd08eb7902974d992a7a010c9b92d8139d310635880315e2a9b10
Instruction Fuzzy Hash: F7115BB1F09A42C2EB189B11B4A05787360FB06B54F594331DA79CAADDCF3CE5A28B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF236E34 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FFDFF236E49

Part of subcall function 00007FFDFF232254: DecodePointer.KERNEL32 ref: 00007FFDFF23227B

_flush.LIBCMT ref: 00007FFDFF236E72
_freebuf.LIBCMT ref: 00007FFDFF236E7C

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: DecodePointer_errno_flush_freebuf
String ID:
API String ID: 1889905870-0
Opcode ID: e8fbb785bd74b5e55ce1839b5dd3b53b9a68c1d6d0f3ecba4533074e0c9cf71c
Instruction ID: 003f8aee78de8a0031af3676967f53128fcbb0516309b763914a156ebd9af09d
Opcode Fuzzy Hash: e8fbb785bd74b5e55ce1839b5dd3b53b9a68c1d6d0f3ecba4533074e0c9cf71c
Instruction Fuzzy Hash: 7101C0A2F1C50242FF149A79D431F7967956F85B64F280330EA39CA1CACF3DE4848244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DCE4C Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

CreatePatternBrush.GDI32 ref: 00007FFDFF1DCE6A
CreateSolidBrush.GDI32 ref: 00007FFDFF1DCE77
FillRect.USER32 ref: 00007FFDFF1DCEC3
DeleteObject.GDI32 ref: 00007FFDFF1DCECC

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: BrushCreate$DeleteFillObjectPatternRectSolid
String ID:
API String ID: 228723661-0
Opcode ID: 85d420660b7462b87324221a53b7fa1b454c96b4a6a58487206dbbfdbc75cdfc
Instruction ID: ee696d3c806b897af075ec9100d60f99690e2aedc430439a1ebfe7a7bbcc5003
Opcode Fuzzy Hash: 85d420660b7462b87324221a53b7fa1b454c96b4a6a58487206dbbfdbc75cdfc
Instruction Fuzzy Hash: D101FE76A0878586D7208F15F45046AB771FB89B80F045635EFAD96B58DF3CD194CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF236758 Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FFDFF236761
_errno.LIBCMT ref: 00007FFDFF236769

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: c48c262b56f1e5ceb7cc8fb55cf3b5e6f0d362ffa26c9279143439e32e8b221e
Instruction ID: 648b2716506bd00a9f6f2685d8b589399c68fccaf4ad76047e0632b12963b7b1
Opcode Fuzzy Hash: c48c262b56f1e5ceb7cc8fb55cf3b5e6f0d362ffa26c9279143439e32e8b221e
Instruction Fuzzy Hash: 67019EA2B2865641FB195B14C875FB82B60AF90B21F908371DA3ECE7DACF7C70818611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DE6C0 Relevance: 6.0, APIs: 4, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32 ref: 00007FFDFF1DE6E9
DeleteObject.GDI32 ref: 00007FFDFF1DE6FC
CreateFontIndirectA.GDI32 ref: 00007FFDFF1DE70C
SendMessageA.USER32 ref: 00007FFDFF1DE724

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Object$CreateDeleteFontIndirectMessageSend
String ID:
API String ID: 1574616763-0
Opcode ID: fb77201d2635bcecb0717f842d59dac8054e5d3cff8bc725890599b94b91b189
Instruction ID: ce23fcd07b7c473d6156a2cedd5cee66da53f058235d7cd5594a4dab0c108407
Opcode Fuzzy Hash: fb77201d2635bcecb0717f842d59dac8054e5d3cff8bc725890599b94b91b189
Instruction Fuzzy Hash: 4801E8B6B15B4582EB509F21E465BA933B1FB89B85F501231CEADCA798DF3CE544C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF1DCBA8 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FFDFF1DCBC3
DeleteObject.GDI32 ref: 00007FFDFF1DCBCD
CreatePen.GDI32 ref: 00007FFDFF1DCBEB
SelectObject.GDI32 ref: 00007FFDFF1DCBFC

Memory Dump Source

Source File: 00000005.00000002.2925607392.00007FFDFF1C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFDFF1C0000, based on PE: true

Associated: 00000005.00000002.2925589009.00007FFDFF1C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925651851.00007FFDFF239000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925672007.00007FFDFF244000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2925690531.00007FFDFF24A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffdff1c0000_Bat_To_Exe_Converter.jbxd

Similarity

API ID: Object$Select$CreateDelete
String ID:
API String ID: 1326144132-0
Opcode ID: 751b5d9bb94d752f21ae2cdf8d608a1d09a126db09b3295144678e2b6dc4f8de
Instruction ID: 613f63098029f64a51e41439e4dcb44f85e514a05a334a015374bba7c8a9189a
Opcode Fuzzy Hash: 751b5d9bb94d752f21ae2cdf8d608a1d09a126db09b3295144678e2b6dc4f8de
Instruction Fuzzy Hash: B8F037B6A15A0086EB248F21D45472933B1FB8DF58F200234CE6E8A398CF39C496C744

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Bat To Exe Converter\Bat_To_Exe_Converter.exe (copy)

C:\Program Files\Bat To Exe Converter\is-48PVO.tmp

C:\Program Files\Bat To Exe Converter\is-54DM0.tmp

C:\Program Files\Bat To Exe Converter\unins000.dat

C:\Program Files\Bat To Exe Converter\unins000.exe (copy)

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bat To Exe Converter\Bat To Exe Converter.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bat To Exe Converter\Uninstall Bat To Exe Converter.lnk

C:\Users\user\AppData\Local\Temp\is-6FOPC.tmp\SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.tmp

C:\Users\user\AppData\Local\Temp\is-DVABN.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Roaming\Bat To Exe Converter\662566134.cmd

C:\Users\user\AppData\Roaming\Bat To Exe Converter\867292396.bat

C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoLink.exe

C:\Users\user\AppData\Roaming\Bat To Exe Converter\GoRC.exe

C:\Users\user\AppData\Roaming\Bat To Exe Converter\Scilexer.dll

C:\Users\user\AppData\Roaming\Bat To Exe Converter\extd.chm

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\??? (Japanese).lng

C:\Users\user\AppData\Roaming\Bat To Exe Converter\lng\??? (Korean).lng

Windows Analysis Report
SecuriteInfo.com.W32.ABRisk.NJSZ-2550.30267.8823.exe

Function 0000000140001000 Relevance: 247.3, APIs: 13, Strings: 127, Instructions: 2274
commemoryCOMMON

Function 0000000140059267 Relevance: 54.4, APIs: 27, Strings: 4, Instructions: 186
nativewindowCOMMON

Function 00000001400451E8 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 301
memoryfileCOMMON

Function 0000000140042388 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 155
windowCOMMON

Function 000000014004C1BC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 107
libraryloaderCOMMON

Function 000000014005AA9C Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 107
memoryCOMMON